1919a11a8fce589ead833467aa0e6fdba7feae54ded89f5cdd4419cd185862d4

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jan-21 16:23:50
Detected languages English - United States
Debug artifacts C:\Users\Administrator\Desktop\tealiploader\tealipPROJE_2026\tealiploader2026\hookloader\build\TealipInjector.pdb

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • FindWindowW
 Manipulates other processes:
  • OpenProcess
Malicious VirusTotal score: 7/71 (Scanned on 2026-08-20 12:53:23) APEX: Malicious
Antiy-AVL: GrayWare[AdWare]/Win32.Puwaders
Bkav: W32.Malware.F510445B
CrowdStrike: win/malicious_confidence_70% (W)
Ikarus: Riskware.Win32.Hacktool
MaxSecure: Trojan.Malware.300983.susgen
TrendMicro-HouseCall: PUA.Win64.Gen.TL0101H626Z5

Hashes

MD5 e557b70fb8a487f99ac106e940b8eed0 🔍
SHA1 ebe5334b8ccaf876bdb73e5633e3c37c74c4b087 🔍
SHA256 1919a11a8fce589ead833467aa0e6fdba7feae54ded89f5cdd4419cd185862d4 🔍
SHA3 7773ad8a4eeb758b112be654d62fe5ea3586efa7d7d1ea44589b5f73435dbb9a 🔍
SSDeep 192:v8B1bOxgNM6P1VEIRC95Delc/hhcNyhfwdcH0tahyVx+V9CY1o4AeLBnO5XfYYa:v8B16uy6d3+NeK/Mg2dcUzD4+5KE 🔍
Imports Hash ff3c50d74aa40efad4dc07060189227d 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jan-21 16:23:50
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1800
SizeOfInitializedData 0x2600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001E38 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x9000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d5c6dfdef78a6087ffd6cf4d58b973cb 🔍
SHA1 616f368bd90cac8eed5bf76e9e46f66c5f8fcca3 🔍
SHA256 3761dc12983ff7df40e6e27dbfa09dbc8c0ed067bca77dd44df172fad0ecb5f7 🔍
SHA3 c33267ea6067eca1a33b51922e393915cef616c7e9aa8e3b2663e8364e7e3c66 🔍
VirtualSize 0x17ec
VirtualAddress 0x1000
SizeOfRawData 0x1800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.07323

.rdata

MD5 dba3eec20c0df9ef06d816e6c2dcd534 🔍
SHA1 7e33f07a4e4e581dfce6cbfcc746c852bc2fea02 🔍
SHA256 b055a6279851d3807c033eb7939d7aaa006443b2b10e9d010987b4d2044dd74e 🔍
SHA3 d1e7edfa7ed03219ef331fe16154acb2ad9aceff9ad0cf5ebe370ec455a6200c 🔍
VirtualSize 0x1b5e
VirtualAddress 0x3000
SizeOfRawData 0x1c00
PointerToRawData 0x1c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.9575

.data

MD5 0b119503a1522ec9a1ebd56eb9f8c1fa 🔍
SHA1 5303ce5bd34050a324658c00574349c8e8b833a1 🔍
SHA256 35de8c073dff03dade1b86b16f2e43e79352662a63542db6adfa9db66149b0bd 🔍
SHA3 dad086f1c1e5a0721557676583229262ef1d553f5d5adacf2c626199013da4f4 🔍
VirtualSize 0x1c0
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.06652

.pdata

MD5 86735b2cd5bf41019688cbfb408b8476 🔍
SHA1 9df9702b205a1d1d2bb1d6052faedf333d8dc594 🔍
SHA256 0df306ace3db2029437af46a256d6987a12e3401348e1adeae65a71973d3238a 🔍
SHA3 b557b1676fb8f7f3a4bbd5d4c01e49e0ae1b14796ebe537eca4adbedc6acd044 🔍
VirtualSize 0x27c
VirtualAddress 0x6000
SizeOfRawData 0x400
PointerToRawData 0x3a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.71602

.rsrc

MD5 0b35de07beeb30d1d6013cbca2846303 🔍
SHA1 c98626ce4d587471d115df6f42cb0f5221f13689 🔍
SHA256 c9ed38ed40cfe8c1718cbf78be16bb4aa76b76097a449f9ea315aee9fd20df0d 🔍
SHA3 76678b071daa4ec33980be3b819260aea5ade31193b0580e19b41e16156137cf 🔍
VirtualSize 0x1e0
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

.reloc

MD5 966a7cdc38b34434801c536bbead0f63 🔍
SHA1 6e02866392875a411b5e23cab2adb9ae53f146dc 🔍
SHA256 6dcf9db738271340507db6c766a0561b7d57d0e3e4b86c7144b9b631a03ee69f 🔍
SHA3 bcf4d74b8ee03b12902d73bd1bad395e051ed57b17364818cd06d13d14ca4ddb 🔍
VirtualSize 0x54
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x4000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.14895

Imports

KERNEL32.dll FreeLibrary
LoadLibraryExW
GetProcAddress
GetCommandLineW
WaitForSingleObject
GetFileAttributesW
OpenProcess
Sleep
CloseHandle
Beep
LocalFree
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
InitializeSListHead
USER32.dll GetWindowThreadProcessId
MessageBoxW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
FindWindowW
IsWindow
SHELL32.dll CommandLineToArgvW
MSVCP140.dll ?_Xlength_error@std@@YAXPEBD@Z
dbghelp.dll ImageDirectoryEntryToData
VCRUNTIME140.dll __current_exception
__current_exception_context
memset
__C_specific_handler
memcpy
__std_exception_copy
__std_exception_destroy
_CxxThrowException
api-ms-win-crt-heap-l1-1-0.dll _callnewh
malloc
_set_new_mode
free
api-ms-win-crt-runtime-l1-1-0.dll _c_exit
_cexit
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_exit
_get_wide_winmain_command_line
_register_thread_local_exe_atexit_callback
_configure_wide_argv
exit
_initterm_e
_initterm
_initialize_wide_environment
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll _set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-string-l1-1-0.dll wcslen
strlen

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jan-21 16:23:50
Version 0.0
SizeofData 138
AddressOfRawData 0x3bc4
PointerToRawData 0x27c4
Referenced File C:\Users\Administrator\Desktop\tealiploader\tealipPROJE_2026\tealiploader2026\hookloader\build\TealipInjector.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jan-21 16:23:50
Version 0.0
SizeofData 20
AddressOfRawData 0x3c50
PointerToRawData 0x2850

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jan-21 16:23:50
Version 0.0
SizeofData 720
AddressOfRawData 0x3c64
PointerToRawData 0x2864

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Jan-21 16:23:50
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140005000

RICH Header

XOR Key 0x754c5756
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 12
ASM objects (35403) 3
C objects (35403) 10
C++ objects (35403) 24
Imports (35403) 6
Imports (33145) 9
Total imports 71
C++ objects (LTCG) (35723) 3
Resource objects (35723) 1
Linker (35723) 1

Errors

Leave a comment

No comments yet.