0e935d649489272b4046c6ce48ac737d7d5e412a675b10dea3372a24b945a085

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00
Detected languages English - United States

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: \x88\x87\x97\x8f\x8c\x8a\x94\x93
Unusual section name found: \x89\x90\x92\x82\xa2\x94\xa2\x93
Unusual section name found: \x8a\x83\x87\x8b\x89\x88\x9c\x81
Unusual section name found: \x9a\x96\xa0\x85\x8c\xa1\x94\x81
Unusual section name found: \xa1\x90\x9c\x8d\xa2\x86\x9e\x93
Unusual section name found: \xa3\x82\x93\x86\x8f\x90\x87\x99
Unusual section name found: \x9f\x85\x9f\x82\x92\x88\x82\x8e
Unusual section name found: \x8e\x90\x98\x86\x87\x98\x89\x9f
Unusual section name found: \x8c\x98\x95\x81\x9e\x93\x96\x99
Section \x8c\x98\x95\x81\x9e\x93\x96\x99 is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. Possibly launches other programs:
  • ShellExecuteA
 Uses Microsoft's cryptographic API:
  • CryptHashData
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 693b005c5b0aa5a5e14170e6e299dc82 🔍
SHA1 ac306ba7cb05c5ffc5f34b3f12a99bf8aab6f52c 🔍
SHA256 0e935d649489272b4046c6ce48ac737d7d5e412a675b10dea3372a24b945a085 🔍
SHA3 2a17eb73639f8906ab9b118f17fd6d75b91bf19cd168d9015ed13c32ed106629 🔍
SSDeep 196608:BTKtA/yIGhxN+5QV+bnEFPJoZyVaG3kyh8racAbQM7NAnxQiuKGCaCz:tKtAqjSewnmJoZRG3RhAaXbgnxKCz 🔍
Imports Hash eec00476a63b581f234a908633ec63b1 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 0.0
SizeOfCode 0x190a00
SizeOfInitializedData 0x9d200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000011A0200 (Section: \x8c\x98\x95\x81\x9e\x93\x96\x99)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 3934654863
SizeOfImage 0x11b7000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

\x88\x87\x97\x8f\x8c\x8a\x94\x93

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1909bc
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

\x89\x90\x92\x82\xa2\x94\xa2\x93

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x60d14
VirtualAddress 0x192000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

\x8a\x83\x87\x8b\x89\x88\x9c\x81

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2af50
VirtualAddress 0x1f3000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

\x9a\x96\xa0\x85\x8c\xa1\x94\x81

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xf870
VirtualAddress 0x21e000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

\xa1\x90\x9c\x8d\xa2\x86\x9e\x93

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x58e438
VirtualAddress 0x22e000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

\xa3\x82\x93\x86\x8f\x90\x87\x99

MD5 ffaab24cd49e1ca80e96a32ab4977753 🔍
SHA1 ff35b1aa8f5e94a522b39cb732b3b0bfc3964b0f 🔍
SHA256 ee99c4c6beb1b151a1249c3dffd0b9da1b2a94ed17d9383871786d307b34bca6 🔍
SHA3 3465c6f0f6601651cadc907b030f93150e91e8ef2d302ebf3c8a8f43fc3ab32e 🔍
VirtualSize 0x1e8
VirtualAddress 0x7bd000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.55338

\x9f\x85\x9f\x82\x92\x88\x82\x8e

MD5 f444ca383a3ab7e6fab1046e6c818a0d 🔍
SHA1 62edb2fa0a053b7b77d26813a47f5b636afc4e2e 🔍
SHA256 996c71ca9984e0f2032a1f7471b1cf1307330842777591c1acf3d555c221bb6a 🔍
SHA3 6cae0774fbe04862a28f9ec8604ea52b8b722a7fbcc3fa3864f006fc45da060b 🔍
VirtualSize 0x9e0788
VirtualAddress 0x7be000
SizeOfRawData 0x9e0800
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.87089

\x8e\x90\x98\x86\x87\x98\x89\x9f

MD5 6d225057c4e3196e4258e757b9903605 🔍
SHA1 3885a1b1ec7a7f479de5a1f0fc7e80fea5ac9d34 🔍
SHA256 91b01d5d550361d8b492879024b29e21d4524d13b240decda561aa3dcd1e0227 🔍
SHA3 3c55d93832bfe8e655053c5a0375045bf1f167da66914a3e8cf11f407f8771d4 🔍
VirtualSize 0x1e0
VirtualAddress 0x119f000
SizeOfRawData 0x200
PointerToRawData 0x9e0e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.78028

\x8c\x98\x95\x81\x9e\x93\x96\x99

MD5 89e7e01a2f7659c3f85f1b17c7eff9c6 🔍
SHA1 4d6f12ddaae1d5411b860a4447be58785bf8c21a 🔍
SHA256 c037fff0d5440287064882c8b4e6182ce9b819788131c8a0fb2fa491f9693271 🔍
SHA3 4173913ceb804f49950eddaa39e5de2b4735363aafec6848e0f43a0b5db603d9 🔍
VirtualSize 0x162f0
VirtualAddress 0x11a0000
SizeOfRawData 0x9800
PointerToRawData 0x9e1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.09779

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_43.dll D3DCompile
SHELL32.dll ShellExecuteA
KERNEL32.dll IsProcessorFeaturePresent
USER32.dll TranslateMessage
MSVCP140.dll ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
IMM32.dll ImmSetCandidateWindow
dwmapi.dll DwmExtendFrameIntoClientArea
CRYPT32.dll CertGetCertificateChain
WS2_32.dll WSASetLastError
SHLWAPI.dll PathFindFileNameW
USERENV.dll UnloadUserProfile
bcrypt.dll BCryptGenRandom
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll __std_exception_copy
api-ms-win-crt-runtime-l1-1-0.dll __sys_errlist
api-ms-win-crt-stdio-l1-1-0.dll _lseeki64
api-ms-win-crt-heap-l1-1-0.dll _callnewh
api-ms-win-crt-filesystem-l1-1-0.dll _fstat64
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-string-l1-1-0.dll strncmp
api-ms-win-crt-convert-l1-1-0.dll wcstombs
api-ms-win-crt-math-l1-1-0.dll _dsign
api-ms-win-crt-environment-l1-1-0.dll getenv
api-ms-win-crt-time-l1-1-0.dll _time64
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
ADVAPI32.dll CryptHashData

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b 🔍
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1401f3f40

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section \x88\x87\x97\x8f\x8c\x8a\x94\x93 has a size of 0! [*] Warning: Section \x89\x90\x92\x82\xa2\x94\xa2\x93 has a size of 0! [*] Warning: Section \x8a\x83\x87\x8b\x89\x88\x9c\x81 has a size of 0! [*] Warning: Section \x9a\x96\xa0\x85\x8c\xa1\x94\x81 has a size of 0! [*] Warning: Section \xa1\x90\x9c\x8d\xa2\x86\x9e\x93 has a size of 0!
Leave a comment

No comments yet.