Manalyze report for 5901373915bfb9b9c7661cb0ed426a21ed8944207fa8b3c3e1edab54d3293595

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-11 17:09:22

Plugin Output

Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`aad163e05f2a698e66e680e518979d94` 🔍
SHA1	`5b35ef2fea61430ea93d636015a601ced6190f8d` 🔍
SHA256	`5901373915bfb9b9c7661cb0ed426a21ed8944207fa8b3c3e1edab54d3293595` 🔍
SHA3	`1976ea0b01ec4b7139fffe2a2fda0857cd3d20d315a9e0f181f5e77e97e8c972` 🔍
SSDeep	`24576:2L+60/GD9Ix7UZ/s6wxyfCKBROfv7xLwaSpnhJcye43pzmjI:/eD9OF6baw6VMVvJrZ` 🔍
Imports Hash	`5e9bee715943b425353d4c10f2ded0d4` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	2026-Oct-11 17:09:22
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x1dba00`
SizeOfInitializedData	`0x9de00`
SizeOfUninitializedData	`0x400`
AddressOfEntryPoint	`0x0000000000280B24 (Section: .gfids)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x3ca000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x1db930`
VirtualAddress	`0x1000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.data

MD5	`56222b87cd44fa35a6e3f8424081cb5c 🔍`
SHA1	`3a9937384c66553004fefbe9458dc0a0e3ee6b06 🔍`
SHA256	`09de0e5fae443f81f6c965bf531ac6a55a7b77d867bd4dfae2104bf4e5ddf939 🔍`
SHA3	`49ccc244c1a61e5a29ebd79b6426498907faf6382ec4f73cafad7df7e17515de 🔍`
VirtualSize	`0xd80`
VirtualAddress	`0x1dd000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.433565`

.rdata

MD5	`1c0e283737ca005c838e870cfaaeb24d 🔍`
SHA1	`10470e2af5538ef7112bf7ea2f5cada3aa61922e 🔍`
SHA256	`a4bf785db58852434e792d2102daef95dcf3814bffcc1b115486d61e1c1233fc 🔍`
SHA3	`89120e7a94dc5f7c1973974c0de6783071839b8f464d4ce65f41c9dbd42ea21d 🔍`
VirtualSize	`0x780e0`
VirtualAddress	`0x1de000`
SizeOfRawData	`0x78200`
PointerToRawData	`0x1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.77679`

.eh_fram

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x4`
VirtualAddress	`0x257000`
SizeOfRawData	`0x200`
PointerToRawData	`0x79400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.pdata

MD5	`51a763ef969fe7568497a95bcbe300a2 🔍`
SHA1	`b9c5cd58d68c70d297b945d2285ecc7cb8528f8b 🔍`
SHA256	`6c592e18c7010d232cbdadecfff90efa10f9709fb3c0cf805583018146d47d4e 🔍`
SHA3	`d65fa7261c47b3b94e63c6dc70b8dca9f3f94ac8d0b42e6a6263d3d9b4871265 🔍`
VirtualSize	`0xd3a4`
VirtualAddress	`0x258000`
SizeOfRawData	`0xd400`
PointerToRawData	`0x79600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.30496`

.xdata

MD5	`a50f1eb3c3f3519359302df5fbb51f14 🔍`
SHA1	`58d7cbb0a09347403d53b6ffeff3c3e3bac5a339 🔍`
SHA256	`927ccb7f4b5bd2b38fbf6e41e328355a5e9722c3d40f8a99be5bfc286b2dc297 🔍`
SHA3	`b940d055497b53ef4a974685bb3233795070d8b223e7f0e200ac267c48af1ba7 🔍`
VirtualSize	`0x11628`
VirtualAddress	`0x266000`
SizeOfRawData	`0x11800`
PointerToRawData	`0x86a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.97836`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x2c0`
VirtualAddress	`0x278000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`56280ca69230a8117da3e421d5502222 🔍`
SHA1	`0b99c301efa6ffe0b69e20bb2b502669d15c3318 🔍`
SHA256	`f53e4b4930511234b6fe2bfb5e49b51e8fdf4cc389e4895c4fc9a54e5381cade 🔍`
SHA3	`e678d104922dc5368fa0e072b6b54815c6b277ee4162c72f7999d9729c8c8bf0 🔍`
VirtualSize	`0x2ef0`
VirtualAddress	`0x279000`
SizeOfRawData	`0x3000`
PointerToRawData	`0x98200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.44154`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x27c000`
SizeOfRawData	`0x200`
PointerToRawData	`0x9b200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`08f42852bf6f00bebcd7d0c3a1b0e729 🔍`
SHA1	`89f8b47eb82e6901efb5e0136962f0463a8c7be5 🔍`
SHA256	`a6d9a6b66fe6c76dfe7461a6d72b11ca057aae697768347f8ace65f6adc88a5a 🔍`
SHA3	`a9682f4d024c8970274d06b9e3c29c179b478c8558ef4dc1166dcc890310040e 🔍`
VirtualSize	`0x2cd4`
VirtualAddress	`0x27d000`
SizeOfRawData	`0x2e00`
PointerToRawData	`0x9b400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.42023`

.gfids

MD5	`f54ab3cd60501d9354918aa22ccc4c10 🔍`
SHA1	`be8f317755b884c3a458109ac3ebeade98e54f52 🔍`
SHA256	`14adb669aa61c6e53aa43f18db21c746566fe74a8b5fc852282d460463af9f47 🔍`
SHA3	`00b8e5979b1c8dd7e13071e61581cc2c81298947334627e9907fcbc805fb5d97 🔍`
VirtualSize	`0x149184`
VirtualAddress	`0x280000`
SizeOfRawData	`0x149200`
PointerToRawData	`0x9e200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.96487`

Imports

bcryptprimitives.dll	`ProcessPrng`
api-ms-win-core-synch-l1-2-0.dll	`WaitOnAddress` `WakeByAddressAll` `WakeByAddressSingle`
api-ms-win-crt-environment-l1-1-0.dll	`__p__environ`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr` `pow` `roundf`
api-ms-win-crt-private-l1-1-0.dll	`memcmp` `memcpy` `memmove`
api-ms-win-crt-runtime-l1-1-0.dll	`_set_app_type` `__p___argc` `__p___argv` `_cexit` `_configure_narrow_argv` `_crt_atexit` `_exit` `_fpreset` `_initialize_narrow_environment` `_initterm` `_initterm_e` `_set_invalid_parameter_handler` `abort` `exit` `signal`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `fflush` `setvbuf`
api-ms-win-crt-string-l1-1-0.dll	`memset` `strlen` `strncmp` `wcslen`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.