| Architecture |
IMAGE_FILE_MACHINE_I386
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date |
2026-May-04 00:45:11
|
| Suspicious |
The PE is possibly packed. |
The PE only has 0 import(s).
|
| Suspicious |
VirusTotal score: 2/66 (Scanned on 2026-07-13 01:04:20) |
Cynet:
Malicious (score: 100)
Kingsoft:
malware.kb.a.762
|
| MD5 |
07b8756c045332683c405fcad9f98175
|
| SHA1 |
a2f2f35e25ee99ceacc96b9063347e1a8308b7f6
|
| SHA256 |
3b22e617b45e476de461dbba34ac066ad8c4adadebc425fa80823b28e93aec34
|
| SHA3 |
cd6379050799ede2bc7981185a8a4d36acbb2c1e366b25b7dbbba37440c9802c
|
| SSDeep |
1536:UhfnSBBu8uXAjn4/ObeApLqcJxVqe8pXEgWE4wuLjVidJnnPCa2RY66fl5QDK4Xe:UhfnSBBuDXEn9pLqQYddMVi/nA16odQp
|
| Imports Hash |
d41d8cd98f00b204e9800998ecf8427e
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x80
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections |
3
|
| TimeDateStamp |
2026-May-04 00:45:11
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xe0
|
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic |
PE32
|
| LinkerVersion |
8.0
|
| SizeOfCode |
0x72600
|
| SizeOfInitializedData |
0x800
|
| SizeOfUninitializedData |
0
|
| AddressOfEntryPoint |
0x0007448E (Section: .text)
|
| BaseOfCode |
0x2000
|
| BaseOfData |
0
|
| ImageBase |
0x400000
|
| SectionAlignment |
0x2000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
0.0
|
| SubsystemVersion |
4.0
|
| Win32VersionValue |
0
|
| SizeOfImage |
0x7a000
|
| SizeOfHeaders |
0x200
|
| Checksum |
0x7c9ee
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve |
0x100000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
|
| VirtualSize |
0x72494
|
| VirtualAddress |
0x2000
|
| SizeOfRawData |
0x72600
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy |
0
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
|
| VirtualSize |
0x48c
|
| VirtualAddress |
0x76000
|
| SizeOfRawData |
0x600
|
| PointerToRawData |
0x72800
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy |
0
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
|
| VirtualSize |
0xc
|
| VirtualAddress |
0x78000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x72e00
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy |
0
|
[!] Error: Could not read the IMAGE_IMPORT_DESCRIPTOR.
[!] Error: Could not read an IMAGE_RESOURCE_DIRECTORY.
[!] Error: Could not read an IMAGE_BASE_RELOCATION!
[*] Warning: Section .text is larger than the executable!
[*] Warning: Section .text is larger than the executable!
[*] Warning: Section .rsrc is larger than the executable!
[*] Warning: Section .rsrc is larger than the executable!
[*] Warning: Section .reloc is larger than the executable!
[*] Warning: Section .reloc is larger than the executable!
[*] Warning: Section .text is larger than the executable!
[*] Warning: Section .rsrc is larger than the executable!
[*] Warning: Section .reloc is larger than the executable!