Manalyze report for 49ec3f075b94dfbea8cc3f2e4f0f84d44d188ede3c523627a52044e43b9dcb15

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-16 21:49:00
Detected languages	English - United States

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: example.com https://curl.se`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to SHA256` `Uses constants related to SHA512` `Uses constants related to AES` `Uses constants related to RC5 or RC6` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot CheckRemoteDebuggerPresent NtQueryInformationProcess NtQuerySystemInformation` `Code injection capabilities: WriteProcessMemory OpenProcess VirtualAllocEx CreateRemoteThread` `Code injection capabilities (mapping injection): CreateFileMappingW MapViewOfFile CreateRemoteThread` `Can access the registry: RegQueryValueExW RegCloseKey RegOpenKeyExW` `Uses Windows's Native API: NtSetInformationThread NtQueryInformationProcess NtQuerySystemInformation ntohs` `Uses Microsoft's cryptographic API: CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptQueryObject CryptDecodeObjectEx CryptStringToBinaryW` `Memory manipulation functions often used by packers: VirtualProtectEx VirtualAllocEx VirtualProtect` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: WriteProcessMemory OpenProcess Process32NextW Process32FirstW ReadProcessMemory` `Interacts with the certificate store: CertAddCertificateContextToStore CertOpenStore`
Malicious	VirusTotal score: 8/69 (Scanned on 2026-10-19 03:39:09)	`APEX: Malicious` `Bkav: W32.Malware.53B32AA8` `CrowdStrike: win/malicious_confidence_90% (W)` `Elastic: malicious (high confidence)` `McAfeeD: ti!49EC3F075B94` `SentinelOne: Static AI - Suspicious PE` `Symantec: ML.Attribute.HighConfidence` `Trapmine: suspicious.low.ml.score`

Hashes

MD5	`c059bcf5e86f45bb0d36159b51c4baa5` 🔍
SHA1	`8a1f9957ebbdac518cfdd77690c0e5daaaf2daac` 🔍
SHA256	`49ec3f075b94dfbea8cc3f2e4f0f84d44d188ede3c523627a52044e43b9dcb15` 🔍
SHA3	`1816a578fb2e20f11170e8a1949f553afdabc87b7dcbce6e801d60262d78370e` 🔍
SSDeep	`24576:AcxAgcANCN1UGk6sUMJkI/5dnaOsZJGmiZpWwxnxLAmcQ+owXGUWFarbVZpBnoa:AcmFAswZLsZJG3ZpWwxnxLAmch9noM7` 🔍
Imports Hash	`8e92be105fcfdef5ced1da3fdbc963c2` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Oct-16 21:49:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x110600`
SizeOfInitializedData	`0x58600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000DD510 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x16e000`
SizeOfHeaders	`0x400`
Checksum	`0x174345`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`cd8f4131120794474d0ec1e3074ec142 🔍`
SHA1	`26f82bfdc7a666db82c1f6658f4809aea469733d 🔍`
SHA256	`ca7accc384208eda963a2028f2df7568d8c6d3bb078e840dd2f0c1c735760e7c 🔍`
SHA3	`4d7312e2977b69fee77d139e1f500576fe8a3c8ac82cf29a0d76540bf12d4df5 🔍`
VirtualSize	`0x11059c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x110600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.52071`

.rdata

MD5	`f10a03ddffb7bf459b26cba4d4692666 🔍`
SHA1	`fd9d576bf88585d8e2052e12560512ad1131e943 🔍`
SHA256	`7ff1db478fd07a3c5e8ed839df8b554174864e8abf2f6d55875c91bac5fb64ed 🔍`
SHA3	`3768fa5498195210752ad9dd41c2fa7e33f060fab50ae4cba537788cb4aa4303 🔍`
VirtualSize	`0x460fa`
VirtualAddress	`0x112000`
SizeOfRawData	`0x46200`
PointerToRawData	`0x110a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.15433`

.data

MD5	`76be357c70e998e18d5ff6008d2dd746 🔍`
SHA1	`e3b4309a381243bc215482068758b9803fb3cb68 🔍`
SHA256	`66c9b532c2337da9f64afa61ccda7fbb117b1ac1e53bafaedda0fca62de9c2cb 🔍`
SHA3	`ec3af42cb7cbe9f2c8175bf603c06112d5b41354f7a199b1dddd4869697f8745 🔍`
VirtualSize	`0x3ba4`
VirtualAddress	`0x159000`
SizeOfRawData	`0x2600`
PointerToRawData	`0x156c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.26026`

.pdata

MD5	`bb20dda3b41d5940ee8d389a8442e0c5 🔍`
SHA1	`e384cb50c4b2126d4b1fd324eea9ea9f83987360 🔍`
SHA256	`b8abc72c8089c56ac6d923346ec9c40346cf608e78ac1b3c2606386389871741 🔍`
SHA3	`f0dc7ebca33f506bd80f3e4cb7d4966566e6a216b3b715c371cdaf185ffdeba7 🔍`
VirtualSize	`0xcda4`
VirtualAddress	`0x15d000`
SizeOfRawData	`0xce00`
PointerToRawData	`0x159200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.09575`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x16a000`
SizeOfRawData	`0x200`
PointerToRawData	`0x166000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`551f8bdaacf4bf8c5b0bb6b7690f84ff 🔍`
SHA1	`4c8ddfa93c2e0a2824cd88de2ff42bf4d6c85829 🔍`
SHA256	`9ceeefece68460152cc073a8cc9b3738c8593dca42158357a1641fd33cdf5855 🔍`
SHA3	`5bf63354a32d4de587d9c0de5789c4f7a1ea7a5f47d78b421daa6f5123b3d750 🔍`
VirtualSize	`0x2b0`
VirtualAddress	`0x16b000`
SizeOfRawData	`0x400`
PointerToRawData	`0x166200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.02475`

.reloc

MD5	`dea8b518dcf776fa4691e9db46c9e863 🔍`
SHA1	`9cfc1dcbee50226a72dfcb3abd3c424415553f25 🔍`
SHA256	`10b5a9816c8a4c558503e35f9f7e92a7177bdce66ee7fe1d37fab2ff612e1464 🔍`
SHA3	`ec9080deeeab97f25b79daafdcac91a4cb56b0ed59b077f4f0fe2d977ecf3a0e 🔍`
VirtualSize	`0x13d4`
VirtualAddress	`0x16c000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x166600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.416`

Imports

ole32.dll	`CoInitializeEx` `CoInitializeSecurity` `CoSetProxyBlanket` `CoCreateInstance` `CoUninitialize`
OLEAUT32.dll	`SysAllocString` `SysFreeString` `VariantInit` `VariantClear`
IPHLPAPI.DLL	`if_nametoindex` `GetAdaptersAddresses`
bcrypt.dll	`BCryptDestroyKey` `BCryptCreateHash` `BCryptHashData` `BCryptDestroyHash` `BCryptFinishHash` `BCryptGenRandom` `BCryptGetProperty` `BCryptGenerateSymmetricKey` `BCryptSetProperty` `BCryptCloseAlgorithmProvider` `BCryptOpenAlgorithmProvider` `BCryptDecrypt`
KERNEL32.dll	`SetConsoleMode` `FlushFileBuffers` `ExitProcess` `CreateFileMappingW` `MapViewOfFile` `WriteProcessMemory` `WaitForSingleObject` `OpenProcess` `CreateToolhelp32Snapshot` `Process32NextW` `Process32FirstW` `CloseHandle` `VirtualProtectEx` `GetProcAddress` `VirtualAllocEx` `ReadProcessMemory` `GetModuleHandleW` `FlushInstructionCache` `CreateRemoteThread` `VirtualFreeEx` `IsWow64Process` `DeviceIoControl` `CreateFileW` `WideCharToMultiByte` `GetFileSizeEx` `GetModuleFileNameW` `UnmapViewOfFile` `GetModuleHandleA` `VirtualProtect` `GetCurrentProcess` `GetCurrentThreadId` `Sleep` `GetCurrentThread` `QueryPerformanceFrequency` `GetThreadContext` `GetCurrentProcessId` `QueryPerformanceCounter` `OpenThread` `CheckRemoteDebuggerPresent` `EnumSystemLocalesW` `GetUserDefaultLCID` `IsValidLocale` `GetLocaleInfoW` `ReadConsoleInputW` `GetCurrentDirectoryW` `SetStdHandle` `DeleteFileW` `SetEndOfFile` `CompareStringW` `GetTimeFormatW` `GetDateFormatW` `LoadLibraryExW` `HeapFree` `HeapAlloc` `UnhandledExceptionFilter` `IsDebuggerPresent` `RtlVirtualUnwind` `RtlCaptureContext` `GetCommandLineW` `GetCommandLineA` `IsProcessorFeaturePresent` `SetFilePointerEx` `GetConsoleOutputCP` `WriteFile` `ReadConsoleW` `GetConsoleMode` `FileTimeToSystemTime` `SystemTimeToTzSpecificLocalTime` `GetFileInformationByHandle` `GetDriveTypeW` `GetConsoleCP` `GetModuleHandleExW` `FreeLibrary` `FlsFree` `FlsSetValue` `FlsGetValue` `FlsAlloc` `RaiseException` `RtlPcToFileHeader` `RtlUnwindEx` `RtlLookupFunctionEntry` `InitializeSListHead` `GetSystemTimeAsFileTime` `GetStartupInfoW` `SetUnhandledExceptionFilter` `GetCPInfo` `IsValidCodePage` `GetACP` `GetOEMCP` `GetTimeZoneInformation` `RtlUnwind` `FindFirstFileExW` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetEnvironmentVariableW` `GetProcessHeap` `LCMapStringW` `HeapReAlloc` `WriteConsoleW` `HeapSize` `TerminateProcess` `GetStringTypeW` `WakeAllConditionVariable` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `GetLastError` `SetLastError` `FormatMessageA` `SleepEx` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `FindFirstFileW` `GetFullPathNameW` `MoveFileExW` `MultiByteToWideChar` `GetEnvironmentVariableA` `InitializeConditionVariable` `VerifyVersionInfoW` `FindClose` `FindNextFileW` `GetStdHandle` `GetFileType` `ReadFile` `PeekNamedPipe` `WaitForMultipleObjects` `WakeConditionVariable` `SleepConditionVariableCS` `WaitForSingleObjectEx` `CreateThread` `LocalFree` `InitializeCriticalSection` `GetSystemInfo` `GetSystemTimePreciseAsFileTime` `SleepConditionVariableSRW` `InitOnceComplete` `InitOnceBeginInitialize` `EncodePointer` `DecodePointer` `LCMapStringEx`
USER32.dll	`EnumWindows` `GetWindowTextW` `GetClassNameW`
ADVAPI32.dll	`RegQueryValueExW` `SystemFunction036` `CryptDestroyHash` `CryptHashData` `CryptCreateHash` `CryptGetHashParam` `CryptReleaseContext` `CryptAcquireContextW` `RegCloseKey` `RegOpenKeyExW`
ntdll.dll	`NtSetInformationThread` `NtQueryInformationProcess` `NtQuerySystemInformation` `VerSetConditionMask`
WS2_32.dll	`setsockopt` `recv` `ntohs` `htons` `getsockname` `getpeername` `connect` `closesocket` `bind` `accept` `WSAStartup` `WSAGetLastError` `WSASetLastError` `WSAResetEvent` `WSAEventSelect` `WSAEnumNetworkEvents` `WSACreateEvent` `WSACloseEvent` `send` `getsockopt` `socket` `listen` `WSAIoctl` `__WSAFDIsSet` `gethostname` `htonl` `ioctlsocket` `sendto` `recvfrom` `select` `getaddrinfo` `freeaddrinfo` `WSAWaitForMultipleEvents`
CRYPT32.dll	`CertCreateCertificateChainEngine` `CryptQueryObject` `CertGetCertificateChain` `CertFindExtension` `CertAddCertificateContextToStore` `CryptDecodeObjectEx` `PFXImportCertStore` `CertFreeCertificateContext` `CertFindCertificateInStore` `CertEnumCertificatesInStore` `CertCloseStore` `CertOpenStore` `CertFreeCertificateChainEngine` `CertFreeCertificateChain` `CertGetNameStringW` `CryptStringToBinaryW`
Secur32.dll	`InitSecurityInterfaceW`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x249`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.06044`
MD5	`f7e7c81035fc42015d50fadd75b9300f 🔍`
SHA1	`df759518191bad6608c336186b31c120b3dadb34 🔍`
SHA256	`72ae19a66b5d012088d762d3e2de6498a9b3b8fc153352ca6c76cf045d1fe96e 🔍`
SHA3	`1038ef4fa889f000231ecd6b7f2eb0759548ed2a8e5da6ca3e19b38062e60dbd 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Oct-16 21:49:00
Version	`0.0`
SizeofData	`1052`
AddressOfRawData	`0x144ea8`
PointerToRawData	`0x1438a8`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Oct-16 21:49:00
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x140145310`
EndAddressOfRawData	`0x140145318`
AddressOfIndex	`0x14015beb8`
AddressOfCallbacks	`0x140112878`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140159ec0`

RICH Header

XOR Key	`0x4722614a`
Unmarked objects	`0`
C++ objects (33145)	`195`
ASM objects (33145)	`10`
C objects (35721)	`18`
ASM objects (35721)	`12`
C++ objects (35721)	`93`
C objects (36260)	`200`
C objects (33145)	`19`
Imports (33145)	`25`
Total imports	`284`
C++ objects (LTCG) (36260)	`17`
Resource objects (36260)	`1`
Linker (36260)	`1`

Errors

Leave a comment

No comments yet.