| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Nov-13 04:09:46 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
Vampi.pdb
|
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to security software:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA256 Uses known Mersenne Twister constants |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| MD5 | 9eafd62ae9e2e22808fc47a2229a3790 🔍 |
|---|---|
| SHA1 | e8e3a096c478566c60d9cdb4427f296e6adfa44f 🔍 |
| SHA256 | 517edc06a934aa03e0353dcd5c3715b599214f15ebe22de9054c7a706cf2dbac 🔍 |
| SHA3 | b90a1afba575ec9984ecb5ae6760449ec2018f61c81f184e5db7ba8effad0c72 🔍 |
| SSDeep | 393216:PbYobEkohIDmonw6KySJHGBoOK8HZ/H+PQsMQMX8kT+oTb:D+fIDf3SJHuePQ68 🔍 |
| Imports Hash | dc00359fbdfd1a4d2d56b009c07f6c9f 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Nov-13 04:09:46 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x26ea00 |
| SizeOfInitializedData | 0xc4c400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000001F55F0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xec1000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 6b6453e9d3b0af119a2c6966c6dc1659 🔍 |
|---|---|
| SHA1 | 3e1962efdce76d8e3c248b5b71fc950dde1d0969 🔍 |
| SHA256 | 5c0bbc6e76a35568da529a0a9ebf9ae25f525707a475afb47b3d9d7cef3ba496 🔍 |
| SHA3 | 2188c6b93ff9513c797de06135c9b84c5ee43c6478cc14c305b069f1243406e1 🔍 |
| VirtualSize | 0x26e88c |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x26ea00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.56088 |
| MD5 | 3d529d91163503e66fe3603825cf9de6 🔍 |
|---|---|
| SHA1 | 362424feb83a9c8640321e556efa363ddfc28e49 🔍 |
| SHA256 | 8c12845c799831b8ebc94459b0f2ee2ff36e34fbb0ae84220664a1f2846ddeb6 🔍 |
| SHA3 | 42d09ec723025e6bf7ff269b87f063569a8bf589c8555c2f0dcefdb9b62b5597 🔍 |
| VirtualSize | 0xc1726c |
| VirtualAddress | 0x270000 |
| SizeOfRawData | 0xc17400 |
| PointerToRawData | 0x26ee00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.67078 |
| MD5 | 012145db2ffc7fcb885d9a161e40a6c9 🔍 |
|---|---|
| SHA1 | 255ca5076a603a7ba3bb690cfd896a8e5417debf 🔍 |
| SHA256 | da0ce2a4e0656cf602bc040dc28f545496518c8eca4f2d060ddc82d4494a18f8 🔍 |
| SHA3 | 9c250000b20edf3d4b95572403ac27cae8dd7b99611513d3009390b79a663b39 🔍 |
| VirtualSize | 0x7274 |
| VirtualAddress | 0xe88000 |
| SizeOfRawData | 0x4800 |
| PointerToRawData | 0xe86200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 3.99042 |
| MD5 | 1fefe9b1682f400f1fc952f34ec8f6cd 🔍 |
|---|---|
| SHA1 | 6d706a75ce3750573b5e09d6545b22c23a25125f 🔍 |
| SHA256 | c89c1ef44582ecd6f7693e5d4de01bf7ef9e6aae35b7d8f715635a11dbc9a085 🔍 |
| SHA3 | 5df733ec332e360f64d394c4a23902d22cf41a3e2140ee1bf5aeaac9bde0156e 🔍 |
| VirtualSize | 0x29700 |
| VirtualAddress | 0xe90000 |
| SizeOfRawData | 0x29800 |
| PointerToRawData | 0xe8aa00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.89882 |
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x100 |
| VirtualAddress | 0xeba000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xeb4200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
| MD5 | a40195987236fe85a29643934a2b6e66 🔍 |
|---|---|
| SHA1 | 21443eb394dce4347bf75252569d548f83580a73 🔍 |
| SHA256 | 01684f5e191844c307a49bdba7555f08f9862c9085f8d7d090b96e19542df3b1 🔍 |
| SHA3 | e0b0042020a0cbf47f16c42cd00f2b1641a42057d69ebf3e5e74a959aad3152e 🔍 |
| VirtualSize | 0x2208 |
| VirtualAddress | 0xebb000 |
| SizeOfRawData | 0x2400 |
| PointerToRawData | 0xeb4400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.04224 |
| MD5 | cd3669a43b166bae2671dc64d8e84c24 🔍 |
|---|---|
| SHA1 | f56c87ca2efc18c5376c07d7f8f9ded22f0e4795 🔍 |
| SHA256 | 7615a1c40b40c55cbf9c802cbbdbcc7c4ef2783737698663959835f619d800be 🔍 |
| SHA3 | fdf75159b60b8f5f4d600a7999e7b4b1e360204e5402ed851e6ea073306ac45e 🔍 |
| VirtualSize | 0x1e0 |
| VirtualAddress | 0xebe000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0xeb6800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.71768 |
| MD5 | 3cd8134c305282349dd24bd1b9d5b75f 🔍 |
|---|---|
| SHA1 | 530fbc1618c16ff4108751ab2330767ff23b02c0 🔍 |
| SHA256 | f3ba21caa24420a51ed342307572b00bed6b4608996e14c673550a1077e06cbb 🔍 |
| SHA3 | 661ad2de6acd55bef822109f22d6dfafe41d49803aa9fb46d480060d424332c1 🔍 |
| VirtualSize | 0x1b74 |
| VirtualAddress | 0xebf000 |
| SizeOfRawData | 0x1c00 |
| PointerToRawData | 0xeb6a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.43245 |
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
|---|---|
| D3DCOMPILER_43.dll |
D3DCompile
|
| WINHTTP.dll |
WinHttpReceiveResponse
WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpWriteData WinHttpOpen |
| KERNEL32.dll |
VirtualFreeEx
CreateToolhelp32Snapshot Process32NextW Process32FirstW K32GetModuleBaseNameA K32GetModuleInformation Module32FirstW ReadProcessMemory Module32NextW K32EnumProcessModules ReadFile GetVolumeInformationW GetFileSizeEx FindFirstFileA FindNextFileA GetEnvironmentVariableA FindClose GetSystemDirectoryW CreateFileA GetLocalTime GetComputerNameW GetSystemTime K32EnumProcessModulesEx GetLastError K32GetModuleBaseNameW GetCurrentProcessId VirtualQueryEx GetExitCodeProcess GetStartupInfoW GetCommandLineW GetCurrentProcess ExitProcess GetModuleFileNameA VirtualFree WriteFile VirtualAlloc TerminateProcess SetFileTime UnmapViewOfFile Sleep GetTempPathA MoveFileExA FlushViewOfFile DeleteFileA SetFileAttributesA CreateFileMappingA RemoveDirectoryA GetProcessHeap CreateDirectoryA MapViewOfFile GetFileTime EnterCriticalSection GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection OpenEventW OpenFileMappingW SetEvent OutputDebugStringA GetProcessId GetExitCodeThread LoadLibraryW CreateRemoteThread CreateFileMappingW OpenMutexW GetTickCount HeapAlloc HeapReAlloc HeapFree ExitThread CreateThread VirtualAllocEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx GetStringTypeW WaitForSingleObjectEx SleepConditionVariableSRW GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx FreeLibraryAndExitThread CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetModuleHandleExW EnumSystemLocalesW VirtualProtectEx OpenProcess WriteProcessMemory CreateWaitableTimerExW GetModuleHandleW CloseHandle WaitForSingleObject SetWaitableTimer SetUnhandledExceptionFilter GlobalUnlock GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA WideCharToMultiByte GetTickCount64 ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle IsProcessorFeaturePresent GetStdHandle RtlCaptureContext RtlVirtualUnwind GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP CreateFileW HeapSize WriteConsoleW RtlUnwind SetEndOfFile FlushFileBuffers GetFileType SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent |
| USER32.dll |
SetWindowLongPtrW
RegisterClassExW ShowWindow IsWindow MapWindowPoints MoveWindow SetFocus UpdateWindow SetForegroundWindow GetWindowThreadProcessId GetWindowTextLengthW EnumWindows GetClassNameW GetWindowTextW MessageBoxA mouse_event DefWindowProcW GetWindowRect DestroyWindow IsWindowVisible SetWindowPos CreateWindowExW DispatchMessageW PeekMessageW RegisterClassW SetWindowDisplayAffinity MapVirtualKeyA SetLayeredWindowAttributes TranslateMessage SetActiveWindow EnumDisplaySettingsW IsIconic GetSystemMetrics SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos EnumDisplayMonitors GetActiveWindow GetMonitorInfoW GetAsyncKeyState GetWindowDisplayAffinity GetKeyNameTextA |
| GDI32.dll |
GetStockObject
DeleteObject DeleteDC BitBlt SelectObject CreateDIBSection CreateCompatibleDC |
| COMDLG32.dll |
GetOpenFileNameW
|
| ADVAPI32.dll |
OpenProcessToken
RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameW RegDeleteTreeA ControlTraceA RegDeleteTreeW RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteValueA QueryAllTracesA RegEnumKeyExA LookupPrivilegeValueW AdjustTokenPrivileges |
| SHELL32.dll |
ShellExecuteA
SHGetKnownFolderPath SHGetFolderPathA |
| ole32.dll |
CoUninitialize
CoInitializeEx CoTaskMemFree CoCreateInstance |
| d3dx11_43.dll |
D3DX11CreateShaderResourceViewFromMemory
|
| dwmapi.dll |
DwmExtendFrameIntoClientArea
|
| IMM32.dll |
ImmSetCompositionWindow
ImmReleaseContext ImmGetContext ImmSetCandidateWindow |
| bcrypt.dll |
BCryptCloseAlgorithmProvider
BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider |
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Nov-13 04:09:46 |
| Version | 0.0 |
| SizeofData | 34 |
| AddressOfRawData | 0xe4f520 |
| PointerToRawData | 0xe4e320 |
| Referenced File | Vampi.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Nov-13 04:09:46 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0xe4f544 |
| PointerToRawData | 0xe4e344 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Nov-13 04:09:46 |
| Version | 0.0 |
| SizeofData | 1216 |
| AddressOfRawData | 0xe4f558 |
| PointerToRawData | 0xe4e358 |
| StartAddressOfRawData | 0x140e4fa60 |
|---|---|
| EndAddressOfRawData | 0x140e4fc20 |
| AddressOfIndex | 0x140e8ceb8 |
| AddressOfCallbacks | 0x140270bd8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_16BYTES
|
| Callbacks |
0x00000001401F5170
0x00000001401F5250 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140e88140 |
| GuardCFCheckFunctionPointer | 5371267472 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0xb2f1ad82 |
|---|---|
| Unmarked objects | 0 |
| C objects (33145) | 32 |
| ASM objects (33145) | 29 |
| 253 (35721) | 1 |
| ASM objects (35721) | 17 |
| C objects (35721) | 19 |
| C++ objects (35721) | 102 |
| C objects (CVTCIL) (33145) | 1 |
| C objects (VS2022 Update 1 (17.1.6) compiler 31107) | 26 |
| C++ objects (33145) | 184 |
| Imports (33145) | 24 |
| Imports (21202) | 7 |
| Total imports | 345 |
| C++ objects (LTCG) (36260) | 63 |
| Resource objects (36260) | 1 |
| Linker (36260) | 1 |
No comments yet.