| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Jun-08 02:26:08 |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
image-viewer.pdb
|
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Jun-08 02:26:08 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x22600 |
| SizeOfInitializedData | 0xca00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000219BC (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x33000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| api-ms-win-core-synch-l1-2-0.dll |
WaitOnAddress
WakeByAddressAll WakeByAddressSingle |
|---|---|
| KERNEL32.dll |
IsProcessorFeaturePresent
SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineW CloseHandle WaitForSingleObject GetExitCodeProcess GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW GetModuleHandleA GetFullPathNameW ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateFileW CreateThread GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead QueryPerformanceCounter |
| ntdll.dll |
NtWriteFile
RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile |
| VCRUNTIME140.dll |
memmove
__CxxFrameHandler3 memcpy memcmp memset __current_exception_context __C_specific_handler __current_exception |
| api-ms-win-crt-runtime-l1-1-0.dll |
_set_app_type
__p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe _configure_narrow_argv exit |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-stdio-l1-1-0.dll |
__p__commode
_set_fmode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
free
_set_new_mode |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-08 02:26:08 |
| Version | 0.0 |
| SizeofData | 41 |
| AddressOfRawData | 0x2a26c |
| PointerToRawData | 0x28c6c |
| Referenced File | image-viewer.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-08 02:26:08 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x2a298 |
| PointerToRawData | 0x28c98 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jun-08 02:26:08 |
| Version | 0.0 |
| SizeofData | 816 |
| AddressOfRawData | 0x2a2ac |
| PointerToRawData | 0x28cac |
| StartAddressOfRawData | 0x14002a600 |
|---|---|
| EndAddressOfRawData | 0x14002a658 |
| AddressOfIndex | 0x14002f1ec |
| AddressOfCallbacks | 0x1400243d0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001400109A0
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14002f0c0 |
| XOR Key | 0xfece8403 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 10 |
| Imports (33731) | 2 |
| ASM objects (33731) | 3 |
| C objects (33731) | 9 |
| C++ objects (33731) | 22 |
| Imports (33145) | 5 |
| Total imports | 103 |
| Unmarked objects (#2) | 4 |
| Linker (33821) | 1 |
No comments yet.