05af8cf841ec6dbfe1580f2feb2adeb9a1ef838c5a8958fd4e63a8f2afdad7c6
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Sep-17 06:03:50 |
| Detected languages |
English - United States
|
| Debug artifacts |
waled.pdb
|
| LegalCopyright | Copyright (C) 2016-2019 Credi Digital |
| FileVersion | 9.7.6.11780 |
| FileDescription | Waled Agent |
| OriginalFilename | waled.exe |
| ProductName | Waled |
| ProductVersion | 9.7.6.11780 |
| InternalName | waled.exe |
| CompanyName | Credi Digital |
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
Hashes
| MD5 | 0613a321b86c4c7508289ad147b0987e 🔍 |
|---|---|
| SHA1 | d0ecdb292c6e9bd707eef45a118d2e06798f3664 🔍 |
| SHA256 | 05af8cf841ec6dbfe1580f2feb2adeb9a1ef838c5a8958fd4e63a8f2afdad7c6 🔍 |
| SHA3 | c242628f969d70c411d81610e0e3d33d902112396289475b9ca8e297cffbcbe8 🔍 |
| SSDeep | 12288:bLupNyySFLVrKkbgRr3g4gnFQ4u7MkIpzsTllGOgS0k6vrdRFzH4O8stJO/5BJk:OTKFLoWN6THGRSsrdjzH4OTA/5UnS+ 🔍 |
| Imports Hash | d3d483be25a602fe8e0852af0f5648fb 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x25800 |
| SizeOfInitializedData | 0xe1800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000017500 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x10d000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x1079d6 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | fcd402088a08d981433f8e92828c939c 🔍 |
|---|---|
| SHA1 | 9bb278248eb33923da1fe6dc8afbaaf149e111af 🔍 |
| SHA256 | 012e6dcaf7559f7b18c2a35ecf1eae35ca182779802f1e00562b7e4c5d1359b3 🔍 |
| SHA3 | d9a22ae0b344b7071c3076a3b7cddf427d801e906bfe10a4dbf478156565e06d 🔍 |
| VirtualSize | 0x25751 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x25800 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.48848 |
.rdata
| MD5 | 714adaff3541d624c9200703576cfc65 🔍 |
|---|---|
| SHA1 | 016b7d8392e3443cb63371caa2019abc5b93517b 🔍 |
| SHA256 | 70fba5923675a6ea4fd98d14586d13126bf90cb4ee8a57032c246ef1c36db181 🔍 |
| SHA3 | 1ae910e32a020a3adcb831f93dcda659fdce22da367a9b5ada4d65226410a949 🔍 |
| VirtualSize | 0x98c0c |
| VirtualAddress | 0x27000 |
| SizeOfRawData | 0x98e00 |
| PointerToRawData | 0x25c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.04939 |
.data
| MD5 | 0a71f4716de65a4f049bd3b0d8c97638 🔍 |
|---|---|
| SHA1 | d2e7ce33615fa00367aefe8a53bcf573e1011a74 🔍 |
| SHA256 | 7ef7d4480569e8e3568e66aaf82a1054bc88b706de35aa010b646d9b6900028b 🔍 |
| SHA3 | 61672f52e70e20a7794746d3e325c01d4fdd5328442ae1a616d88ec864d2088c 🔍 |
| VirtualSize | 0x2df0 |
| VirtualAddress | 0xc0000 |
| SizeOfRawData | 0x2200 |
| PointerToRawData | 0xbea00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.80694 |
.pdata
| MD5 | b384e3ae1f78b77cc3011a430f000f25 🔍 |
|---|---|
| SHA1 | 3d79ae1829912a0bee8f076f8acb1dbf992cf046 🔍 |
| SHA256 | 5f3f035f82f3db0db84dfb255e77641df6b8d25f621771184aecf72a2105d200 🔍 |
| SHA3 | 64153d3e7d6f0ffefd9b21e177e605f2b266b8dd7eb0f7e62b1867d7a536762e 🔍 |
| VirtualSize | 0x13bc |
| VirtualAddress | 0xc3000 |
| SizeOfRawData | 0x1400 |
| PointerToRawData | 0xc0c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.44055 |
.tls
| MD5 | 94c95f08da43f4a87727e9c7425c881a 🔍 |
|---|---|
| SHA1 | 075b028ae75d5e221e62c1d2a942496a970e2575 🔍 |
| SHA256 | 3d1e35b874b33ea8e1691d6c63a40fc844d649f676905357fc2b08e16b0e80b9 🔍 |
| SHA3 | c483cbb4c91ba45aa3bb384cc9f40b52d5c5b78d9bf8b01155f84436dcb2ec03 🔍 |
| VirtualSize | 0xe1 |
| VirtualAddress | 0xc5000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xc2000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.65974 |
_RDATA
| MD5 | 59d873b73080043767c4c7657e3e2d74 🔍 |
|---|---|
| SHA1 | 5d4e7bccea323d1e9927378bbe398e6a37119401 🔍 |
| SHA256 | fb0ddcf3a304f9a30e3646d2c4d98fb19a9737967f9444984d269049774d8778 🔍 |
| SHA3 | b7c56bcc9037ec23e9e2784b9d3df443f993f24d83233d0d7a9b34ca11640694 🔍 |
| VirtualSize | 0x444 |
| VirtualAddress | 0xc6000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0xc2200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.93657 |
.rsrc
| MD5 | 410a2aca8b3e0cda235e7cf52c4ae59d 🔍 |
|---|---|
| SHA1 | a3916738bd91c32c3194282eec0eb648dea6de8a 🔍 |
| SHA256 | 1ec11eef548b5d7e15df697e164243539f553e0be9935126fc33a13d9d57b76e 🔍 |
| SHA3 | daac6a5cb00f2744b543bedfb7f48285ac7d3a14094d192ba4e8a06fbd8013eb 🔍 |
| VirtualSize | 0x443e0 |
| VirtualAddress | 0xc7000 |
| SizeOfRawData | 0x44400 |
| PointerToRawData | 0xc2800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.61579 |
.reloc
| MD5 | 30bcf5c2172f75a282dc4227fab8e012 🔍 |
|---|---|
| SHA1 | 75be246306fbcc1618f7e4bca2922c26eb7e9331 🔍 |
| SHA256 | 1be6274fe2acb4bb32b50c114c6ee180ed72b0bcebd35c9f43697c31a926fc7d 🔍 |
| SHA3 | 00ab3252cb6456e15809f0c37bbfbdc69f05e4ebc5955acea7cf7e37cf1fc11c 🔍 |
| VirtualSize | 0x734 |
| VirtualAddress | 0x10c000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x106c00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.21024 |
Imports
| kernel32.dll |
CloseHandle
CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetActiveProcessorCount GetActiveProcessorGroupCount GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLogicalDrives GetMaximumProcessorCount GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetVersion HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile |
|---|---|
| user32.dll |
GetCaretBlinkTime
GetSysColor GetSystemMetrics |
| ntdll.dll |
NtReadFile
NtWriteFile |
| WINMM.dll |
midiInGetNumDevs
timeGetTime |
Delayed Imports
1
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x457 |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Entropy | 5.24952 |
| MD5 | 334b0db900f89d3eba4d91824e77c34a 🔍 |
| SHA1 | 477a0cdd4d14d1ecbcb5818faf7c739eea1b63aa 🔍 |
| SHA256 | 0b45aea34073cf8466ce884b858c2350ca45ee20df02489da7a7ac5b66370594 🔍 |
| SHA3 | 0bd63c3c7178af69477ec46216558d688ea934b4561e16d6048d020172b354be 🔍 |
1 (#2)
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x40158 |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Entropy | 5.56039 |
| Detected Filetype | PNG graphic file |
| MD5 | f960f771bfcbc0ef6450f6b9d20e083d 🔍 |
| SHA1 | 18dbe07f211e00211abf6c86f8775b47bb98ce33 🔍 |
| SHA256 | c905969b278bc0baed8a0e9b9e6bb59a46835565b9ec3ad8696bbb079f2a8dca 🔍 |
| SHA3 | b6530af38f84d4946fdaae44aadcddbd9c4809a7c5a503835d70dc8e3e9f990b 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2474 |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Entropy | 5.717 |
| Detected Filetype | PNG graphic file |
| MD5 | 5c6f6320d27b781f06eb23f693e30398 🔍 |
| SHA1 | 8b1d0dff393025f015212028ce59a6891112083b 🔍 |
| SHA256 | f1f11737781bb6c9951795204e4d07dba7f94bf28fdc4696d381fbfa04a9945f 🔍 |
| SHA3 | d2c0d9608e355b9cf10eb18e63ce74b17c07d1e7a1b56883b5d605023e8ec0fa 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x1064 |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Entropy | 5.84465 |
| Detected Filetype | PNG graphic file |
| MD5 | c9e36763c2e451c8672b7799373ba0cf 🔍 |
| SHA1 | 712d3b7e778aa0ebfe42ff066d706c62cb099762 🔍 |
| SHA256 | 962f9f6642bd0cef130969dec7d367aa4c55750c71cd8771a599b41cae11ce66 🔍 |
| SHA3 | f03efd83e7b56a8842819003058f020ebef7589cfb0c44ed602b446dddc308cc 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x454 |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Entropy | 5.9347 |
| Detected Filetype | PNG graphic file |
| MD5 | 02f1df6b573ddafb7cc51a1591fca942 🔍 |
| SHA1 | 83498d1aac64711fe52c2923bd6cf29800cd0050 🔍 |
| SHA256 | b0bf23b3d03dce2ecfa7bcd7d227375d99ccdacd57ac495496050fa304428c7e 🔍 |
| SHA3 | 9574681bcbde39bce2f1da07da0c273785ff304b52f0a09da9cdaf07568ddfc6 🔍 |
1 (#3)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x3e |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Entropy | 2.46418 |
| Detected Filetype | Icon file |
| MD5 | dfa900010343b02eb96e5b32707d3786 🔍 |
| SHA1 | a6f8a7624ca9685bd0cf747b55c93453d3395ce2 🔍 |
| SHA256 | fefea84cf6710ac491667865afedacc8a490970b764ef96a9947f9ae360202a4 🔍 |
| SHA3 | f520ba117c339cdf02a3cd6576ea74040113290aed37d4d462db0a885c92c2d2 🔍 |
1 (#4)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2d8 |
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Entropy | 3.45238 |
| MD5 | ce1b792cbc7c1525e3772adf3e53bcb4 🔍 |
| SHA1 | 888ae39e7b504f576707d0cf2914f9853d682ad7 🔍 |
| SHA256 | 2b1ec57560aa1382ecbbe1a3477d54f774d83a09daa483e7f646a330122f445d 🔍 |
| SHA3 | 35083f2411fff6ccccd8394a9141dae550b097fef8a521f8040e48121321d72d 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 9.7.6.11780 |
| ProductVersion | 9.7.6.11780 |
| FileFlags | (EMPTY) |
| FileOs | (EMPTY) |
| FileType |
VFT_UNKNOWN
|
| Language | English - United States |
| LegalCopyright | Copyright (C) 2016-2019 Credi Digital |
| FileVersion (#2) | 9.7.6.11780 |
| FileDescription | Waled Agent |
| OriginalFilename | waled.exe |
| ProductName | Waled |
| ProductVersion (#2) | 9.7.6.11780 |
| InternalName | waled.exe |
| CompanyName | Credi Digital |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Version | 0.0 |
| SizeofData | 34 |
| AddressOfRawData | 0xbd80c |
| PointerToRawData | 0xbc40c |
| Referenced File | waled.pdb |
TLS Callbacks
| StartAddressOfRawData | 0x1400c5000 |
|---|---|
| EndAddressOfRawData | 0x1400c50e0 |
| AddressOfIndex | 0x1400c2308 |
| AddressOfCallbacks | 0x1400bd8c8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 2026-Sep-17 06:03:50 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400c1780 |
RICH Header
Errors
Leave a comment
No comments yet.