| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Apr-30 15:18:59 |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
injector.pdb
|
| FileVersion | 0.0.0.1 |
| ProductVersion | 1.0.0.0 |
| OriginalFilename | xproc64.exe |
| InternalName | xproc64.exe |
| FileDescription | xproc64.exe |
| CompanyName | |
| LegalCopyright | bhackariCTF{y3s_5ys7em32_1s_7h3_p3rf3c7_h1d1ng_sp07} |
| ProductName |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA256 Uses constants related to SHA512 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 3/71 (Scanned on 2026-05-30 13:33:33) |
Bkav:
W32.Malware.9BB7F012
CrowdStrike: win/malicious_confidence_60% (D) Malwarebytes: Malware.Heuristic.2518 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Apr-30 15:18:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x106400 |
| SizeOfInitializedData | 0xa5e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000010120C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1b1000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x1ad1c8 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetProcessIoCounters
GetProcessTimes RtlVirtualUnwind FormatMessageW RtlLookupFunctionEntry Process32FirstW ReadProcessMemory CreateToolhelp32Snapshot VirtualQueryEx RtlCaptureContext LocalFree GlobalMemoryStatusEx Sleep SetWaitableTimer GetSystemTimes CreateWaitableTimerExW GetFullPathNameW FindClose FindFirstFileExW GetFileInformationByHandleEx QueryPerformanceFrequency GetFileInformationByHandle CreateFileW SetHandleInformation GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetProcAddress TerminateProcess GetSystemInfo Process32NextW QueryPerformanceCounter CreateMutexA GetCurrentThreadId GetSystemTimePreciseAsFileTime HeapAlloc GetCurrentProcessId HeapReAlloc GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler VirtualFreeEx CloseHandle WaitForSingleObject CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess ReleaseMutex IsProcessorFeaturePresent GetLastError SetLastError WaitForSingleObjectEx GetCurrentProcess HeapFree K32GetPerformanceInfo GetProcessHeap |
|---|---|
| advapi32.dll |
SystemFunction036
GetTokenInformation CopySid GetLengthSid IsValidSid OpenProcessToken |
| ws2_32.dll |
closesocket
getaddrinfo freeaddrinfo send WSARecv recv WSADuplicateSocketW setsockopt getsockopt WSASocketW WSACleanup WSAStartup select connect ioctlsocket WSAGetLastError getsockname WSASend getpeername |
| api-ms-win-core-synch-l1-2-0.dll |
WakeByAddressAll
WaitOnAddress WakeByAddressSingle |
| ntdll.dll |
RtlNtStatusToDosError
RtlGetVersion NtQueryInformationProcess NtWriteFile NtReadFile |
| pdh.dll |
PdhCollectQueryData
PdhCloseQuery PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhEnumObjectsA PdhOpenQueryA |
| psapi.dll |
GetProcessMemoryInfo
GetModuleFileNameExW |
| shell32.dll |
CommandLineToArgvW
|
| oleaut32.dll |
GetErrorInfo
|
| powrprof.dll |
CallNtPowerInformation
|
| bcryptprimitives.dll |
ProcessPrng
|
| bcrypt.dll |
BCryptGenRandom
|
| KERNEL32.dll |
GetEnvironmentVariableW
GetModuleHandleA GetCurrentDirectoryW LoadLibraryA lstrlenW WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP ReadConsoleW GetModuleHandleW GetModuleFileNameW WriteConsoleW MultiByteToWideChar |
| VCRUNTIME140.dll |
__CxxFrameHandler3
memcpy memset memcmp memmove _CxxThrowException __C_specific_handler __current_exception __current_exception_context |
| api-ms-win-crt-string-l1-1-0.dll |
wcslen
|
| api-ms-win-crt-runtime-l1-1-0.dll |
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback _configure_narrow_argv _seh_filter_exe _cexit _set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _c_exit terminate _crt_atexit _register_onexit_function _initialize_onexit_table |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__p__commode
_set_fmode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
free |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.1 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| FileVersion (#2) | 0.0.0.1 |
| ProductVersion (#2) | 1.0.0.0 |
| OriginalFilename | xproc64.exe |
| InternalName | xproc64.exe |
| FileDescription | xproc64.exe |
| CompanyName | |
| LegalCopyright | bhackariCTF{y3s_5ys7em32_1s_7h3_p3rf3c7_h1d1ng_sp07} |
| ProductName |
| Resource LangID | UNKNOWN |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-30 15:18:59 |
| Version | 0.0 |
| SizeofData | 37 |
| AddressOfRawData | 0x1853bc |
| PointerToRawData | 0x183bbc |
| Referenced File | injector.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-30 15:18:59 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x1853e4 |
| PointerToRawData | 0x183be4 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-30 15:18:59 |
| Version | 0.0 |
| SizeofData | 816 |
| AddressOfRawData | 0x1853f8 |
| PointerToRawData | 0x183bf8 |
| StartAddressOfRawData | 0x140185748 |
|---|---|
| EndAddressOfRawData | 0x1401857a8 |
| AddressOfIndex | 0x1401a32a0 |
| AddressOfCallbacks | 0x1401085d8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001400993A0
|
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1401a3148 |
| XOR Key | 0xf8720770 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 12 |
| Imports (30034) | 2 |
| C++ objects (30034) | 23 |
| C objects (30034) | 10 |
| ASM objects (30034) | 4 |
| Imports (27412) | 5 |
| Total imports | 159 |
| C objects (30152) | 12 |
| Unmarked objects (#2) | 46 |
| Linker (30152) | 1 |
No comments yet.