Manalyze report for 023a0f7d059965ae1ee40f244ca7012f5eb86ef0397b504f2914d30a305a770d

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2025-Mar-27 21:11:40
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: /4`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryW` `Code injection capabilities: CreateRemoteThread VirtualAllocEx WriteProcessMemory` `Possibly launches other programs: CreateProcessW` `Memory manipulation functions often used by packers: VirtualAllocEx VirtualProtect` `Manipulates other processes: WriteProcessMemory`
Suspicious	The file contains overlay data.	`14 bytes of data starting at offset 0x4400.`
Malicious	VirusTotal score: 7/71 (Scanned on 2026-08-27 14:07:37)	`APEX: Malicious` `Bkav: W32.Malware.D713F4FD` `CrowdStrike: win/malicious_confidence_90% (D)` `Cylance: Unsafe` `Gridinsoft: Trojan.Win64.Agent.cl` `Rising: Trojan.Generic!8.C3 (CLOUD)` `TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101DK26YA`

Hashes

MD5	`5513a4a14e07f39e854749180142d3c7` 🔍
SHA1	`fc4110eec8e99e21208b080e17b6ae7995d1bf77` 🔍
SHA256	`023a0f7d059965ae1ee40f244ca7012f5eb86ef0397b504f2914d30a305a770d` 🔍
SHA3	`bf9158149544a5efe3ecdd33b470c25e506122f11c55c0ce230f2f1d0539d745` 🔍
SSDeep	`192:VwPll4HLbch7X8dTqFRg92GgRDKdIP5GhLzVRYFXoeIXll4AILt4IW:VwdsHir8dTCGPiWkcZgXo94p2n` 🔍
Imports Hash	`b1ce965958d00e2938205458b08b4618` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	2025-Mar-27 21:11:40
PointerToSymbolTable	`0x4400`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x1c00`
SizeOfInitializedData	`0x4000`
SizeOfUninitializedData	`0x200`
AddressOfEntryPoint	`0x00000000000013D0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xd000`
SizeOfHeaders	`0x400`
Checksum	`0x8dc9`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`2028ce3b9d491b92b8e25f146aa66692 🔍`
SHA1	`73d66e6f071d9ab1d9bf291e5d5d129b3c71dd8a 🔍`
SHA256	`cf1851acf348de3eb805debe001bbf543537e53dc419d13b64e7521725521d10 🔍`
SHA3	`2288683088cfa284e4556f3a6ba45c4cdfaa1d23b7036cb85ee4d79cd9dc794b 🔍`
VirtualSize	`0x1a78`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.82572`

.data

MD5	`90c90cc5fee22278dc26811d366f80b8 🔍`
SHA1	`223fe3a5cc0abc00f3c7e0cab8b552d54e459edc 🔍`
SHA256	`50cafa5d4b2727a5a282c8dafb1bda194fc5ea0854dbc227d55012dfdb9c2525 🔍`
SHA3	`5e0d0a0ec27eb140a5dfd9f0a1785fa5874ed207d6491c6d30d5c5f328a30340 🔍`
VirtualSize	`0xa0`
VirtualAddress	`0x3000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.610103`

.rdata

MD5	`af408bd68e10cf5e9b10bad097355283 🔍`
SHA1	`9bfa0bea86303184433933d2894e6b4406142c5c 🔍`
SHA256	`3bc02e33d66080ff779c2f8eb953843321075f371ac2b4c054a9ebb9565a035f 🔍`
SHA3	`757725ef979c2974983c2c70f1295a504ebd96ec772ea0d7f265c99d17187423 🔍`
VirtualSize	`0x980`
VirtualAddress	`0x4000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x2200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.06186`

/4

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x4`
VirtualAddress	`0x5000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.pdata

MD5	`50dcc6e3184c4f03bf18bfc006ac6d0e 🔍`
SHA1	`9b428ca916ad4ca6242cdf056f9041b178b990d6 🔍`
SHA256	`c236bae6e62ba4d2cf59c49864599a2e634c9ec71aa48e93daf5ff03162f700b 🔍`
SHA3	`b82b6f0afa147eb5034b8c636aff6bdcdc99caaa19d50cd7978f8b5a27a90be1 🔍`
VirtualSize	`0x228`
VirtualAddress	`0x6000`
SizeOfRawData	`0x400`
PointerToRawData	`0x2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.35911`

.xdata

MD5	`d98769a19d8d07b375da98fe3aed68dc 🔍`
SHA1	`6e86a58ca7c1e673938e9546fbdf938d9fd57f01 🔍`
SHA256	`cf524259591a08b327f6773a9d3b9041e20dc8695d1f4b9595e245ce3ca3391f 🔍`
SHA3	`7d4a7a7d33c6cac4aaa3fec66a8e69ba03bb4f635b13821a78068f0e210527ee 🔍`
VirtualSize	`0x1ac`
VirtualAddress	`0x7000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.41152`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x1e0`
VirtualAddress	`0x8000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`55e840b36939f17eeccb0bf8c48207c4 🔍`
SHA1	`49045c1be58f0e1080d4836db268d9c6cc62716f 🔍`
SHA256	`25b0e8764487f84966e3364b5946cded1b45240291a435c83132c73779e43d6c 🔍`
SHA3	`f02a23305cec196e50f570a7df14b52ae57b202875a55930d43a76542881606a 🔍`
VirtualSize	`0x888`
VirtualAddress	`0x9000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x3400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.5678`

.CRT

MD5	`005afc1bf380d608fe64931ca53bd165 🔍`
SHA1	`d2c9e73495a30d23de97d60c067382b0b16805d2 🔍`
SHA256	`fa24dbc0c60c61150ac03fb2e21ce3b9b79df49edf48559598b422a3c77e0113 🔍`
SHA3	`d57fd354202c9b303ec2e92d91b42a4292af0b1fabd207b1313868af6e57ca42 🔍`
VirtualSize	`0x60`
VirtualAddress	`0xa000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.282654`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0xb000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`e8609717fbe8e6e8d9d502b5a8900630 🔍`
SHA1	`7188289ae5569b1776cad32f3d6ab202f2622342 🔍`
SHA256	`09b6b923458f27cfe9222c850b8c90486338a651b6c4149f5498e27fcb08ee11 🔍`
SHA3	`f11a872678db818f0c2224b3098d76aac18958ac92c7c1dc397255bd4d2bd0cd 🔍`
VirtualSize	`0x78`
VirtualAddress	`0xc000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`1.42406`

Imports

KERNEL32.dll	`CloseHandle` `CreateProcessW` `CreateRemoteThread` `DeleteCriticalSection` `EnterCriticalSection` `FreeLibrary` `GetCommandLineW` `GetExitCodeProcess` `GetLastError` `GetModuleFileNameW` `GetModuleHandleA` `GetProcAddress` `InitializeCriticalSection` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryW` `ResumeThread` `SetUnhandledExceptionFilter` `Sleep` `TlsGetValue` `VirtualAllocEx` `VirtualFreeEx` `VirtualProtect` `VirtualQuery` `WaitForSingleObject` `WriteProcessMemory`
msvcrt.dll	`__C_specific_handler` `__getmainargs` `__initenv` `__iob_func` `__set_app_type` `__setusermatherr` `_amsg_exit` `_cexit` `_commode` `_fmode` `_initterm` `_onexit` `_wgetenv` `abort` `calloc` `exit` `fprintf` `free` `fwrite` `getenv` `malloc` `memcpy` `signal` `strlen` `strncmp` `vfprintf` `wcscpy` `wcscpy_s` `wcslen`
SHLWAPI.dll	`PathAppendW` `PathRemoveFileSpecW`

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData	`0x14000b000`
EndAddressOfRawData	`0x14000b008`
AddressOfIndex	`0x1400080dc`
AddressOfCallbacks	`0x14000a038`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000140001660` `0x0000000140001630`

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.