389f4d5e8db87292fb9b52a98d5306abad562e77810aa8f4bfabdbba2f839364

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2024-Jun-05 14:15:28
Detected languages English - United States
Debug artifacts C:\Users\Francja\source\repos\sv_pureLevelBypass\x64\Release\sv_pureLevelBypass.pdb

Plugin Output

Malicious The PE contains functions mostly used by malware. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowA
 Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
 Manipulates other processes:
  • WriteProcessMemory
  • OpenProcess
  • ReadProcessMemory
Malicious VirusTotal score: 6/69 (Scanned on 2026-07-17 10:34:48) APEX: Malicious
CrowdStrike: win/malicious_confidence_70% (W)
Gridinsoft: Trojan.Win64.Agent.cl
MaxSecure: Trojan.Malware.317832575.susgen
McAfeeD: ti!389F4D5E8DB8
TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101GF26ZU

Hashes

MD5 74d088679a50cfe89a747559ebcb24b0
SHA1 4f9808746795e2d5e6002c6ee66ecd1607a2880f
SHA256 389f4d5e8db87292fb9b52a98d5306abad562e77810aa8f4bfabdbba2f839364
SHA3 17f1fdd09f38ab8a1d5181f74b2db9653e49a9f152984cbd54d915639644ea69
SSDeep 6144:S+KNCcpbSuzWYZph0lhSMXlBXBWn47EP:+NCcpbS8jZph0lhSMXli4
Imports Hash 853ca5f9e8bf25047d4c028b283cbf5f

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2024-Jun-05 14:15:28
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xda00
SizeOfInitializedData 0x26200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000DB68 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x38000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6632cb0532f9314a70ded054e3f92117
SHA1 efcd452a8b043ef4895f7571501ebc9f795945d5
SHA256 bb1c6c67180aed13f3318e61223a0886f0824685088ded29096513249fa4b795
SHA3 82e779c51bb02dd47c8a4b2867b0db2bede142911b7689c8baed6e232d263c4c
VirtualSize 0xd853
VirtualAddress 0x1000
SizeOfRawData 0xda00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50602

.rdata

MD5 a378ad20fbcd309609a7a6029cf5ba5e
SHA1 667ad3335055302559fa7f703edbbfd3c5a6a0c9
SHA256 5c2b5e4d95fe796957c6eabbae7526cd0898bcc0bcbea1ca00a582c69cf67007
SHA3 96bb80bf90163864c4614f6fb6ed9d94cc64815401662b2ed4a3f3c745e8cf29
VirtualSize 0x24a96
VirtualAddress 0xf000
SizeOfRawData 0x24c00
PointerToRawData 0xde00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.69487

.data

MD5 f6d309caf4e0a0903365c0d7a9283a08
SHA1 34e04a3e87d85f8cad633e8df03a92014b352ad7
SHA256 8f74997faf3421232c3e52865b87d80b1726632f7b9381cfbc43abea0b15c62d
SHA3 10fdb1eb78674e81fe53983422697b07b44ffc13a9ea62ead7c8d99a7b49d928
VirtualSize 0x968
VirtualAddress 0x34000
SizeOfRawData 0x400
PointerToRawData 0x32a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.56322

.pdata

MD5 10089c00da1c1829e348782aba1e3d73
SHA1 4363b5845e00693f68d80d3b3e70add86c970ec2
SHA256 226d61c79f7cbd0440a624dd88696dd87dbc7cc5e7176b368e23831fc1f1f3dc
SHA3 564b571b567952800165e2bdf24830d3d4b870f37b72fa6b3257e150c6bc35f0
VirtualSize 0x744
VirtualAddress 0x35000
SizeOfRawData 0x800
PointerToRawData 0x32e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.45152

.rsrc

MD5 4c0974f46496b0dc7164575af8f9b24d
SHA1 02612e2784b1091f67a3e218a71272c57833f070
SHA256 b85eda5f27da0487f8494368ade8cf83156cf6fea54c2ecb185f2a8068ef3264
SHA3 5d1e3d8dcf7efb75f24052861039655b6ded5b30ef5e70499a0a9c04519498b6
VirtualSize 0x1e0
VirtualAddress 0x36000
SizeOfRawData 0x200
PointerToRawData 0x33600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71377

.reloc

MD5 1869f57651cb608bd45014a9bf9dac5b
SHA1 24a26b8c230a3d4f78d177a51785b41ae0fa84be
SHA256 fa495257a730a59dfc54a6d34cf535848a7a0e31f51b015d9d42b1496c68c15c
SHA3 75a926e8dab7f804025786629a74dbfd2b8f8efea9e16aa5a96c357bb03ba534
VirtualSize 0xac
VirtualAddress 0x37000
SizeOfRawData 0x200
PointerToRawData 0x33800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.20572

Imports

KERNEL32.dll WriteProcessMemory
GetConsoleScreenBufferInfo
SetConsoleTitleA
SetConsoleScreenBufferSize
GetStdHandle
SetConsoleMode
Module32Next
Module32First
OpenProcess
CreateToolhelp32Snapshot
GetConsoleMode
SetConsoleCursorInfo
CloseHandle
ReadProcessMemory
GetConsoleWindow
AllocConsole
VirtualQueryEx
GetModuleHandleW
GetLastError
MultiByteToWideChar
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
USER32.dll GetWindowLongA
FindWindowA
SetLayeredWindowAttributes
GetWindowThreadProcessId
SetWindowPos
SetWindowLongA
MSVCP140.dll ??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
??_7_Facet_base@std@@6B@
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
??_7facet@locale@std@@6B@
_Query_perf_counter
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
VCRUNTIME140.dll memmove
memset
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memcpy
VCRUNTIME140_1.dll __CxxFrameHandler4
api-ms-win-crt-heap-l1-1-0.dll malloc
_set_new_mode
_callnewh
calloc
free
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
freopen_s
__acrt_iob_func
_set_fmode
api-ms-win-crt-math-l1-1-0.dll _dsign
__setusermatherr
_fdsign
_ldsign
api-ms-win-crt-runtime-l1-1-0.dll __p___argc
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
_invalid_parameter_noinfo_noreturn
_set_app_type
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2024-Jun-05 14:15:28
Version 0.0
SizeofData 108
AddressOfRawData 0x31cf0
PointerToRawData 0x30af0
Referenced File C:\Users\Francja\source\repos\sv_pureLevelBypass\x64\Release\sv_pureLevelBypass.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2024-Jun-05 14:15:28
Version 0.0
SizeofData 20
AddressOfRawData 0x31d5c
PointerToRawData 0x30b5c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-Jun-05 14:15:28
Version 0.0
SizeofData 800
AddressOfRawData 0x31d70
PointerToRawData 0x30b70

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2024-Jun-05 14:15:28
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140034000

RICH Header

XOR Key 0x58071884
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 10
ASM objects (33731) 3
C objects (33731) 10
C++ objects (33731) 32
Imports (33731) 6
Imports (30795) 5
Total imports 177
C++ objects (LTCG) (33808) 1
Resource objects (33808) 1
Linker (33808) 1

Errors

Leave a comment

No comments yet.