Manalyze report for 311fbef60fc192d8b1cac321ee5a04487aa5c05e33208cb3a6f7df87ced199aa

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Oct-16 19:45:11

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: System32\drivers\etc\hosts`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to RC5 or RC6`
Suspicious	The PE is possibly packed.	`Unusual section name found: .0data`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`9f2e71c5c57271970b8d808f8c8170ae` 🔍
SHA1	`828f60365e8c07e11e85ea58c25c91d709da02bb` 🔍
SHA256	`311fbef60fc192d8b1cac321ee5a04487aa5c05e33208cb3a6f7df87ced199aa` 🔍
SHA3	`ef69b5e350a95c28cc492a3840c553732f72286e2edfd6e33088b7531af66bbb` 🔍
SSDeep	`49152:UUBdsnI/MS+VMP17bXrOdwNpLYfLgOzNu:vP17zCqNiHzN` 🔍
Imports Hash	`c0a2754cb9643ffeb904a59aa22f66a4` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`12`
TimeDateStamp	2026-Oct-16 19:45:11
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x17ce00`
SizeOfInitializedData	`0x80600`
SizeOfUninitializedData	`0x400`
AddressOfEntryPoint	`0x00000000002047A0 (Section: .gfids)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x30d000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x17cc10`
VirtualAddress	`0x1000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.data

MD5	`a7a03545566c2a62c3f804820d5eccff 🔍`
SHA1	`14bfeb315e95ac48e9df98460bd26e0fae8ceb1c 🔍`
SHA256	`d7b2a6ee8c39127d1d48d03eb81848089fcc96604a4d53e4290133d269c92b34 🔍`
SHA3	`4e2f02c8fcd3bcc84607a6680630ec83a12010033992831f0d2e843cd1b96faf 🔍`
VirtualSize	`0xca0`
VirtualAddress	`0x17e000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.53222`

.rdata

MD5	`b9175ea5e5c99b57c1c4817f648f2be0 🔍`
SHA1	`1902863ace1c609fbfc8615144e340a7a8a1532f 🔍`
SHA256	`bde93232103fd31d30d06438d7dd2ff73aa2b8235262cdb65f3acfe34a7fe3c9 🔍`
SHA3	`02afa855267fbec94618cf03b3ad4fcef8fef00275f7507946dd95d394dae057 🔍`
VirtualSize	`0x620e0`
VirtualAddress	`0x17f000`
SizeOfRawData	`0x62200`
PointerToRawData	`0x1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.8961`

.eh_fram

MD5	`978270becc36f36cf4d04066490b77bb 🔍`
SHA1	`e06635283d80d4009ae53b52476133de58a7f9e8 🔍`
SHA256	`08d40a2545ea1d1bde69a42f6bc8c7c65ae93d0bb0d8d19954ab60a77c1afc01 🔍`
SHA3	`e409be0cce57f63fce626501fb95e88eb38e2ffce3f702bcf551f79f7dafd140 🔍`
VirtualSize	`0x4`
VirtualAddress	`0x1e2000`
SizeOfRawData	`0x200`
PointerToRawData	`0x63400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.53386`

.pdata

MD5	`63151aeb1f8ca8fbffd2ad473208d1a9 🔍`
SHA1	`a4b7a0c6aa630b82a1aa10caa959b28f79432f74 🔍`
SHA256	`75dde889bc79404e05111535f73177ccee8fe53b6db5245a82946d8690056bba 🔍`
SHA3	`fd0b71e911b0d1166fdbbbd04b706f25c23c662c58adf6ea4009fe5c38d7cb32 🔍`
VirtualSize	`0xac44`
VirtualAddress	`0x1e3000`
SizeOfRawData	`0xae00`
PointerToRawData	`0x63600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.24837`

.xdata

MD5	`c1143e7e813f558f48ea4cc203ab9b41 🔍`
SHA1	`75480b90e4106ba71776c07057938c6065c82588 🔍`
SHA256	`40e31597bda0a001fe089da482c05648406dedd7a4d3f6fab5630b269ba6c032 🔍`
SHA3	`415efd6aaf038b0648bda84b873626bd864282654c04d20524a839b87a97fbe0 🔍`
VirtualSize	`0xe000`
VirtualAddress	`0x1ee000`
SizeOfRawData	`0xe000`
PointerToRawData	`0x6e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.96003`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x2e0`
VirtualAddress	`0x1fc000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`95a09c3762d8992e65256a18cd74e11a 🔍`
SHA1	`771a79a926413184a1ba788b0a7d19b53a7001e2 🔍`
SHA256	`098858b59ec7abce5bec075496d3fa5f714edd4655f449b54a8fd3d5c85175d4 🔍`
SHA3	`a540dd1ce72d8dc5a55e7afa50b512c28d55d795b00f0f37066eff16eeea1191 🔍`
VirtualSize	`0x1da8`
VirtualAddress	`0x1fd000`
SizeOfRawData	`0x1e00`
PointerToRawData	`0x7c400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.02362`

.tls

MD5	`cfeac188873a2bf4623f96a4cb815849 🔍`
SHA1	`2fe4abf0281589a72efb24954d57b71d79571979 🔍`
SHA256	`a12f330c3e43a354786ea97e67327b6fb28fb252bda3b0348df086cbf54b81d0 🔍`
SHA3	`1da7ef5b22f2442ebcbe54c12ec6b8f23933243974b3cad74cda0248ce9b6254 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x1ff000`
SizeOfRawData	`0x200`
PointerToRawData	`0x7e200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.54031`

.reloc

MD5	`bd958fede1222473fb49d3bd251de99f 🔍`
SHA1	`b452ad66c599f2d90420860e5a952ec050330de7 🔍`
SHA256	`204c61e78804a62d3f73e0574d7fab3b72f0f7d719ee5e939c0f3794f7010016 🔍`
SHA3	`96385234bcdeeb6d608573ddc7c27f90d7a5f84a9d0f9818d95ceb744bbeb505 🔍`
VirtualSize	`0x2474`
VirtualAddress	`0x200000`
SizeOfRawData	`0x2600`
PointerToRawData	`0x7e400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.70918`

.gfids

MD5	`02c6d9cf4a1106a8eb1a0d360e46349d 🔍`
SHA1	`c7ba98ae307c855645649c3cf855e2aafbaad683 🔍`
SHA256	`938d900c0a685a88f0906728b28b6effde1e76379ddb706d28ed31fbf1653a4c 🔍`
SHA3	`d18e7cfb36fc7f2aab59be62c9b58948b2dae141c3f17fe056ddd05083a2abbe 🔍`
VirtualSize	`0x2140`
VirtualAddress	`0x203000`
SizeOfRawData	`0x2200`
PointerToRawData	`0x80a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.97681`

.0data

MD5	`c981e9462143afd4c43acbafd569f0b9 🔍`
SHA1	`8b162dce1a585cea2889e45b6121abc46c7f3f9f 🔍`
SHA256	`5919807b204540d5c5bcc1d6fcfcf702d04a4ac6e96c1acdddaac15d5df60177 🔍`
SHA3	`60c056812103ef14196b544ed6a2c5f37ec513c294c7354a8be80356f3188655 🔍`
VirtualSize	`0x106344`
VirtualAddress	`0x206000`
SizeOfRawData	`0x106400`
PointerToRawData	`0x82c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.99983`

Imports

bcryptprimitives.dll	`ProcessPrng`
api-ms-win-core-synch-l1-2-0.dll	`WaitOnAddress` `WakeByAddressAll` `WakeByAddressSingle`
api-ms-win-crt-environment-l1-1-0.dll	`__p__environ`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr` `pow`
api-ms-win-crt-private-l1-1-0.dll	`memcmp` `memcpy` `memmove`
api-ms-win-crt-runtime-l1-1-0.dll	`_set_app_type` `__p___argc` `__p___argv` `_cexit` `_configure_narrow_argv` `_crt_atexit` `_exit` `_fpreset` `_initialize_narrow_environment` `_initterm` `_initterm_e` `_set_invalid_parameter_handler` `abort` `exit` `signal`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `fflush` `setvbuf`
api-ms-win-crt-string-l1-1-0.dll	`memset` `strlen` `strncmp`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.