38d9e43c5afbc7af37b7d3ea0423c4eabafcbd4df8b5413ef02cf94aeff2761a

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 1980-Jan-01 00:00:00
TLS Callbacks 1 callback(s) detected.

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for VMWare presence:
  • VMWARE
 Contains domain names:
  • GoDaddy.com
  • birthpopuptypesapplyImagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedTermspartsGroupbrandusingwomanfalsereadyaudiotakeswhile.com
  • genretrucklooksValueFrame.net
  • http://www.C
  • http://www.a
  • http://www.css
  • http://www.hortcut
  • http://www.icon
  • http://www.interpretation
  • http://www.language
  • http://www.style
  • http://www.text-decoration
  • http://www.w3.org
  • http://www.w3.org/shortcut
  • http://www.wencodeURIComponent
  • http://www.years
  • https://www.World
  • https://www.recent
  • openssl.org
  • thing.org
  • www.w3.org
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Suspicious The PE is possibly packed. The PE only has 0 import(s).
Suspicious The file contains overlay data. 922746 bytes of data starting at offset 0x48ae00.
The overlay data has an entropy of 7.99417 and is possibly compressed or encrypted.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 c3db4d5b49d599e054913ca09387a92d 🔍
SHA1 8ec7e9cb64e3f693fa0fdc2cece29efe65ddfd8a 🔍
SHA256 38d9e43c5afbc7af37b7d3ea0423c4eabafcbd4df8b5413ef02cf94aeff2761a 🔍
SHA3 0ebe560d90183a3f980b9290ef30148c4eec7907545dcd1e3b4aefc8b618b49a 🔍
SSDeep 98304:oo7J1mhOXdJKCPuThYGO30GYRhkcU+JBusxPMyvgf9:l1mhOXdJtKhYREGYo65MyO9 🔍
Imports Hash d41d8cd98f00b204e9800998ecf8427e 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 1980-Jan-01 00:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x32f400
SizeOfInitializedData 0x15b600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000004A10 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x490000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c3aa61cc7979a0f3861466cabb9337ef 🔍
SHA1 1199cfc20ffbcfaa45601efc03f55b7a0484f71a 🔍
SHA256 e79346ab469fb7e8331103f6e6589e63aabd60e894d63402e197f9146d703a4d 🔍
SHA3 2608540ba2fbb205aa421cf45a49b70716c09845e945c0672d6314614cc45f59 🔍
VirtualSize 0x32f293
VirtualAddress 0x1000
SizeOfRawData 0x32f400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.3904

.rdata

MD5 ef9bf201ab1f76361aa71a14c1da5d04 🔍
SHA1 51d1b35e1bc73ec902bbeaee6c4d956df5b74fbe 🔍
SHA256 b00b310c2479271982bb1b5c0dd1a168c9b5c9712de24cade28fb04462927079 🔍
SHA3 c8b49a4ee0ecbdd6b6f39501cf950f4d6f776a709e76699ae79f4ed8b0d86d92 🔍
VirtualSize 0x145974
VirtualAddress 0x331000
SizeOfRawData 0x145a00
PointerToRawData 0x32f800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.78621

.data

MD5 b065993fdba75bd0587bb4639e83cdd5 🔍
SHA1 786a97b8b335eca8433b4f661695b875959bf330 🔍
SHA256 94063f0e9d3caa2b83826e77dfa1aefb85ad86757812750b3d90b75c8381c63e 🔍
SHA3 437f3064648cdbc25867598f8db94638fa904f4240d77bcd9adeac954482cb82 🔍
VirtualSize 0x6e10
VirtualAddress 0x477000
SizeOfRawData 0x6800
PointerToRawData 0x475200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.8023

.pdata

MD5 a9b27f22ad24af502ad6c4793f3830bb 🔍
SHA1 30b7c84a33a02d049692522938ee594d30ab9761 🔍
SHA256 5629b6b96e26d0bedbcb5f96d59fc22b43ce5af08ed8c1ac293d9bc1c1d1c9c6 🔍
SHA3 642e3267edabcb3d72ec56fcbc286e83bdca4a56a19240f8ee912545185029d2 🔍
VirtualSize 0xcc00
VirtualAddress 0x47e000
SizeOfRawData 0xcc00
PointerToRawData 0x47ba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.04318

.CRT

MD5 a5574fd395ca3dd1b17efa7e13b797f8 🔍
SHA1 c361d9869f9ca9001912ad5f2ef3404464d3829f 🔍
SHA256 97e82089dc4e9d70c60d0dcd9b93bb0375372f57cbcbe4c7a1e1ff11f815d030 🔍
SHA3 b15bb6dc92370fb3f7d8ea2c30d49aedc40baeabeacbfce61c022a375ae36b6c 🔍
VirtualSize 0x28
VirtualAddress 0x48b000
SizeOfRawData 0x200
PointerToRawData 0x488600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.10191

.tls

MD5 52509857a82ecbce9ed1b7a20e232f49 🔍
SHA1 2e6b79ff07fed520c5bac515612149cdbf4d7cb9 🔍
SHA256 f92b7ed0d8315bb471e5395df60f56352b129e50fbdf92f6185a856ad782b7ea 🔍
SHA3 1658a974309fa5c5e70d74a95970ea650b970c1b8f9431aa2cfe8ce6769cb4a4 🔍
VirtualSize 0xc9
VirtualAddress 0x48c000
SizeOfRawData 0x200
PointerToRawData 0x488800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0203931

.reloc

MD5 298ffc1b9501d39ad41d7007b354a320 🔍
SHA1 22bb09174fecf6aae69cea7785111fefec7bbf20 🔍
SHA256 831e5c0e4c0416c3631b349740654c5f44402a3d59e49898189accdad9c435be 🔍
SHA3 00f203c2786153a153503b3323663cc6d5a02a3e7ddf6380fad7c47746fddf3e 🔍
VirtualSize 0x22f8
VirtualAddress 0x48d000
SizeOfRawData 0x2400
PointerToRawData 0x488a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.41237

Imports

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x14048c000
EndAddressOfRawData 0x14048c0c8
AddressOfIndex 0x14047d898
AddressOfCallbacks 0x14048b018
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x00000001401949A0

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14047d640

RICH Header

Errors

Leave a comment

No comments yet.