Manalyze report for 11d129ba47d32d2c4903f85346c8982fd15c9b1f061c4148dc2dc1a0717eeb64

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Aug-01 11:31:04
TLS Callbacks	1 callback(s) detected.
Debug artifacts	mycode.pdb

Plugin Output

Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`d0aa28b41c056ff9b112e9a90a9d7cc1`
SHA1	`3845aa1f3ec66b4ba670b19a68b9fecadacd20f5`
SHA256	`11d129ba47d32d2c4903f85346c8982fd15c9b1f061c4148dc2dc1a0717eeb64`
SHA3	`c66c16b14d7a3da6407249e6ef6e751e0331f09beb0e15b8b30e6a3a4aef6dc6`
SSDeep	`1536:WNNC2YvLPLgUWvx6OgqlmK+9/p+9To9SkP7o9+RcZJ0G8tvK:WzwvL0yOgqlQ/8T8P8ka6`
Imports Hash	`0c914686071d5a82b10e6d67f568d364`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`5`
TimeDateStamp	2026-Aug-01 11:31:04
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x14200`
SizeOfInitializedData	`0x8a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000013450 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x21000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`45b266e2aab109f3b263f5c7173f4167`
SHA1	`e5f457b4677137212fc68b9ff6ada410c762a1ec`
SHA256	`9dc1f80e2a8bd09f40c49da785889e40a3a1bdfe0c543979ec8e3db84cb30c5c`
SHA3	`4290238f5f8ae68d9ae20df86171d8df0069b50df9776586a185cbc69e1e13b1`
VirtualSize	`0x14028`
VirtualAddress	`0x1000`
SizeOfRawData	`0x14200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.42479`

.rdata

MD5	`40c69c1187a41d0e27d04a87fee31244`
SHA1	`20df429d364566f98a2dad325f0fec88baaebb54`
SHA256	`e02bf642258d4e21d93c95f2d8fd17702e50f3cb00939c6fd387e619dd8327fd`
SHA3	`64f2894ec64106ae44959670ec318d5964018069a36616ce4e6396a072cfc024`
VirtualSize	`0x7310`
VirtualAddress	`0x16000`
SizeOfRawData	`0x7400`
PointerToRawData	`0x14600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.44162`

.data

MD5	`bb1de4525244e1b794877695d8bd1c92`
SHA1	`05f6bdd1cb02a7fc1de34c7ac8b005a92a313a94`
SHA256	`3c953e73e6fd19705d03250e6584c6f943dbb6aaccd86a4e35b525124c01e38d`
SHA3	`69923601fd7a2980ac96b4b6a82c43be7963dfd77d31179528763b0d1ca79359`
VirtualSize	`0x2d0`
VirtualAddress	`0x1e000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1ba00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.53799`

.pdata

MD5	`93a3517e4ad4250210f16bba8ade58de`
SHA1	`9bd1dafb1afc0c1cf06c1274baa19abe03f6de35`
SHA256	`a451f1dd08f255630437e34bc25ba6e2540ab1cd1d401a92b9d6f0e5cf2a8bd5`
SHA3	`1255bcf6fc73f5baaec470c8b9f137de8a260a60fa573393d96969aa0346acd0`
VirtualSize	`0xdec`
VirtualAddress	`0x1f000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x1bc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.05527`

.reloc

MD5	`c4158b981e1352cd99a77f1b7f111286`
SHA1	`893a22d350651c5df69e9c5e5e076048b256bd4b`
SHA256	`05e4483cb4a6ba5216089906a2be20efe657f22aaedff6c0471e490c583a7f86`
SHA3	`4b56c5507e62e06b50d9a4a73795ff37523753a1232c4a58045cd1c41b9e72ec`
VirtualSize	`0x20c`
VirtualAddress	`0x20000`
SizeOfRawData	`0x400`
PointerToRawData	`0x1ca00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`3.50587`

Imports

api-ms-win-core-synch-l1-2-0.dll	`WakeByAddressAll` `WaitOnAddress` `WakeByAddressSingle`
KERNEL32.dll	`SetUnhandledExceptionFilter` `InitializeSListHead` `GetSystemTimeAsFileTime` `GetLastError` `CloseHandle` `WaitForSingleObject` `SetLastError` `GetCurrentThreadId` `GetProcessHeap` `HeapFree` `HeapReAlloc` `QueryPerformanceCounter` `GetCurrentProcessId` `GetCurrentProcess` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `GetStdHandle` `AddVectoredExceptionHandler` `SetThreadStackGuarantee` `GetCurrentThread` `GetCurrentDirectoryW` `GetEnvironmentVariableW` `lstrlenW` `GetProcAddress` `WideCharToMultiByte` `WaitForSingleObjectEx` `LoadLibraryA` `CreateMutexA` `ReleaseMutex` `HeapAlloc` `MultiByteToWideChar` `WriteConsoleW` `GetConsoleMode` `GetConsoleOutputCP` `GetModuleHandleW` `GetModuleHandleA`
ntdll.dll	`NtWriteFile` `RtlNtStatusToDosError`
VCRUNTIME140.dll	`memmove` `memset` `__current_exception` `__C_specific_handler` `__CxxFrameHandler3` `__current_exception_context` `memcpy` `_CxxThrowException` `memcmp`
api-ms-win-crt-runtime-l1-1-0.dll	`_set_app_type` `_seh_filter_exe` `_configure_narrow_argv` `_initialize_narrow_environment` `_initterm` `_initterm_e` `exit` `_exit` `_crt_atexit` `__p___argc` `__p___argv` `_cexit` `_c_exit` `terminate` `_get_initial_narrow_environment` `_register_onexit_function` `_initialize_onexit_table` `_register_thread_local_exe_atexit_callback`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-stdio-l1-1-0.dll	`_set_fmode` `__p__commode`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-heap-l1-1-0.dll	`free` `_set_new_mode`

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Aug-01 11:31:04
Version	`0.0`
SizeofData	`35`
AddressOfRawData	`0x1a0f8`
PointerToRawData	`0x186f8`
Referenced File	mycode.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Aug-01 11:31:04
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x1a11c`
PointerToRawData	`0x1871c`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Aug-01 11:31:04
Version	`0.0`
SizeofData	`816`
AddressOfRawData	`0x1a130`
PointerToRawData	`0x18730`

TLS Callbacks

StartAddressOfRawData	`0x14001a480`
EndAddressOfRawData	`0x14001a4d8`
AddressOfIndex	`0x14001e244`
AddressOfCallbacks	`0x140016318`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`0x0000000140006830`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x14001e100`

RICH Header

XOR Key	`0x9e91f09b`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`12`
Imports (35721)	`2`
ASM objects (35721)	`3`
C objects (35721)	`9`
C++ objects (35721)	`23`
Imports (33145)	`9`
Total imports	`178`
Unmarked objects (#2)	`17`
Linker (36252)	`1`

Errors

Leave a comment

No comments yet.