| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2022-Jan-18 19:08:39 |
| Detected languages |
English - United States
|
| Debug artifacts |
D:\leetcode\needle3\x64\Debug\needle3.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | The PE is possibly packed. |
Section .textbss is both writable and executable.
Unusual section name found: .msvcjmc |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 37/70 (Scanned on 2023-01-30 13:26:37) |
Lionic:
Trojan.Win32.Pincav.4!c
Elastic: malicious (moderate confidence) Cynet: Malicious (score: 100) ALYac: Trojan.GenericKD.64436265 Cylance: Unsafe Zillya: Trojan.Pincav.Win32.30632 Sangfor: Trojan.Win32.Agent.V6s8 Cyren: W64/ABRisk.KNRZ-7792 Symantec: ML.Attribute.HighConfidence ESET-NOD32: a variant of Generik.CENYOZO Kaspersky: UDS:Trojan.Win32.Pincav BitDefender: Trojan.GenericKD.64436265 MicroWorld-eScan: Trojan.GenericKD.64436265 Avast: Win64:Malware-gen Emsisoft: Trojan.GenericKD.64436265 (B) VIPRE: Trojan.GenericKD.64436265 TrendMicro: TROJ_GEN.R002C0WLN22 McAfee-GW-Edition: BehavesLike.Win64.Injector.tm FireEye: Trojan.GenericKD.64436265 Sophos: Mal/Generic-R Jiangmin: Trojan.Pincav.bdp Antiy-AVL: Trojan/Win64.SGeneric Microsoft: Trojan:Script/Phonzy.A!ml Arcabit: Trojan.Generic.D3D73829 ZoneAlarm: UDS:Trojan.Win32.Pincav GData: Trojan.GenericKD.64436265 Google: Detected McAfee: Artemis!2AC1F1DB6D3D MAX: malware (ai score=100) VBA32: Trojan.Pincav Malwarebytes: Malware.AI.4269289797 TrendMicro-HouseCall: TROJ_GEN.R002C0WLN22 Ikarus: Trojan.Win64.Meterpreter MaxSecure: Trojan.Malware.300983.susgen Fortinet: W32/PossibleThreat AVG: Win64:Malware-gen Panda: Trj/Chgt.AD |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 11 |
| TimeDateStamp | 2022-Jan-18 19:08:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xd0000 |
| SizeOfInitializedData | 0x42a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000064FE0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x17b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
CloseHandle
ExitProcess CreateRemoteThread OpenProcess VirtualAllocEx IsDebuggerPresent GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32First Process32Next CreateFileW WriteProcessMemory GetFullPathNameA GetCurrentThreadId RaiseException MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapSize HeapValidate GetSystemInfo GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetCurrentThread OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW HeapReAlloc HeapQueryInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW RtlUnwind |
|---|---|
| ADVAPI32.dll |
GetUserNameA
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Jan-18 19:08:39 |
| Version | 0.0 |
| SizeofData | 66 |
| AddressOfRawData | 0x15be2c |
| PointerToRawData | 0xf922c |
| Referenced File | D:\leetcode\needle3\x64\Debug\needle3.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Jan-18 19:08:39 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x15be70 |
| PointerToRawData | 0xf9270 |
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140164008 |
| XOR Key | 0xc9fe68ed |
|---|---|
| Unmarked objects | 0 |
| C objects (27412) | 11 |
| ASM objects (27412) | 7 |
| C++ objects (27412) | 145 |
| C++ objects (30034) | 45 |
| C objects (30034) | 17 |
| ASM objects (30034) | 9 |
| Imports (27412) | 5 |
| Total imports | 98 |
| C++ objects (VS2019 Update 10 (16.10.4) compiler 30040) | 1 |
| Resource objects (VS2019 Update 10 (16.10.4) compiler 30040) | 1 |
| Linker (VS2019 Update 10 (16.10.4) compiler 30040) | 1 |