| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jul-10 13:25:11 |
| Detected languages |
English - United States
|
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-Jul-10 13:25:11 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x70800 |
| SizeOfInitializedData | 0x9ca00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000045B24 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x112000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
CloseHandle
Sleep CreateThread SetThreadPriority GetLocalTime VirtualProtect VirtualQuery GetModuleFileNameW GetModuleHandleA AllocConsole RtlPcToFileHeader GetCurrentProcess GetCurrentThreadId SuspendThread ResumeThread GetThreadId GetThreadContext GetSystemInfo VirtualAlloc VirtualFree WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar SwitchToThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetStringTypeW CompareStringEx GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcessId InitializeSListHead RaiseException RtlUnwindEx InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW ExitProcess HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW RtlUnwind |
|---|---|
| USER32.dll |
EnumDisplaySettingsA
|
| ntdll.dll |
NtGetNextThread
RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-10 13:25:11 |
| Version | 0.0 |
| SizeofData | 992 |
| AddressOfRawData | 0xf9664 |
| PointerToRawData | 0xf8264 |
| StartAddressOfRawData | 0x1800f9a90 |
|---|---|
| EndAddressOfRawData | 0x1800f9a98 |
| AddressOfIndex | 0x180106428 |
| AddressOfCallbacks | 0x180072500 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x180102740 |
| XOR Key | 0x601936d1 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33145) | 175 |
| C objects (33145) | 19 |
| ASM objects (33145) | 8 |
| ASM objects (35207) | 10 |
| C objects (35207) | 14 |
| C++ objects (35207) | 83 |
| Imports (33145) | 7 |
| Total imports | 165 |
| C++ objects (35228) | 2 |
| C objects (35228) | 1 |
| Resource objects (35228) | 1 |
| Linker (35228) | 1 |
No comments yet.