Manalyze report for 1a6543c0b38a5ba8834f548b5cbb365544a1a87931d3ef819135c4fc9a040eab

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2021-Feb-08 06:15:09
Detected languages	English - United States
TLS Callbacks	2 callback(s) detected.
CompanyName
FileDescription
FileVersion	`0.0.0.0`
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
ProductName
ProductVersion	`0.0.0.0`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: Programs\Startup` `Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: cmd.exe` Contains domain names: bugzilla.redhat.com command.com en.wikipedia.org ftp.info-zip.org ftp://ftp.info-zip.org ftp://ftp.info-zip.org/pub/infozip/license.html github.com http://mingw-w64.sourceforge.net http://mingw-w64.sourceforge.net/ http://rt.cpan.org http://rt.cpan.org/Ticket/Display.html?id http://www.cpan.org http://www.cpan.org/modules/by-authors/id/\U$3/$2/$1\E/ http://www.gzip.org http://www.gzip.org/format.txt http://www.info-zip.org http://www.info-zip.org/pub/infozip/ http://www.perl.org http://www.perl.org/, https://bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id https://en.wikipedia.org https://en.wikipedia.org/wiki/Windows_10_version_history https://github.com https://rt.cpan.org https://rt.cpan.org/Public/Bug/Display.html?id https://rt.cpan.org/Ticket/Display.html?id https://rt.perl.org https://rt.perl.org/Public/Bug/Display.html?id ig.co.uk info-zip.org leonerd.org.uk mingw-w64.sourceforge.net newman.upenn.edu pobox.com redhat.com rt.cpan.org rt.perl.org sourceforge.net strawberryperl.com unicode.org upenn.edu w64.sourceforge.net wikipedia.org www.cpan.org www.gzip.org www.info-zip.org www.perl.org www.unicode.org
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses known Mersenne Twister constants`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA`
Suspicious	The file contains overlay data.	`2946606 bytes of data starting at offset 0x4e3800.` `The overlay data has an entropy of 7.36034 and is possibly compressed or encrypted.`
Malicious	VirusTotal score: 5/71 (Scanned on 2025-09-28 03:15:15)	`APEX: Malicious` `AVG: FileRepMalware [Misc]` `Avast: FileRepMalware [Misc]` `Rising: Trojan.Poebot!8.ACC (CLOUD)` `TrellixENS: Artemis!D48FE1A6A2F6`

Hashes

MD5	`d48fe1a6a2f661a90b15c45ddaffcd63` 🔍
SHA1	`ec91f038f27e9cbde8e621cda54c08a9904526dd` 🔍
SHA256	`1a6543c0b38a5ba8834f548b5cbb365544a1a87931d3ef819135c4fc9a040eab` 🔍
SHA3	`9ba259dcd147c0f265281d155556a31430332c48fe186a30548e360c06745ef9` 🔍
SSDeep	`98304:PhbBPbuxDFGgkmrAy/tim3YWN5B0pcpcCLG5Ay20ti:PhpMFBTF0oXeQ` 🔍
Imports Hash	`b5386887e16a21e06cef5d9f7b8b9c4e` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	2021-Feb-08 06:15:09
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0xa000`
SizeOfInitializedData	`0x4e3400`
SizeOfUninitializedData	`0x9400`
AddressOfEntryPoint	`0x00000000000014E0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x4f2000`
SizeOfHeaders	`0x400`
Checksum	`0x4e84f3`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`1590e6caa9711ac1f9b005b6f32d426f 🔍`
SHA1	`79fb26cf85fd1d02eb4d1903fc002caa00672168 🔍`
SHA256	`d1e93a4cfff8ad109cc91099198ab13dd4a5b9bf24cccb68807ad6385fbb1b74 🔍`
SHA3	`9886e7444373b9785ae5b0f995041033289cdafb2c75e2140e357b3979d93a1b 🔍`
VirtualSize	`0x9ed8`
VirtualAddress	`0x1000`
SizeOfRawData	`0xa000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.41737`

.data

MD5	`7de617248638450185da5d51fcd79527 🔍`
SHA1	`8183555fd8859bb61d89d77c6fe3291781f8586e 🔍`
SHA256	`1c5fc3b35c1a6bf9283c39c6309cf4d044e509a53ec2a60150bfe06a08f42373 🔍`
SHA3	`4b829fab6137f335d60448c6ccd7fae0ac68cdf2eaa8be0ba67c90b0ea7e4ec6 🔍`
VirtualSize	`0x4d4000`
VirtualAddress	`0xb000`
SizeOfRawData	`0x4d4000`
PointerToRawData	`0xa400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.77187`

.rdata

MD5	`60713843fc2d043508ecc9d16c0aef51 🔍`
SHA1	`8f1552ab13ee9851fd9dae251380fe3f6221937a 🔍`
SHA256	`0cb7a3cfc1694de52e6e9b85ee01f224bbf870b1308671f3a3307c186bfce431 🔍`
SHA3	`877c11f197c5d9703e653d32ad059b7a5c8248ea48ff32a65c37e926d7792f3f 🔍`
VirtualSize	`0xc50`
VirtualAddress	`0x4df000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x4de400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.80571`

.pdata

MD5	`e6cffc9e0f080f0534fb741c1d288f91 🔍`
SHA1	`4a6466ecaf388b729e78e582f5fdd18222ec5e93 🔍`
SHA256	`3f74616f8f7f001f46ae954c4d526a2882437daf80d0589bd7790e6d4a7ed21a 🔍`
SHA3	`f77b0314d6b07b3cc8231ceb1725d4147934aacf0c1fd3924daae4ba89e356ff 🔍`
VirtualSize	`0x5f4`
VirtualAddress	`0x4e0000`
SizeOfRawData	`0x600`
PointerToRawData	`0x4df200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.60742`

.xdata

MD5	`3450373c0b18e5b8d3a4525f149f5d53 🔍`
SHA1	`43523ff8bf85c071d04ed6419238b3e9ccc15803 🔍`
SHA256	`d8fa1febb95a0037a5177f3260940b8887d4b676f2d76951fbe10b742490adac 🔍`
SHA3	`f3e9b9999a1a10148477c0e826a2a413e05ff4079c9ca0b0ebce934b8187f700 🔍`
VirtualSize	`0x5d0`
VirtualAddress	`0x4e1000`
SizeOfRawData	`0x600`
PointerToRawData	`0x4df800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.31023`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x93a0`
VirtualAddress	`0x4e2000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`1b83237e27b43129f2beb57fd687d1bf 🔍`
SHA1	`83dd7ed8c508355209a7a7ad6991305e0a8c0544 🔍`
SHA256	`d8faaf22b8559908cd1d05bba66e38687217f43c9f43bd469758202a37b683f4 🔍`
SHA3	`bcc82a1ebfcfd4adfdd1e82a5d14e4423845379d248772ff961cacbcf7d75cb9 🔍`
VirtualSize	`0xda0`
VirtualAddress	`0x4ec000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x4dfe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.28649`

.CRT

MD5	`74e07ff5c5324f530ea6c5eeb222e1e5 🔍`
SHA1	`bf9cae59dc7a58af1adc44313152a40e88868fad 🔍`
SHA256	`893ecd6c04a541657a01356e0084a060728987dd559d286d8574acba48580a5d 🔍`
SHA3	`51a03f46ec2d934f014365109c0433ccd4bbc482ea74bd4009aa2300f5076110 🔍`
VirtualSize	`0x68`
VirtualAddress	`0x4ed000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4e0c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.270919`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x4ee000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4e0e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`4f2056d9268ab5e798571d40c39ce218 🔍`
SHA1	`d1aa32f7ccc8eb8cd79a83d65568303f687c66a7 🔍`
SHA256	`c3345c1c3603ed9ff4050e6ca4e605f3294adbb92626981323eafeba4e4a3c54 🔍`
SHA3	`9012d7a425b15d3f368de58952cca6431d0b0862a7baf9c64de998e5e653c64f 🔍`
VirtualSize	`0x2668`
VirtualAddress	`0x4ef000`
SizeOfRawData	`0x2800`
PointerToRawData	`0x4e1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.42139`

Imports

msvcrt.dll	`___lc_codepage_func` `___mb_cur_max_func` `__getmainargs` `__initenv` `__iob_func` `__lconv_init` `__set_app_type` `__setusermatherr` `_access` `_acmdln` `_amsg_exit` `_cexit` `_chmod` `_close` `_environ` `_errno` `_findclose` `_findfirst64` `_findnext64` `_fmode` `_getpid` `_initterm` `_lock` `_lseek` `_mkdir` `_onexit` `_open` `_putenv` `_read` `_rmdir` `_spawnvp` `_stat64` `_strdup` `_stricmp` `_strnicmp` `_unlink` `_unlink` `_unlock` `_write` `abort` `calloc` `exit` `fprintf` `fputc` `free` `fwrite` `localeconv` `malloc` `memcpy` `rename` `signal` `strchr` `strcmp` `strerror` `strlen` `strncmp` `strncpy` `strpbrk` `strspn` `strstr` `strtok` `vfprintf` `wcslen`
ADVAPI32.dll	`GetUserNameA`
KERNEL32.dll	`DeleteCriticalSection` `EnterCriticalSection` `FreeLibrary` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThreadId` `GetLastError` `GetModuleFileNameA` `GetModuleHandleA` `GetProcAddress` `GetStartupInfoA` `GetSystemTimeAsFileTime` `GetTickCount` `InitializeCriticalSection` `IsDBCSLeadByteEx` `LeaveCriticalSection` `LoadLibraryA` `MultiByteToWideChar` `QueryPerformanceCounter` `RtlAddFunctionTable` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `SetUnhandledExceptionFilter` `Sleep` `TerminateProcess` `TlsGetValue` `UnhandledExceptionFilter` `VirtualProtect` `VirtualQuery` `WideCharToMultiByte` `__C_specific_handler`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.96054`
MD5	`a813dc9aaaf643c0e998eddb333b3ea1 🔍`
SHA1	`0415bb92c0e44f238571afef3644a146b486b159 🔍`
SHA256	`e684dff8fa16538d9d47d3f0c7e7de75d9050463622a332e16475e42480f13ed 🔍`
SHA3	`6975972047ed3fd20acf89d3e024699793e1d5c4cf0f68440767abf1a91283c5 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.19723`
MD5	`bf2cd1f86c2394b548feee2acbc5189b 🔍`
SHA1	`6bf9c86a2715d997f508434d154764f5b2ee13d3 🔍`
SHA256	`72900b466f8b841f09f4989337908e520aa82ffbeb8ba9441d6574a2b02d424f 🔍`
SHA3	`b81eda4600f2b192b855877a45b76f031a6fc96fc9fca9ca721395a2958f38fe 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.96054`
MD5	`a813dc9aaaf643c0e998eddb333b3ea1 🔍`
SHA1	`0415bb92c0e44f238571afef3644a146b486b159 🔍`
SHA256	`e684dff8fa16538d9d47d3f0c7e7de75d9050463622a332e16475e42480f13ed 🔍`
SHA3	`6975972047ed3fd20acf89d3e024699793e1d5c4cf0f68440767abf1a91283c5 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.19723`
MD5	`bf2cd1f86c2394b548feee2acbc5189b 🔍`
SHA1	`6bf9c86a2715d997f508434d154764f5b2ee13d3 🔍`
SHA256	`72900b466f8b841f09f4989337908e520aa82ffbeb8ba9441d6574a2b02d424f 🔍`
SHA3	`b81eda4600f2b192b855877a45b76f031a6fc96fc9fca9ca721395a2958f38fe 🔍`

WINEXE

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.48614`
Detected Filetype	Icon file
MD5	`336806d34ad9306b288cf590b65a06ea 🔍`
SHA1	`1c9d2ae54b62c3761b1490a861a8cb40c9f210d0 🔍`
SHA256	`0493b9de18a4f23d34fccaebf063f5477bfd276c20467877f9ce2da433d96d4c 🔍`
SHA3	`0da9bc2def16ebcf4f97b9d2736c0a01cf02f21cba8c6acdbd38e21835374da1 🔍`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x258`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.13789`
MD5	`b56a22603ec10ce759b967c307f7a0f0 🔍`
SHA1	`a7eb6074de3deab1402f2dab5ca3cbf1046290e8 🔍`
SHA256	`8aa38a294ee91b2be85b70dd14af6ebda8b0e68b88c8a2d387350e7ce32cecff 🔍`
SHA3	`a12371fe7c05465de1a8b1748b2f7de69b56ecdcabff58855946829243abe2b6 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5da`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.03838`
MD5	`1583d4634427fb4ffd972560d5bbf9c6 🔍`
SHA1	`08eb31d4031174624f9ab06db8a3ac19179b201d 🔍`
SHA256	`e1ec15a0f3dff05ff2545ec4b5ea3e5ab7aa84c4427202e6bfc883f512e87c09 🔍`
SHA3	`2ae58b544e9a15a873e855f9512408476344cd7a2fb869811d9756098dc74b2e 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
CompanyName
FileDescription
FileVersion (#2)	0.0.0.0
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
ProductName
ProductVersion (#2)	0.0.0.0

Resource LangID	English - United States

TLS Callbacks

StartAddressOfRawData	`0x8ee000`
EndAddressOfRawData	`0x8ee008`
AddressOfIndex	`0x8ea61c`
AddressOfCallbacks	`0x8ed040`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x00000000004047B0` `0x0000000000404780`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.