517edc06a934aa03e0353dcd5c3715b599214f15ebe22de9054c7a706cf2dbac

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Nov-13 04:09:46
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.
Debug artifacts Vampi.pdb

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to security software:
  • MsMpEng.exe
May have dropper capabilities:
  • CurrentControlSet\Services
Contains another PE executable:
  • This program cannot be run in DOS mode.
Miscellaneous malware strings:
  • exploit
Contains domain names:
  • cloudflare.com
  • discord.com
  • github.com
  • https://discord.com
  • https://github.com
  • https://vampi-auth.ourgaxo.workers.dev
  • www.cloudflare.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA256
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
Code injection capabilities:
  • VirtualAlloc
  • CreateRemoteThread
  • VirtualAllocEx
  • OpenProcess
  • WriteProcessMemory
Code injection capabilities (mapping injection):
  • CreateFileMappingA
  • MapViewOfFile
  • CreateRemoteThread
  • CreateFileMappingW
Can access the registry:
  • RegQueryValueExW
  • RegOpenKeyExW
  • RegCloseKey
  • RegSetValueExA
  • RegOpenKeyExA
  • RegEnumValueA
  • RegDeleteValueA
  • RegEnumKeyExA
Possibly launches other programs:
  • ShellExecuteA
Can create temporary files:
  • CreateFileA
  • GetTempPathA
  • CreateFileW
Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • GetAsyncKeyState
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualAllocEx
  • VirtualProtectEx
  • VirtualProtect
Has Internet access capabilities:
  • WinHttpReceiveResponse
  • WinHttpQueryHeaders
  • WinHttpReadData
  • WinHttpOpenRequest
  • WinHttpSetOption
  • WinHttpCloseHandle
  • WinHttpQueryDataAvailable
  • WinHttpCrackUrl
  • WinHttpConnect
  • WinHttpSetTimeouts
  • WinHttpSendRequest
  • WinHttpWriteData
  • WinHttpOpen
Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
Enumerates local disk drives:
  • GetVolumeInformationW
Manipulates other processes:
  • Process32NextW
  • Process32FirstW
  • ReadProcessMemory
  • OpenProcess
  • WriteProcessMemory
Can take screenshots:
  • GetDC
  • BitBlt
  • CreateCompatibleDC
Reads the contents of the clipboard:
  • GetClipboardData
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 9eafd62ae9e2e22808fc47a2229a3790 🔍
SHA1 e8e3a096c478566c60d9cdb4427f296e6adfa44f 🔍
SHA256 517edc06a934aa03e0353dcd5c3715b599214f15ebe22de9054c7a706cf2dbac 🔍
SHA3 b90a1afba575ec9984ecb5ae6760449ec2018f61c81f184e5db7ba8effad0c72 🔍
SSDeep 393216:PbYobEkohIDmonw6KySJHGBoOK8HZ/H+PQsMQMX8kT+oTb:D+fIDf3SJHuePQ68 🔍
Imports Hash dc00359fbdfd1a4d2d56b009c07f6c9f 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2026-Nov-13 04:09:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x26ea00
SizeOfInitializedData 0xc4c400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000001F55F0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xec1000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6b6453e9d3b0af119a2c6966c6dc1659 🔍
SHA1 3e1962efdce76d8e3c248b5b71fc950dde1d0969 🔍
SHA256 5c0bbc6e76a35568da529a0a9ebf9ae25f525707a475afb47b3d9d7cef3ba496 🔍
SHA3 2188c6b93ff9513c797de06135c9b84c5ee43c6478cc14c305b069f1243406e1 🔍
VirtualSize 0x26e88c
VirtualAddress 0x1000
SizeOfRawData 0x26ea00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.56088

.rdata

MD5 3d529d91163503e66fe3603825cf9de6 🔍
SHA1 362424feb83a9c8640321e556efa363ddfc28e49 🔍
SHA256 8c12845c799831b8ebc94459b0f2ee2ff36e34fbb0ae84220664a1f2846ddeb6 🔍
SHA3 42d09ec723025e6bf7ff269b87f063569a8bf589c8555c2f0dcefdb9b62b5597 🔍
VirtualSize 0xc1726c
VirtualAddress 0x270000
SizeOfRawData 0xc17400
PointerToRawData 0x26ee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.67078

.data

MD5 012145db2ffc7fcb885d9a161e40a6c9 🔍
SHA1 255ca5076a603a7ba3bb690cfd896a8e5417debf 🔍
SHA256 da0ce2a4e0656cf602bc040dc28f545496518c8eca4f2d060ddc82d4494a18f8 🔍
SHA3 9c250000b20edf3d4b95572403ac27cae8dd7b99611513d3009390b79a663b39 🔍
VirtualSize 0x7274
VirtualAddress 0xe88000
SizeOfRawData 0x4800
PointerToRawData 0xe86200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.99042

.pdata

MD5 1fefe9b1682f400f1fc952f34ec8f6cd 🔍
SHA1 6d706a75ce3750573b5e09d6545b22c23a25125f 🔍
SHA256 c89c1ef44582ecd6f7693e5d4de01bf7ef9e6aae35b7d8f715635a11dbc9a085 🔍
SHA3 5df733ec332e360f64d394c4a23902d22cf41a3e2140ee1bf5aeaac9bde0156e 🔍
VirtualSize 0x29700
VirtualAddress 0xe90000
SizeOfRawData 0x29800
PointerToRawData 0xe8aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.89882

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0xeba000
SizeOfRawData 0x200
PointerToRawData 0xeb4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

_RDATA

MD5 a40195987236fe85a29643934a2b6e66 🔍
SHA1 21443eb394dce4347bf75252569d548f83580a73 🔍
SHA256 01684f5e191844c307a49bdba7555f08f9862c9085f8d7d090b96e19542df3b1 🔍
SHA3 e0b0042020a0cbf47f16c42cd00f2b1641a42057d69ebf3e5e74a959aad3152e 🔍
VirtualSize 0x2208
VirtualAddress 0xebb000
SizeOfRawData 0x2400
PointerToRawData 0xeb4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.04224

.rsrc

MD5 cd3669a43b166bae2671dc64d8e84c24 🔍
SHA1 f56c87ca2efc18c5376c07d7f8f9ded22f0e4795 🔍
SHA256 7615a1c40b40c55cbf9c802cbbdbcc7c4ef2783737698663959835f619d800be 🔍
SHA3 fdf75159b60b8f5f4d600a7999e7b4b1e360204e5402ed851e6ea073306ac45e 🔍
VirtualSize 0x1e0
VirtualAddress 0xebe000
SizeOfRawData 0x200
PointerToRawData 0xeb6800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71768

.reloc

MD5 3cd8134c305282349dd24bd1b9d5b75f 🔍
SHA1 530fbc1618c16ff4108751ab2330767ff23b02c0 🔍
SHA256 f3ba21caa24420a51ed342307572b00bed6b4608996e14c673550a1077e06cbb 🔍
SHA3 661ad2de6acd55bef822109f22d6dfafe41d49803aa9fb46d480060d424332c1 🔍
VirtualSize 0x1b74
VirtualAddress 0xebf000
SizeOfRawData 0x1c00
PointerToRawData 0xeb6a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43245

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
D3DCOMPILER_43.dll D3DCompile
WINHTTP.dll WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpWriteData
WinHttpOpen
KERNEL32.dll VirtualFreeEx
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
K32GetModuleBaseNameA
K32GetModuleInformation
Module32FirstW
ReadProcessMemory
Module32NextW
K32EnumProcessModules
ReadFile
GetVolumeInformationW
GetFileSizeEx
FindFirstFileA
FindNextFileA
GetEnvironmentVariableA
FindClose
GetSystemDirectoryW
CreateFileA
GetLocalTime
GetComputerNameW
GetSystemTime
K32EnumProcessModulesEx
GetLastError
K32GetModuleBaseNameW
GetCurrentProcessId
VirtualQueryEx
GetExitCodeProcess
GetStartupInfoW
GetCommandLineW
GetCurrentProcess
ExitProcess
GetModuleFileNameA
VirtualFree
WriteFile
VirtualAlloc
TerminateProcess
SetFileTime
UnmapViewOfFile
Sleep
GetTempPathA
MoveFileExA
FlushViewOfFile
DeleteFileA
SetFileAttributesA
CreateFileMappingA
RemoveDirectoryA
GetProcessHeap
CreateDirectoryA
MapViewOfFile
GetFileTime
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
OpenEventW
OpenFileMappingW
SetEvent
OutputDebugStringA
GetProcessId
GetExitCodeThread
LoadLibraryW
CreateRemoteThread
CreateFileMappingW
OpenMutexW
GetTickCount
HeapAlloc
HeapReAlloc
HeapFree
ExitThread
CreateThread
VirtualAllocEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
InitializeSListHead
GetSystemTimeAsFileTime
GetCPInfo
CompareStringEx
WakeAllConditionVariable
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
GetStringTypeW
WaitForSingleObjectEx
SleepConditionVariableSRW
GetCurrentThreadId
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemTimePreciseAsFileTime
GetFileInformationByHandleEx
FreeLibraryAndExitThread
CopyFile2
AreFileApisANSI
CreateFile2
SetFileInformationByHandle
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
GetModuleHandleExW
EnumSystemLocalesW
VirtualProtectEx
OpenProcess
WriteProcessMemory
CreateWaitableTimerExW
GetModuleHandleW
CloseHandle
WaitForSingleObject
SetWaitableTimer
SetUnhandledExceptionFilter
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
QueryPerformanceCounter
FreeLibrary
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
GetModuleHandleA
WideCharToMultiByte
GetTickCount64
ReadConsoleW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
IsProcessorFeaturePresent
GetStdHandle
RtlCaptureContext
RtlVirtualUnwind
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
LoadLibraryExW
VirtualProtect
GetConsoleMode
GetConsoleOutputCP
CreateFileW
HeapSize
WriteConsoleW
RtlUnwind
SetEndOfFile
FlushFileBuffers
GetFileType
SetFilePointerEx
UnhandledExceptionFilter
IsDebuggerPresent
USER32.dll SetWindowLongPtrW
RegisterClassExW
ShowWindow
IsWindow
MapWindowPoints
MoveWindow
SetFocus
UpdateWindow
SetForegroundWindow
GetWindowThreadProcessId
GetWindowTextLengthW
EnumWindows
GetClassNameW
GetWindowTextW
MessageBoxA
mouse_event
DefWindowProcW
GetWindowRect
DestroyWindow
IsWindowVisible
SetWindowPos
CreateWindowExW
DispatchMessageW
PeekMessageW
RegisterClassW
SetWindowDisplayAffinity
MapVirtualKeyA
SetLayeredWindowAttributes
TranslateMessage
SetActiveWindow
EnumDisplaySettingsW
IsIconic
GetSystemMetrics
SendInput
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
GetMessageExtraInfo
GetDC
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
ReleaseDC
GetCursorPos
EnumDisplayMonitors
GetActiveWindow
GetMonitorInfoW
GetAsyncKeyState
GetWindowDisplayAffinity
GetKeyNameTextA
GDI32.dll GetStockObject
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
COMDLG32.dll GetOpenFileNameW
ADVAPI32.dll OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
RegDeleteTreeA
ControlTraceA
RegDeleteTreeW
RegSetValueExA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
QueryAllTracesA
RegEnumKeyExA
LookupPrivilegeValueW
AdjustTokenPrivileges
SHELL32.dll ShellExecuteA
SHGetKnownFolderPath
SHGetFolderPathA
ole32.dll CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
d3dx11_43.dll D3DX11CreateShaderResourceViewFromMemory
dwmapi.dll DwmExtendFrameIntoClientArea
IMM32.dll ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
bcrypt.dll BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Nov-13 04:09:46
Version 0.0
SizeofData 34
AddressOfRawData 0xe4f520
PointerToRawData 0xe4e320
Referenced File Vampi.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Nov-13 04:09:46
Version 0.0
SizeofData 20
AddressOfRawData 0xe4f544
PointerToRawData 0xe4e344

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Nov-13 04:09:46
Version 0.0
SizeofData 1216
AddressOfRawData 0xe4f558
PointerToRawData 0xe4e358

TLS Callbacks

StartAddressOfRawData 0x140e4fa60
EndAddressOfRawData 0x140e4fc20
AddressOfIndex 0x140e8ceb8
AddressOfCallbacks 0x140270bd8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks 0x00000001401F5170
0x00000001401F5250

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140e88140
GuardCFCheckFunctionPointer 5371267472
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xb2f1ad82
Unmarked objects 0
C objects (33145) 32
ASM objects (33145) 29
253 (35721) 1
ASM objects (35721) 17
C objects (35721) 19
C++ objects (35721) 102
C objects (CVTCIL) (33145) 1
C objects (VS2022 Update 1 (17.1.6) compiler 31107) 26
C++ objects (33145) 184
Imports (33145) 24
Imports (21202) 7
Total imports 345
C++ objects (LTCG) (36260) 63
Resource objects (36260) 1
Linker (36260) 1

Errors

Leave a comment

No comments yet.