23dc88a23b7ddc929c826e8ed62f72a859f71800c1b0cecd736145ac2b6ddf80

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jul-27 16:43:20
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: /4
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Suspicious The file contains overlay data. 14 bytes of data starting at offset 0x5e00.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 89ed2ebb54af85afa65272b65fb62bad
SHA1 1eaa955d911b27d664bae74d3de49da310975a31
SHA256 23dc88a23b7ddc929c826e8ed62f72a859f71800c1b0cecd736145ac2b6ddf80
SHA3 ba9bad1846f464c73cd14f1d2302200e9b3daddda9161d147876bc17be4a1d29
SSDeep 384:0QbvcUZy+PecJOtP1MllXnLxhp5pDcz6p3YNYTIU0AQTqM:0QbZua56W2NY+AYqM
Imports Hash 743412a344dc86270a5eaf13a763184c

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 9
TimeDateStamp 2026-Jul-27 16:43:20
PointerToSymbolTable 0x5e00
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x2200
SizeOfInitializedData 0x3800
SizeOfUninitializedData 0x8200
AddressOfEntryPoint 0x000013F0 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x4000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x15000
SizeOfHeaders 0x400
Checksum 0x14461
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 2f86b33d3fde7f063290ab75b9c0c9cd
SHA1 3456a27d879d1ed487cda783a25e2c80c100516e
SHA256 0cd25e0f3a4aea37096263c0ce540b2bb7475cf2b5ff9f8af6913b5fef0a6562
SHA3 daea6cb013e417c9289c3aa6e5cdd9bffd8d10f82b20360227a7f01f7a1d220f
VirtualSize 0x20c0
VirtualAddress 0x1000
SizeOfRawData 0x2200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.0535

.data

MD5 d994d843affd17bd53a8b1d2f1a1a781
SHA1 5c2e48440cc4c6b303f7b9f9814711d1deff82b5
SHA256 6f949818d0e6a15d6d416fd9788074bb9373f03b443b90e4566227321566a450
SHA3 1c935ae6455cb2e5ffdc863d0261a1cc1d842df3956b859f7178826304f8eb79
VirtualSize 0x34
VirtualAddress 0x4000
SizeOfRawData 0x200
PointerToRawData 0x2600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.598595

.rdata

MD5 2ccf86301320a7705cb663b862406992
SHA1 18d0340afa453a37aba366cba6f585cfd718cbe8
SHA256 ab41eba3bd94dfaebc7b112c9c4bd2f1511b257dcd3b9ac0d1384fd4561078fc
SHA3 554504fda9fee62ac06e80e6bd0481bf0cf9b0042867e4af203a5ea4a4e340d7
VirtualSize 0x1818
VirtualAddress 0x5000
SizeOfRawData 0x1a00
PointerToRawData 0x2800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.91884

/4

MD5 1ca143cf4ff05291edc0887af316595d
SHA1 69bc6a4b32ab5407b6ce2914e62619122688f21b
SHA256 74523f7ced5fd98aee8ae1533e08f17cbdfd094a564d105cadb0d5d70cf8af8d
SHA3 1c401f59229123dbe19e0da9cfc3b4921eb183f8bf0b6ad7b8a507bc251cd7d7
VirtualSize 0x9d0
VirtualAddress 0x7000
SizeOfRawData 0xa00
PointerToRawData 0x4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.66077

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x80dc
VirtualAddress 0x8000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 3e47e091c6aa5d94dac29123f8ccbf7a
SHA1 3621540c7a72a483ec5420ca6944504bec933f3b
SHA256 a8476847c116918ced50db4a2c3f70b9c794847b52fa6f4f012344c8568855e8
SHA3 28d94b416779390e42de5ba4e3440f667c7a9bbb54cf4962b519c62329a72b6f
VirtualSize 0x65c
VirtualAddress 0x11000
SizeOfRawData 0x800
PointerToRawData 0x4c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.4011

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x8
VirtualAddress 0x12000
SizeOfRawData 0x200
PointerToRawData 0x5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 f416dc0e2bf14ce406228e60431f6013
SHA1 fa10c348f40a339c4354ea567f771d8b9a1f89f1
SHA256 7026573444ddb0060e843db6c9bc66f2e229f6c3418c5037c3103450395cdceb
SHA3 c7822905146a61e1cf22aec6e16db9cae9fb222d4fba1605fea860dac4261cc6
VirtualSize 0x3e0
VirtualAddress 0x13000
SizeOfRawData 0x400
PointerToRawData 0x5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.23255

.reloc

MD5 674572a5c275d8174ea59b0564b0b0f2
SHA1 b4a7ad5a0f92d7c598366afc0bf07b1c88301c23
SHA256 2abd597dd276cbd61d89c0eb1994f73c4235e69079d3b1b1c54282bd68c7bcd7
SHA3 f1f227157b6ca122639206dadbdf800be9d6d2a4ffa285aacc49d86e9c1fade9
VirtualSize 0x2d8
VirtualAddress 0x14000
SizeOfRawData 0x400
PointerToRawData 0x5a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.30168

Imports

KERNEL32.dll DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GlobalAlloc
GlobalLock
GlobalUnlock
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt.dll __p__iob
__p___initenv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_ismbblead
atexit
_wtof
abort
calloc
ceil
exit
fprintf
free
malloc
memcpy
signal
strlen
strncmp
swprintf_s
vfprintf
wcslen
__getmainargs
USER32.dll CloseClipboard
DialogBoxParamW
EmptyClipboard
EndDialog
GetDlgItemTextW
OpenClipboard
SendDlgItemMessageW
SetClipboardData
SetDlgItemTextW

Delayed Imports

100

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x384
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4239
MD5 7ae002a07fca0e6f5a4461e5ca68dcec
SHA1 ab1e6162044eb87545ad24384d4c97dc9a109894
SHA256 5ae4bf68492eff5e7526985f74d1cad01de07e8d2586b3581a8e56650d51c4ac
SHA3 f51d11be5414603ed061c14b1ffcedb8b0c05962351d6cc9b174884d30ad5499

Version Info

TLS Callbacks

StartAddressOfRawData 0x412000
EndAddressOfRawData 0x412004
AddressOfIndex 0x410080
AddressOfCallbacks 0x406804
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks 0x00401E50
0x00401E10

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4! [*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.