| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Apr-23 08:22:20 |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
attack_02_pe_injection.pdb
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Apr-23 08:22:20 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x20600 |
| SizeOfInitializedData | 0xf000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000001F510 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x33000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetProcAddress
CloseHandle IsProcessorFeaturePresent IsDebuggerPresent VirtualFree VirtualAlloc LoadLibraryA GetSystemTimeAsFileTime |
|---|---|
| api-ms-win-core-synch-l1-2-0.dll |
WakeByAddressAll
WaitOnAddress WakeByAddressSingle |
| KERNEL32.dll |
QueryPerformanceCounter
UnhandledExceptionFilter InitializeSListHead RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId SetUnhandledExceptionFilter GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex GetLastError SetFileInformationByHandle WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW GetFileInformationByHandleEx CreateFileW GetFileInformationByHandle GetFinalPathNameByHandleW GetConsoleMode GetFullPathNameW GetModuleHandleA GetModuleFileNameW GetModuleHandleW FormatMessageW HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep |
| ntdll.dll |
RtlNtStatusToDosError
NtWriteFile NtReadFile |
| VCRUNTIME140.dll |
__current_exception
__C_specific_handler __current_exception_context memcmp memmove __CxxFrameHandler3 memcpy _CxxThrowException memset |
| api-ms-win-crt-string-l1-1-0.dll |
strlen
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_initialize_onexit_table
terminate _register_thread_local_exe_atexit_callback _crt_atexit _c_exit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _cexit __p___argc __p___argv _register_onexit_function |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__p__commode
_set_fmode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
free
_set_new_mode |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-23 08:22:20 |
| Version | 0.0 |
| SizeofData | 51 |
| AddressOfRawData | 0x294fc |
| PointerToRawData | 0x27efc |
| Referenced File | attack_02_pe_injection.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-23 08:22:20 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x29530 |
| PointerToRawData | 0x27f30 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-23 08:22:20 |
| Version | 0.0 |
| SizeofData | 816 |
| AddressOfRawData | 0x29544 |
| PointerToRawData | 0x27f44 |
| StartAddressOfRawData | 0x140029898 |
|---|---|
| EndAddressOfRawData | 0x1400298f0 |
| AddressOfIndex | 0x14002f240 |
| AddressOfCallbacks | 0x1400223c0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x000000014000B620
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14002f100 |
| XOR Key | 0x9d8dcd72 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 12 |
| Imports (35207) | 2 |
| ASM objects (35207) | 3 |
| C objects (35207) | 9 |
| C++ objects (35207) | 23 |
| Imports (33145) | 9 |
| Total imports | 184 |
| Unmarked objects (#2) | 75 |
| Linker (35222) | 1 |
No comments yet.