| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-Jun-03 20:53:54 |
| TLS Callbacks | 1 callback(s) detected. |
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for VirtualBox presence:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA256
Uses constants related to AES |
| Malicious | The file headers were tampered with. | The RICH header checksum is invalid. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. | 5844 bytes of data starting at offset 0x736200. |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2020-Jun-03 20:53:54 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x42600 |
| SizeOfInitializedData | 0x6f4400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000034A74 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x73b000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x746241 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| CRYPT32.dll |
CertFreeCertificateContext
|
|---|---|
| Secur32.dll |
GetUserNameExW
|
| WINHTTP.dll |
WinHttpCrackUrl
WinHttpCloseHandle |
| bcrypt.dll |
BCryptOpenAlgorithmProvider
|
| WINTRUST.dll |
WinVerifyTrust
|
| WS2_32.dll |
WSAStartup
|
| KERNEL32.dll |
SetFilePointerEx
FlushFileBuffers HeapSize LCMapStringW CompareStringW LoadLibraryA GetProcAddress GetProcessHeap HeapFree ExitProcess GetModuleHandleA CloseHandle GetTickCount64 FindFirstFileExW GetFileAttributesW GetLastError FindNextFileW FindClose GetLocalTime Sleep AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc VirtualAlloc VirtualProtect GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess lstrlenW GetCurrentProcessId ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW SetFileTime SetFileInformationByHandle GetModuleHandleW FormatMessageW GetModuleFileNameW DeleteFileW WriteFileEx SleepEx ReadFileEx GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW DuplicateHandle CreateThread SetErrorMode FindFirstFileW FlsAlloc HeapDestroy TlsFree LoadLibraryExW CreateMutexA GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter IsValidCodePage GetACP |
| USER32.dll |
GetCursorPos
GetForegroundWindow |
| ADVAPI32.dll |
GetUserNameW
|
| api-ms-win-core-synch-l1-2-0.dll |
WaitOnAddress
WakeByAddressSingle WakeByAddressAll |
| ntdll.dll |
NtCreateNamedPipeFile
NtWriteFile RtlNtStatusToDosError NtOpenFile |
| StartAddressOfRawData | 0x14072d1b8 |
|---|---|
| EndAddressOfRawData | 0x14072d210 |
| AddressOfIndex | 0x140734c28 |
| AddressOfCallbacks | 0x1400444d0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001400214B0
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1407340c0 |
| XOR Key | 0x503c66b6 |
|---|---|
| Unmarked objects | 0 |
| C objects (CVTCIL) (VS2019 Update 2 (16.2) compiler 27905) | 181 |
| C++ objects (VS2010 SP1 build 40219) | 76 |
| Linker (VS2013 build 21005) | 113 |
| C++ objects (VS2017 v15.8.1 compiler 26726) | 113 |
| C++ objects (POGO O) (33135) | 57 |
| Imports (VS2017 v15.3.* compiler 25506) | 122 |
No comments yet.