111178a52345aedcec7bc7110c0feb7665789efffbb399e558e9713c7d4ce109

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jul-29 10:29:49
Detected languages English - United States

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .fptable
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 65e7fd6b3f6e90c7c7ddac78e71f9030
SHA1 2c92f37399dbc86d2d0f1bd4c8125f52fc812291
SHA256 111178a52345aedcec7bc7110c0feb7665789efffbb399e558e9713c7d4ce109
SHA3 e883485623b2286bc60786bb13eacd5eb1bcdd548b6ca519eb0a8d44fbf66941
SSDeep 3072:0d/fft+0DDFM5amMJB67DgoyCLjZj2EK:Ec6FlU7DiH
Imports Hash 76992069859b77453d4047ada533b499

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Jul-29 10:29:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x14e00
SizeOfInitializedData 0xe200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001320 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x28000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e588d4b9e0edc268658346adc7e0e106
SHA1 194df7aa95a510d3260f3f562834efc4867316c8
SHA256 352c506a3edf57faa13b9e8834c9a82682c265350683027bb33697debddcf83b
SHA3 4043c3b0229a15436ff0df2b8891568551771476bb71636cc87e64fb825b0323
VirtualSize 0x14c60
VirtualAddress 0x1000
SizeOfRawData 0x14e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48955

.rdata

MD5 c8c973c4043472ef622e71f9cebd5422
SHA1 0233b83cb03c4b3d3a612cf041d5f952ae8ae6ee
SHA256 127d2122d0dd3670dc7903d9681bc1fc3615e22612ff1ef63c97716cf00b6488
SHA3 1dec24214855db071da1f8d754918272c43b9629e46ec7f0637abcef09111fd5
VirtualSize 0xa868
VirtualAddress 0x16000
SizeOfRawData 0xaa00
PointerToRawData 0x15200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.9691

.data

MD5 60bd4476a034a2555f759df6297d7117
SHA1 ac692c60758960ef0aae4f655b03dcf2fe03a80b
SHA256 4865577b8724e5bd5f3d6c9fadca48c23e8b43ab10cb65cd2ed7ac43c11abcc1
SHA3 57df94db315f0e3d49ae20d7940a75a86e4dd6d81488ff1dc36b3bc9ea39a540
VirtualSize 0x15f0
VirtualAddress 0x21000
SizeOfRawData 0xc00
PointerToRawData 0x1fc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.94399

.pdata

MD5 27bc05a0a34e8e627c50bbd69e890072
SHA1 773bba04aca80dd564cd2be5784d9cba1b38f9d3
SHA256 382cb0b3d952e665f976d62364af96d5dcd38cec9213640e7a376200dc9208ae
SHA3 fd22cf3b21e0013fd63a9f4f95971bb723e7423957be2abe1138d1064e3f68a2
VirtualSize 0x1338
VirtualAddress 0x23000
SizeOfRawData 0x1400
PointerToRawData 0x20800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.90553

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x100
VirtualAddress 0x25000
SizeOfRawData 0x200
PointerToRawData 0x21c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 a726f87faa1452f85775859b97e10896
SHA1 f4ddbeb80bb55d177bcb9f85a0d4856805762858
SHA256 d74a228aab0716b1d8c94d5644434758f8c592e995d2205503f99fce72d4f6f9
SHA3 2d17f67bb418d5b963ab6269ba53eb7d4f5c46a2a1a6bca38a8dcd3d1ff4c01a
VirtualSize 0x2b0
VirtualAddress 0x26000
SizeOfRawData 0x400
PointerToRawData 0x21e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.02084

.reloc

MD5 81ae370a5ea074301712850c75a49f6c
SHA1 dfdf1907a3c1a735f76b6a2822db8bf2d741057d
SHA256 bee9aa1220dcf6afe9dd7b0a89c43745176b9a8f0dee98222ed30eb35b169171
SHA3 6faa05162573e9cc9f5ec25e8636d8e8636b7d8f2eca417789ffbb37d0762eab
VirtualSize 0x674
VirtualAddress 0x27000
SizeOfRawData 0x800
PointerToRawData 0x22200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.91792

Imports

KERNEL32.dll QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
WriteConsoleW

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x249
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.06044
MD5 f7e7c81035fc42015d50fadd75b9300f
SHA1 df759518191bad6608c336186b31c120b3dadb34
SHA256 72ae19a66b5d012088d762d3e2de6498a9b3b8fc153352ca6c76cf045d1fe96e
SHA3 1038ef4fa889f000231ecd6b7f2eb0759548ed2a8e5da6ca3e19b38062e60dbd

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jul-29 10:29:49
Version 0.0
SizeofData 840
AddressOfRawData 0x1e9b8
PointerToRawData 0x1dbb8

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Jul-29 10:29:49
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140021000

RICH Header

XOR Key 0xe4fd7807
Unmarked objects 0
C++ objects (33145) 141
C objects (33145) 12
ASM objects (33145) 6
ASM objects (35721) 9
C objects (35721) 16
C++ objects (35721) 39
Imports (33145) 3
Total imports 87
C objects (LTCG) (36252) 1
Resource objects (36252) 1
Linker (36252) 1

Errors

Leave a comment

No comments yet.