05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-22 18:59:07

Plugin Output

Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .imports
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 04a28a66dc4c969cdf7c4668fe50d11b 🔍
SHA1 9cf48c18bdfa8d285e9c91fb9d24992196b5b62c 🔍
SHA256 05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28 🔍
SHA3 12ec258c274c62e86208e6b0fbd4cf20c5b5b67f735697328b33ee19fb6a7515 🔍
SSDeep 98304:OFbjgUXdZdz7H87fy+iOh+CGVfkzpm09O2lyigQwyZlz:OFvTRz7hNOh+XdkzpnO2po4 🔍
Imports Hash ffe43da5f4f0844716d8adaf83b63a9b 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 11
TimeDateStamp 2026-Aug-22 18:59:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x153600
SizeOfInitializedData 0x141400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000845058 (Section: .boot)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xb97000
SizeOfHeaders 0x400
Checksum 0x4917f7
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 a99a7e2c255f9988013f4975aba109af 🔍
SHA1 89f5d942ee6b06c5875878275bddd88092070944 🔍
SHA256 3b71fd61cdbbca7ad053704fcfcd661ad18e813f958eab4a7640ee7cb6a21389 🔍
SHA3 0b06ebca9c2c7b939f36c66b4f19f82446621821132a759aedfd081e0fae439d 🔍
VirtualSize 0x1535cc
VirtualAddress 0x1000
SizeOfRawData 0xa593f
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.98328

(#2)

MD5 d9107d44d4a093d1be17a22b62d24f24 🔍
SHA1 66135a1604f552045fb4104ad3ceba82e536cf3c 🔍
SHA256 6f79974428c466d51dd095e58741cecda5fde239381d5bcb6a47df947ca24667 🔍
SHA3 809d888a6bba2a966c052a147198b21311f44fa6f78c76bff7fbc8191e0450f9 🔍
VirtualSize 0x51652
VirtualAddress 0x155000
SizeOfRawData 0x24f0a
PointerToRawData 0xa5e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.96982

(#3)

MD5 07755bca57d57c2cb4515ea7bccce781 🔍
SHA1 84e4693fdd3fc26cfad069403f51af334170f548 🔍
SHA256 49ef56a8cfd42b9a24eeb20cd5b439d404a6afa5251374351201d2d1faccc1d9 🔍
SHA3 4f69728cc4b1830e949bb2669d30c908184022f7e65969bae825d251b419a344 🔍
VirtualSize 0xe25dc
VirtualAddress 0x1a7000
SizeOfRawData 0x69483
PointerToRawData 0xcae00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.98131

(#4)

MD5 ecb717c33d822af5fbf2157c4eda916b 🔍
SHA1 453d03673f9f76bbfef3d7254c497ca45df6a19d 🔍
SHA256 cb8f6ea0a6fba5e94cdb0b6d35e30d94ee486309ba9c0d8cb60b77d035693cbe 🔍
SHA3 0c660c8d874bc5aa0eb67ed13c902b20704ae893950ca5f1a2aa9d9fc8b35410 🔍
VirtualSize 0xbbd4
VirtualAddress 0x28a000
SizeOfRawData 0x6eaa
PointerToRawData 0x134400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.65043

(#5)

MD5 ccfd285e651dcc933724783bd514fff0 🔍
SHA1 3301aa5d7a9a4ceecd55a7f7f4d4da110c700aac 🔍
SHA256 541fb1ce9be1b452a44dfc074eb0c2d5284841230ba85707a4f4f301a11ebde6 🔍
SHA3 4372b992729aafdb4af0818a727d63cdbde4b04af67370ef3cf79bb22afbf130 🔍
VirtualSize 0x100
VirtualAddress 0x296000
SizeOfRawData 0x6
PointerToRawData 0x13b400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.58496

(#6)

MD5 82fe2b81b41ec10a54b9fcaa13e07a3b 🔍
SHA1 4959973d7627d03205b95dbe483f358dff0c9941 🔍
SHA256 7c9287f0e1ab16e96674b319125be1846eccfbfd446c7b478be4856458946e61 🔍
SHA3 c3ed44ff722ab2fa28261550d8ce32e9e12471b8878810781e487bbc8e5d1d16 🔍
VirtualSize 0x16ac
VirtualAddress 0x297000
SizeOfRawData 0xb24
PointerToRawData 0x13b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 7.71025

.imports

MD5 3d65b8fc836a399f77de7778916d130d 🔍
SHA1 9ead5811ecb03a94326257e55489509263098b06 🔍
SHA256 780034ef48fd7d9b5d89a0b25384a0eb9b1cfafec4ca14dca819e6741c516c55 🔍
SHA3 f8e660631c1fdd0b3dc0f6305626e58f0ac4c82bf1fa4b9ada68c22c0961d139 🔍
VirtualSize 0x1000
VirtualAddress 0x299000
SizeOfRawData 0x400
PointerToRawData 0x13c200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.17703

.tls

MD5 4299e989b7548fef414b1a71d7426d6d 🔍
SHA1 69d5b8424838a18b5f1b9cdad32429b6cf325539 🔍
SHA256 aaa65966eff9b5fbfd5f7342b654436598543104403d53dfdd3154d3d3c839fc 🔍
SHA3 9a99c003cf864d591b76c486d19823b598b57b815085713ff6cc9df778911579 🔍
VirtualSize 0x1000
VirtualAddress 0x29a000
SizeOfRawData 0x200
PointerToRawData 0x13c600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.284569

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x5aa000
VirtualAddress 0x29b000
SizeOfRawData 0
PointerToRawData 0x13c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 68b961d518dfadfd35f7098cb1b3650e 🔍
SHA1 a3f2f678fc4b6bb7a3ee5ab2c99909b6cc934a7b 🔍
SHA256 90b594c800e23b00c280b78aae1e626bb4f6cf6ad796936b3eb5296f4ebc271a 🔍
SHA3 f315244437cbb6296c7a3f2c35f03dedb0f3ed2708a828e44a74daa7e4f04e60 🔍
VirtualSize 0x350200
VirtualAddress 0x845000
SizeOfRawData 0x350200
PointerToRawData 0x13c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.96273

.reloc

MD5 02f9d3ff14a839f6e6ff3189f816bc7e 🔍
SHA1 0c29b8ff684cd3ad4da926ad1400bb336a4b76d3 🔍
SHA256 3dd4e827b3b5e05abc92105855427e14d42cf55ff015b2da87535b95d350db00 🔍
SHA3 8a50734d8faed22b87c4d15ca65a480aeea73c2cbac5c665397e9404800e9c37 🔍
VirtualSize 0x1000
VirtualAddress 0xb96000
SizeOfRawData 0x10
PointerToRawData 0x48ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
Entropy 2.27178

Imports

kernel32.dll GetModuleHandleA
d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_47.dll D3DCompile
dwmapi.dll DwmExtendFrameIntoClientArea
ole32.dll CLSIDFromString
USER32.dll MessageBoxA
ADVAPI32.dll AllocateAndInitializeSid
SHELL32.dll SHGetFolderPathA
WININET.dll HttpOpenRequestA
IMM32.dll ImmSetCompositionWindow
ntdll.dll NtLoadDriver

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x8a1138c1
Unmarked objects 0
C++ objects (33145) 202
C objects (33145) 25
ASM objects (33145) 18
253 (35721) 1
ASM objects (35721) 12
C objects (35721) 20
C++ objects (35721) 95
C objects (VS2022 Update 1 (17.1.6) compiler 31107) 26
Imports (33145) 25
Total imports 222
C++ objects (LTCG) (36256) 26
Linker (36256) 1

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .themida has a size of 0!
Leave a comment

No comments yet.