1024646609bcf0008ae537fa697da39e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Oct-05 13:23:23
Detected languages English - United States

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .fptable
Unusual section name found: ./'w
Unusual section name found: .]_s
Unusual section name found: .{ho
The PE only has 5 import(s).
Info The PE contains common functions which appear in legitimate applications. Has Internet access capabilities:
  • WinHttpReceiveResponse

Hashes

MD5 1024646609bcf0008ae537fa697da39e
SHA1 1053c0092cf2f26d340f346300004cc879ad6bf7
SHA256 22b5c5fd52e7b6f55ebde4952c5a1ad722ce244c072f64c17b1e1d5e582ca535
SHA3 e6f634df5cba4c895c3ebb7ffa11ce0683558c4cf1694a78a5838921946362ed
SSDeep 393216:jIwGX7NMdvJdkQNiwjIps3rYDvfBfJRRehq:0wA+HljMJRU
Imports Hash 1d45a6446a9353cabc9df4816798bd09

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2025-Oct-05 13:23:23
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1fa00
SizeOfInitializedData 0x63e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000A5FE9C (Section: .{ho)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x198d000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1f8f0
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x5f930
VirtualAddress 0x21000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1df0
VirtualAddress 0x81000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1920
VirtualAddress 0x83000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x100
VirtualAddress 0x85000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

./'w

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x9be79a
VirtualAddress 0x86000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.]_s

MD5 42783ae38f6b39ace8de9b8e8530931a
SHA1 4fd59fe91d2b991112d1997a52b9ad822494abf5
SHA256 ece2439e06ad18fe3a6b7843086090f44eab85458de2b534c9dca6332e57203b
SHA3 75af9c1cc42e5904f196644c515cf751285845675d67298348f3e53fb0a25a09
VirtualSize 0x80
VirtualAddress 0xa45000
SizeOfRawData 0x200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.338113

.{ho

MD5 71a88573786a1bf946d05b30376a19de
SHA1 f05ee32677dadade7f90143e902a1c6d0d5dec77
SHA256 0c0bfa4caaaf3b1b40964b25de8c31f92f8c3a25b8d02edabac7218fe6b95d51
SHA3 5b610cecbdf4422b4fcd34133e9123e833fccf77f976f12a153f3add8426ffcc
VirtualSize 0xf44f14
VirtualAddress 0xa46000
SizeOfRawData 0xf45000
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.79151

.rsrc

MD5 3f09ed7b847a623459cc4c0b9b565635
SHA1 26e3dbf5d1b4173e9aacf9034aaf2b43aba0cba9
SHA256 8af116e183bc2e38d5a78620f493d53b489f941ee29c4b90778da0cc78aa7109
SHA3 64a252d7d4c46840a8e04d8658f3b7a39a652aceab08a31ae3a3f761761e9aef
VirtualSize 0x1e0
VirtualAddress 0x198b000
SizeOfRawData 0x200
PointerToRawData 0xf45600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.78028

.reloc

MD5 f9d6a8db12198511b8462235f82cc14d
SHA1 bab6ddec5c3a305cef7e9f5c8863715192656a18
SHA256 b05d065548ddb1bfb74622e835fb369eb639c29c9d141fde5b317362850481e2
SHA3 b294dcf6b30f4700ec35e656d4c45c0dbdc363823faf9c08415a9e7100d60aac
VirtualSize 0x100
VirtualAddress 0x198c000
SizeOfRawData 0x200
PointerToRawData 0xf45800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.53011

Imports

WINHTTP.dll WinHttpReceiveResponse
fwpuclnt.dll FwpmEngineOpen0
KERNEL32.dll GetOEMCP
USER32.dll GetMessageW
ADVAPI32.dll LookupPrivilegeValueW

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140081000

RICH Header

Errors

[*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section .fptable has a size of 0! [*] Warning: Section ./'w has a size of 0! [*] Warning: Please edit the configuration file with your VirusTotal API key. [!] Error: Could not load yara_rules/bitcoin.yara! [!] Error: Could not load yara_rules/monero.yara! [!] Error: Could not load yara_rules/compilers.yara! [!] Error: Could not load yara_rules/findcrypt.yara! [!] Error: Could not load yara_rules/suspicious_strings.yara! [!] Error: Could not load yara_rules/domains.yara! [!] Error: Could not load yara_rules/peid.yara!