209d374d0bf832eda2a6d7dc050c80fada7cb2075f1f60468cd058235aff1088

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Feb-22 17:32:12
Detected languages English - United States
FileVersion 1.0.0.0

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryExW
 Can create temporary files:
  • CreateFileA
  • GetTempPathA
  • CreateFileW
  • GetTempPathW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 12909e86b37bf37a586753a787fdb6a0 🔍
SHA1 823c86758957fb3121b4460398ea3f1aa84e1a81 🔍
SHA256 209d374d0bf832eda2a6d7dc050c80fada7cb2075f1f60468cd058235aff1088 🔍
SHA3 00cf18b725f2496b90210138b7538dcb8c5e859628a7424a1ec78c2ff01f8065 🔍
SSDeep 24576:4vFGLcq+gjzzN9cl7U0ZaWYJMiKiqNwS+62kfoF4KuMN6eMwpOrPi:/bcljZeB7VPMhPi 🔍
Imports Hash 44ff467624b508f09332e2db0fe06f8d 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2024-Feb-22 17:32:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x141e00
SizeOfInitializedData 0xda400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000115D08 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x220000
SizeOfHeaders 0x400
Checksum 0x21de70
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 15cd6a6995b2dc1b2408819be6f157ee 🔍
SHA1 85cf29b3cb644c02025fc002d9a1ae38b8096cf9 🔍
SHA256 931c61ad2d2fcbd909fba511b3ad0be88a04703ba064a4407cffac16fd070797 🔍
SHA3 4233e1497b6b28030514464cb266bfa6fc7d4bafccda59d31964b699b4e3596f 🔍
VirtualSize 0x141d8c
VirtualAddress 0x1000
SizeOfRawData 0x141e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47445

.rdata

MD5 bd03ca0b3a05446ce78687ccf6c8a23b 🔍
SHA1 b05e6a353adc670eab9a083955702db7fecff7e4 🔍
SHA256 80dd5aa012dc3d060568b9cc331c097f8497403df515d27b9f8ba637fc2ff643 🔍
SHA3 fded246aa3b2ee5902ed77e122e968c5b259bf570b1d407b740ef49d7f1d9036 🔍
VirtualSize 0x50ef2
VirtualAddress 0x143000
SizeOfRawData 0x51000
PointerToRawData 0x142200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.82995

.data

MD5 b5610f3b94279586d134428ec0556a58 🔍
SHA1 6d4371a3b3ada651ce10dd50b90d8feca2b6eb1c 🔍
SHA256 93e480adff7da49c1abc98e1bf740692c247f41603beae5f8285ead1318ce298 🔍
SHA3 4c2fae2ee789dfe279bf0e81dd5bbb9db5fa4789467308e4805f72008dfdf4bb 🔍
VirtualSize 0x7aad4
VirtualAddress 0x194000
SizeOfRawData 0x78e00
PointerToRawData 0x193200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.76918

.pdata

MD5 150d0aaaa0d30c5bf2d851ebcc0c5e76 🔍
SHA1 e1d9ef360ff5f79f68cde197570e0dea981703fc 🔍
SHA256 26f0ec4de702bec957fe5de6cee644be04cc92ebf53deebcfb074226647c0fee 🔍
SHA3 d03589ba24b67029c63bfc9d8d5db2c68175a5c68395a1c1fb1ca6e892ba1cb2 🔍
VirtualSize 0xc930
VirtualAddress 0x20f000
SizeOfRawData 0xca00
PointerToRawData 0x20c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.12629

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x21c000
SizeOfRawData 0x200
PointerToRawData 0x218a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 7c94996543a5bd0508b6824539d2a4f4 🔍
SHA1 28c787817044be6817a0d76bcea290d34ad13bb3 🔍
SHA256 f8aca4fe01c203e7d74b9609a672d6af7eb72d3c9371268d423b3bece35de730 🔍
SHA3 7eadf9d3ab05b6a492dadc7794dce233adb56ef85253c8f745f80e63146e5f09 🔍
VirtualSize 0x3e0
VirtualAddress 0x21d000
SizeOfRawData 0x400
PointerToRawData 0x218c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.19065

.reloc

MD5 ce2032a6a2f402d0dc62401f943229d3 🔍
SHA1 a96b70557e16401aa5e9a2a0a95842300f158b37 🔍
SHA256 bc93ed529c4220115eba8785f886f8d6a7cbcde3e808991feac0376262807619 🔍
SHA3 b0f04b4d19d5cc694dc19db3575902b8e585ea9ae356b7d990b5dd9ad0283329 🔍
VirtualSize 0x1630
VirtualAddress 0x21e000
SizeOfRawData 0x1800
PointerToRawData 0x219000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.32601

Imports

KERNEL32.dll GetLocalTime
GetSystemTime
LoadLibraryA
CloseHandle
GetCurrentProcess
WaitForSingleObject
GetCurrentThreadId
GetLastError
FormatMessageA
GetModuleFileNameA
MultiByteToWideChar
GetFileAttributesA
CreateFileA
GetSystemInfo
HeapAlloc
GetProcAddress
GetProcessHeap
FreeLibrary
VirtualFree
CreateMutexA
ReleaseMutex
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleW
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
GetNativeSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameW
GetStdHandle
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleOutputCP
RtlUnwind

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.1361
MD5 f352484fae90edc6ee36bbf4084284c5 🔍
SHA1 ed2c7cb70273be9623fcb13e20970d6409b2f92b 🔍
SHA256 67961ba0f95334cebc7001318c498c3c581c3dad693d6aabb9dd75e8771ef880 🔍
SHA3 67054123bf5a5f10a2344b7f32f9ebb41487d6f208af0c1524769b55554948f7 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.1
ProductVersion 1.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileVersion (#2) 1.0.0.0
Resource LangID English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-May-29 08:54:33
Version 0.0
SizeofData 940
AddressOfRawData 0x183924
PointerToRawData 0x182b24

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140197e40

RICH Header

XOR Key 0xd51efdc2
Unmarked objects 0
C++ objects (33140) 174
C objects (33140) 19
ASM objects (33140) 7
ASM objects (33731) 10
C objects (33731) 17
C++ objects (33731) 81
Imports (33140) 3
Total imports 153
C objects (33811) 11
C++ objects (LTCG) (33811) 36
Resource objects (33811) 1
151 1
Linker (33811) 1

Errors

Leave a comment

No comments yet.