19926d266c2fbcc4ad0aaf176a1ab548

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2025-Jan-07 15:56:30

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Functions related to the privilege level:
  • OpenProcessToken
Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 10228746 bytes of data starting at offset 0x49e00.
The overlay data has an entropy of 7.99988 and is possibly compressed or encrypted.
Overlay data amounts for 97.1267% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 19926d266c2fbcc4ad0aaf176a1ab548
SHA1 4a8a2bda496fbeab002197a60b9e34410d0ae580
SHA256 ca48b00a31ec798dc7cda2647092bc911605b955e57c8d0895e292c8d7515cac
SHA3 9479f0ba5e09b56c9613594486d321ac5f11acff3944b221128fd193bfcc7543
SSDeep 196608:yaW1OfTRrjuEWvNm1E8giq1g9NurErvI9pWjbL1DEzx7sKbSEzQUkA1cDCUW9h7:JW0fdo1m1NqCurEUWj9EhCa1yGD
Imports Hash a06f302f71edd380da3d5bf4a6d94ebd

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Jan-07 15:56:30
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2b200
SizeOfInitializedData 0x1e800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000C380 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x53000
SizeOfHeaders 0x400
Checksum 0xa0e2ee
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 420661550c659f884db561712e500aae
SHA1 3a5bbdd182098055e875ae0bbf2dc4b1e643ce2b
SHA256 57b668f5d4897da9436e26a21a43a967b7a0ccfb47f76334196930bd4af6b8cf
SHA3 4a5dc41b2af2b150ea9166661cdc8a1561e9840c4a12b20e8e653547d2a2e291
VirtualSize 0x2b170
VirtualAddress 0x1000
SizeOfRawData 0x2b200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.4986

.rdata

MD5 606ebabda204fff552223f5d60074575
SHA1 8e0dfe0b4f13e84fd11455e0973598013ec85c63
SHA256 c1c5582b644211f296b10acba1a2af0ba2905292e2a0af062d79fa82e25d94a1
SHA3 dd9d904355b548fc973635a40b4679bdd21683da00b97c65f5d84c39383c8cbf
VirtualSize 0x12802
VirtualAddress 0x2d000
SizeOfRawData 0x12a00
PointerToRawData 0x2b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.76844

.data

MD5 aff56347f897785154c53727472c548d
SHA1 249cf6b3c95e5782a7f27c661b5f018c45d7745c
SHA256 b274a12e1cfa1bd7347b00964d8833631066402b06d4ee631fed7d4f94e79c26
SHA3 b7cf1a6886e82368ae8a941c5409bb67d7ba7bae596fc50001088915ebf0308b
VirtualSize 0x5408
VirtualAddress 0x40000
SizeOfRawData 0xe00
PointerToRawData 0x3e000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.83157

.pdata

MD5 2411a276649fc67a0a93227155911735
SHA1 a639b4d5d90be1565952d392609bd5fa3ff35d02
SHA256 5c480f9bd91f01b46539f5fb94eb6130bdef7b3cee87726d883eb0cf6c639aae
SHA3 7742e1eb570e38b8401ec14e12d3dfbf43e3715e689e62a1fe4e978969491e8c
VirtualSize 0x22bc
VirtualAddress 0x46000
SizeOfRawData 0x2400
PointerToRawData 0x3ee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.33457

.rsrc

MD5 bea6e86aba4c9c8480b930bac45d6bc8
SHA1 42c88cf9acd736141d59bb75ad741401abf7c7da
SHA256 fbdaa36701dfa2f1e5ad2d967d7423d575b014782719a243a185dc8c23d197ed
SHA3 c187029cc4d4c014081e540abe409f4c2ab8f94b25c160466295713277b70ca8
VirtualSize 0x83a8
VirtualAddress 0x49000
SizeOfRawData 0x8400
PointerToRawData 0x41200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.60126

.reloc

MD5 42d6242177dbae8e11ed5d64b87d0d48
SHA1 e599e91a866af587afec0cc6408b4eaba8188703
SHA256 43619f12c5f30419602c7ca56a01509afce7f2e88e44846a3745b64a49a75b44
SHA3 2c96ac40f27300c612862bfa15e3b128ad236ead7aea267c24a4c3de3526b12b
VirtualSize 0x768
VirtualAddress 0x52000
SizeOfRawData 0x800
PointerToRawData 0x49600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.26872

Imports

USER32.dll TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
KERNEL32.dll GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
HeapSize
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetDriveTypeW
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW
ADVAPI32.dll ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.94877
MD5 c85a6956e20f36878a5db292ab681c0e
SHA1 fb4327ca3782a0be3d4efd13468f81dd6299a2cb
SHA256 a24e6a0892cb93458888f392c6e95d508673791bf145a37db66b149c358ddcec
SHA3 4affcf26c137c1901f4abea1fa01989675a133a1e429bb625ca90c846bccc414

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.69637
MD5 2a3af294bbbebfa6ec1287b135fb0f0a
SHA1 10852f767a2ca31c584dc8fd2bdddb714cf6a131
SHA256 b008044fe64c0ae30a6361f3f700287623650cbf0ad42f132225d0f2de236a85
SHA3 561bd403bc35db56a639ea06ac27767f4e6ff018bea6acf3446ed83b0cc4625a

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.16571
MD5 6785167e2272338f75333060ae449b0c
SHA1 cf37c45075bae470f9ccf91c3fbb448e0146d8c4
SHA256 40fd0db6940b4705e79ff58d76bcb186f10853b2ee0fc010662d94182ffc54b4
SHA3 ef9e3c1ac24bb1497ca52127b0203916c2fea86706100625643bf6c8e135aa0e

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.76399
MD5 e57295256f9ea4d268ae5159289821ec
SHA1 56bb97a854dafd6c47847edcc820c43508daccc2
SHA256 08e8722b531eb8816b8221c4096404a30ca95c6af055fab6046cf75e4cb30ecb
SHA3 7982b4d187ead8b4a01611fc070f6f827b2fa72046f0c7758c6e8655bd12a5bb

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62308
Detected Filetype Icon file
MD5 7266d550f7fc2a4f9527ac534831ee65
SHA1 2655a17d14813113c955d1059f4679dcc405c070
SHA256 822952416183dc59088127325e52faebc96d08a97d76bd9202cc4880de84f48e
SHA3 0fdf51b4f52294affe8ece587a1ff20f47fe201efed87ab32ecd585ef0b98df0

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Jan-07 15:56:30
Version 0.0
SizeofData 796
AddressOfRawData 0x3c3f4
PointerToRawData 0x3a9f4

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140040040
GuardCFCheckFunctionPointer 5368894464
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x11aa093c
Unmarked objects 0
ASM objects (30795) 7
C++ objects (30795) 179
C objects (30795) 10
253 (33808) 2
ASM objects (33808) 9
C objects (33808) 17
C++ objects (33808) 40
Imports (30795) 7
Total imports 137
C objects (34123) 25
Linker (34123) 1

Errors

[*] Warning: Raw bytes from section .text could not be obtained.
<-- -->