| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2022-Nov-16 05:24:36 |
| Debug artifacts |
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb
|
| Comments | Sunshine allrihts |
| CompanyName | Sunshine |
| FileDescription | ConsoleApp1 |
| FileVersion | 1.0.0.0 |
| InternalName | ConsoleApp1.dll |
| LegalCopyright | Sunshine |
| OriginalFilename | ConsoleApp1.dll |
| ProductName | ConsoleApp1 |
| ProductVersion | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2022-Nov-16 05:24:36 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x18e00 |
| SizeOfInitializedData | 0xd800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000149F0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x180000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
FindClose
FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW |
|---|---|
| USER32.dll |
MessageBoxW
|
| SHELL32.dll |
ShellExecuteW
|
| ADVAPI32.dll |
RegOpenKeyExW
RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW |
| api-ms-win-crt-runtime-l1-1-0.dll |
_initialize_wide_environment
_invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _crt_atexit _get_initial_wide_environment _initialize_onexit_table _exit __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _initterm _configure_wide_argv terminate _initterm_e _register_onexit_function _errno abort exit |
| api-ms-win-crt-stdio-l1-1-0.dll |
fclose
__p__commode __stdio_common_vsprintf_s fread fseek fwrite _set_fmode __acrt_iob_func fputwc fputws __stdio_common_vfwprintf _wfopen fflush __stdio_common_vswprintf |
| api-ms-win-crt-string-l1-1-0.dll |
wcsncmp
_wcsnicmp _wcsdup strcspn strcpy_s _wcsicmp wcsnlen memset |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
frexp |
| api-ms-win-crt-heap-l1-1-0.dll |
calloc
free _callnewh malloc _set_new_mode |
| api-ms-win-crt-locale-l1-1-0.dll |
___mb_cur_max_func
setlocale __pctype_func ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func localeconv |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_wrename
_wremove |
| api-ms-win-crt-convert-l1-1-0.dll |
wcstoul
_wtoi |
| api-ms-win-crt-time-l1-1-0.dll |
wcsftime
_gmtime64 _time64 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | Sunshine allrihts |
| CompanyName | Sunshine |
| FileDescription | ConsoleApp1 |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | ConsoleApp1.dll |
| LegalCopyright | Sunshine |
| OriginalFilename | ConsoleApp1.dll |
| ProductName | ConsoleApp1 |
| ProductVersion (#2) | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Nov-16 05:24:36 |
| Version | 0.0 |
| SizeofData | 110 |
| AddressOfRawData | 0x20a4c |
| PointerToRawData | 0x1fc4c |
| Referenced File | D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Nov-16 05:24:36 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x20abc |
| PointerToRawData | 0x1fcbc |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Nov-16 05:24:36 |
| Version | 0.0 |
| SizeofData | 924 |
| AddressOfRawData | 0x20ad0 |
| PointerToRawData | 0x1fcd0 |
| StartAddressOfRawData | 0x140020e90 |
|---|---|
| EndAddressOfRawData | 0x140020ea0 |
| AddressOfIndex | 0x140026110 |
| AddressOfCallbacks | 0x14001a530 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140025528 |
| GuardCFCheckFunctionPointer | 5368816744 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0x1966703a |
|---|---|
| Unmarked objects | 0 |
| C objects (30034) | 12 |
| ASM objects (30034) | 9 |
| C++ objects (30034) | 77 |
| Imports (VS2008 SP1 build 30729) | 18 |
| Imports (26213) | 9 |
| Total imports | 167 |
| C++ objects (VS2019 Update 11 (16.11.10) compiler 30140) | 13 |
| Linker (VS2019 Update 11 (16.11.10) compiler 30140) | 1 |