| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Apr-18 20:15:13 |
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | The PE contains common functions which appear in legitimate applications. |
Possibly launches other programs:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 4 |
| TimeDateStamp | 2026-Apr-18 20:15:13 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x62000 |
| SizeOfInitializedData | 0x5400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000006055C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x69000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| USER32.dll |
GetSystemMetrics
ShowWindow SetTimer TrackMouseEvent EndPaint SetWindowTextA GetMonitorInfoA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes PostMessageA SendMessageA SetCursor SystemParametersInfoA GetClientRect PostQuitMessage RegisterClassExA UpdateWindow ReleaseCapture InvalidateRect ReleaseDC BeginPaint ScreenToClient MonitorFromWindow SetWindowPos GetWindowRect LoadCursorA DispatchMessageA GetMessageA TranslateMessage AdjustWindowRectEx |
|---|---|
| GDI32.dll |
SelectObject
DeleteDC GetDeviceCaps CreateCompatibleBitmap DeleteObject |
| gdiplus.dll |
GdipAlloc
GdipDeletePath GdipCreateFontFamilyFromName GdipAddPathArcI GdipSetSmoothingMode GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipSetStringFormatTrimming GdipFillPath GdipGraphicsClear GdipSetSolidFillColor GdipDrawRectangleI GdipClosePathFigure GdipCloneBrush GdipFree GdipDrawPath GdipDrawString GdipCreateFromHDC GdipSetTextRenderingHint GdipGetSolidFillColor GdipSetStringFormatFlags GdipSetStringFormatAlign GdipCreatePen1 GdipDeleteFontFamily GdiplusShutdown GdipDeletePen GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdiplusStartup GdipGetStringFormatFlags GdipDeleteBrush GdipCreateStringFormat |
| MSVCP140.dll |
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z |
| SHELL32.dll |
DragFinish
DragQueryFileA DragAcceptFiles |
| KERNEL32.dll |
CreateThread
CreateProcessA GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetTickCount64 IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess CloseHandle MultiByteToWideChar QueryPerformanceCounter OutputDebugStringA GetModuleFileNameA GetStartupInfoW |
| VCRUNTIME140.dll |
__std_exception_destroy
memmove memcpy __std_exception_copy memset memcmp __C_specific_handler _CxxThrowException __current_exception __current_exception_context |
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| api-ms-win-crt-stdio-l1-1-0.dll |
fseek
_set_fmode fread __stdio_common_vsprintf ftell __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vfprintf fwrite __acrt_iob_func fopen __p__commode fclose |
| api-ms-win-crt-math-l1-1-0.dll |
tan
pow ceilf trunc log sqrt fmod fabs nan floor cos ceil _dtest sin __setusermatherr round |
| api-ms-win-crt-runtime-l1-1-0.dll |
_cexit
_crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _seh_filter_exe _errno _get_narrow_winmain_command_line abort _initterm _initterm_e exit _exit _configure_narrow_argv terminate _register_thread_local_exe_atexit_callback _invoke_watson _c_exit _set_app_type |
| api-ms-win-crt-convert-l1-1-0.dll |
strtoul
strtol strtod strtof |
| api-ms-win-crt-string-l1-1-0.dll |
isxdigit
toupper strcmp isalpha isdigit tolower wcslen isspace isalnum |
| api-ms-win-crt-utility-l1-1-0.dll |
rand
|
| api-ms-win-crt-heap-l1-1-0.dll |
free
malloc _set_new_mode _callnewh |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-18 20:15:13 |
| Version | 0.0 |
| SizeofData | 740 |
| AddressOfRawData | 0xdce8 |
| PointerToRawData | 0xd0e8 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140063040 |
| XOR Key | 0xe34d95ec |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| ASM objects (35207) | 4 |
| C objects (35207) | 10 |
| C++ objects (35207) | 28 |
| Imports (35207) | 6 |
| Imports (33145) | 11 |
| Total imports | 186 |
| C++ objects (LTCG) (35225) | 1 |
| Linker (35225) | 1 |
No comments yet.