56b4b621885c8921af75da96e407632d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2022-Jun-02 20:19:49

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 6431803 bytes of data starting at offset 0x47800.
The overlay data has an entropy of 7.99799 and is possibly compressed or encrypted.
Overlay data amounts for 95.6449% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 56b4b621885c8921af75da96e407632d
SHA1 24f1a60181d88d559d141410e6c544fc8138a292
SHA256 d60749681c25dac0d7a7a29da1d4b99650497ec627fd3698114533074195bd2a
SHA3 c397ea54201b5802b552c7088a9f814155827795faa0f9894014fc19cfe9eaef
SSDeep 196608:csXrkHCsXDjDyfvwKP5W3I6sKpfyOp6rFJeTT:zSCEDPKRW3I1Kp92Jen
Imports Hash d170e2e5adcfc4c271f2eb78a565305e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2022-Jun-02 20:19:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x23600
SizeOfInitializedData 0x23e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000009D30 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x5c000
SizeOfHeaders 0x400
Checksum 0x679254
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d7fa6f1a0c2e39e5e7ead14e92ea99c9
SHA1 70f76ef1e4b33002a96c9bedcb5e4add8cefddac
SHA256 14b716d7e1335f388cb7c0a57accd4a253c78cc32045befb8cbe5ddc97b9978d
SHA3 752ec818bdaee1baa386b91fc14801aa5e15c9a6420eb9510e88601621140629
VirtualSize 0x235e0
VirtualAddress 0x1000
SizeOfRawData 0x23600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47352

.rdata

MD5 b8f523943e71eb01bbf8366ab8ba845b
SHA1 f0ce9a69cfab8d4770a5ce511fbc6fac3ce51b80
SHA256 ef53b87e8c8a526343e6903b1e31770a6416f755999b2312de25cd27a7087f1c
SHA3 6bd8eb920715e885824b1399cfd767949225d1618f480aae277543d3beec28e6
VirtualSize 0x114fc
VirtualAddress 0x25000
SizeOfRawData 0x11600
PointerToRawData 0x23a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.73191

.data

MD5 1cc543037802ecab778979a9d38fefa4
SHA1 1357ef622b1fb520a0eefadda99f952cd2f410fd
SHA256 ed6658c56838e4d548e2efead56e85022783d38841bb06b4389aec4cfc2fb2d6
SHA3 0b1e17f6c81c7ac5941cfa06fe5dada0342d088e206bfc84b25902fc72786dbe
VirtualSize 0x10398
VirtualAddress 0x37000
SizeOfRawData 0xc00
PointerToRawData 0x35000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.85809

.pdata

MD5 ac00f06362e5910fa2833334b348e1bc
SHA1 a13d5f9ec8ba58b2d97c46d3786b54f74107f3e6
SHA256 a9fb7cf132473c52a4096f37c89f7e46f1cb302a30b0588161c57830b728bc5e
SHA3 bd18bf3aea3e88eed856edbd774f2926fa2be59f44c7b3e46e5446c9a0abbabd
VirtualSize 0x1e48
VirtualAddress 0x48000
SizeOfRawData 0x2000
PointerToRawData 0x35c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.16781

_RDATA

MD5 e2027b2205402187ea5ceb5c90bdf5f1
SHA1 3d223be90fda88f77ad6dee19143526d4f73d516
SHA256 e62554b8d5280b1e037e7daceeb9f1ac0ad9870f267a4b9c289635052cc2a7bd
SHA3 9794fa7fa4a19f52eb12ab173b29248e57c043e5f85dffe7ef4b76e9f188c346
VirtualSize 0xf4
VirtualAddress 0x4a000
SizeOfRawData 0x200
PointerToRawData 0x37c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.97944

.rsrc

MD5 4b1b90312b3605b30cf2488b85d2f973
SHA1 cd92148e28cdc342f0ffb38a37bdf2702525e3ee
SHA256 f7c730361c5f893ab5db00b194918082521c80e6e662bc0737fd48d7c9b21dcc
SHA3 70220f97f19767f2f15631dfa5c113c8ae348a34fc4fef010a54adc50708f40e
VirtualSize 0xf00c
VirtualAddress 0x4b000
SizeOfRawData 0xf200
PointerToRawData 0x37e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.35626

.reloc

MD5 6607b018e266376a81d45bed63616545
SHA1 84994933977d0833b9ea83de058df56eba1930d2
SHA256 ce7c3e108caa450db8ae555e5188643d9e3ac21a685054d1782d92a015767f31
SHA3 383e7d0a2a57091f400107dad7f84aa2f97ccf09de00af248fe00b4b0faf92c4
VirtualSize 0x74c
VirtualAddress 0x5b000
SizeOfRawData 0x800
PointerToRawData 0x47000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.23124

Imports

KERNEL32.dll GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
GetStartupInfoW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
CreateProcessW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
ADVAPI32.dll ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.58652
MD5 008578f1b7acebecd90bf1f3ac6ee061
SHA1 a013b9ba662b5244fd84a9d09404e999dc6333ad
SHA256 e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96
SHA3 1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05629
MD5 5096923956b255386181e7c44af9b552
SHA1 9d3f9d245fd7721707ad0dda9d133bc9398684af
SHA256 46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5
SHA3 d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5741
MD5 5a64b725f24048ed51af35b9ee7d2fff
SHA1 a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e
SHA256 c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc
SHA3 4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x909b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.95079
Detected Filetype PNG graphic file
MD5 20d36c0a435caad0ae75d3e5f474650c
SHA1 e9e536a2c9d009666e5de2b3e5823269204aabb6
SHA256 c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2
SHA3 a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29119
MD5 b21a1cea6c1a6796700a0c7ee394ff2b
SHA1 c9b5246eddedabf11534c9c984e305a86151be9f
SHA256 01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8
SHA3 9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43869
MD5 a12bdfb484bb481e1f106beb19aa4765
SHA1 18228c2e61981dd29f67cd938ef2a2303d75b81b
SHA256 b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8
SHA3 01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e

7

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89356
MD5 3343c0fa901ae372eb7c9d1159386193
SHA1 16944a8dcace69148c0628b723e0fa124279a79d
SHA256 0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be
SHA3 a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71858
Detected Filetype Icon file
MD5 d06bb5f499a7e63fdebdde478b53af68
SHA1 f4b46ca808dc838d436be1d2c13a40d51bdd8f4f
SHA256 038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5
SHA3 af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x58d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29
MD5 c4dc86c32810b6508c37f3a366b8a350
SHA1 81e0608549e2413de4ab030dd2e4bfab955a193f
SHA256 30aa7dcfed2af1c01ab7834926470943373f9bc5be6e606f735354f404a4bb3c
SHA3 c77e19f0d37225d77e8893e21ba5e9d815339b5e06074ba2482d945a862f338f

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2022-Jun-02 20:19:49
Version 0.0
SizeofData 680
AddressOfRawData 0x339a0
PointerToRawData 0x323a0

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140037008

RICH Header

XOR Key 0x883b3fa8
Unmarked objects 0
C objects (27412) 11
ASM objects (27412) 7
C++ objects (27412) 186
253 (28518) 3
C++ objects (30034) 38
C objects (30034) 17
ASM objects (30034) 9
Imports (27412) 5
Total imports 113
C objects (VS2019 Update 11 (16.11.8) compiler 30138) 19
Linker (VS2019 Update 11 (16.11.8) compiler 30138) 1

Errors

<-- -->