5a0780c28116a40731aa92bbe0551069
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2024-Sep-16 16:33:33 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
C:\__build\windows\ryft_ex\mt-s\community\polynom_server.pdb
|
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses constants related to base58 Uses known Diffie-Helman primes Microsoft's Cryptography API |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Code Siren
Issuer: Sectigo Public Code Signing CA EV R36 |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x150 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2024-Sep-16 16:33:33 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x930e00 |
| SizeOfInitializedData | 0x401400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000883C38 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xd37000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xcfe414 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
_RDATA
.rodata
.rsrc
.reloc
Imports
| ADVAPI32.dll |
SystemFunction036
CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptDestroyKey CryptImportKey DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW |
|---|---|
| CRYPT32.dll |
CertFreeCertificateContext
CertGetCertificateContextProperty CryptDecodeObjectEx CertOpenStore CertDuplicateStore CertCloseStore CertEnumCertificatesInStore CertSetCertificateContextProperty CertAddCertificateContextToStore CertAddCRLContextToStore CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptStringToBinaryA CertFindCertificateInStore CertDuplicateCertificateContext CertOpenSystemStoreW |
| Secur32.dll |
FreeCredentialsHandle
EncryptMessage DecryptMessage QueryContextAttributesA AcquireCredentialsHandleA InitializeSecurityContextA FreeContextBuffer DeleteSecurityContext |
| SHLWAPI.dll |
PathRemoveFileSpecA
|
| USER32.dll |
GetUserObjectInformationW
MessageBoxW GetProcessWindowStation |
| WS2_32.dll |
getservbyname
getpeername WSASendTo WSARecvFrom shutdown htons WSAStringToAddressW freeaddrinfo getaddrinfo WSAAddressToStringW WSASocketW WSASend sendto WSAIoctl inet_addr send setsockopt WSARecv ntohs ntohl listen htonl getsockopt getsockname ioctlsocket connect closesocket bind accept __WSAFDIsSet WSACleanup WSAStartup recv socket WSASetLastError inet_ntoa gethostbyaddr recvfrom gethostbyname getservbyport WSAGetLastError select |
| KERNEL32.dll |
RtlUnwind
WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW SetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW ExitProcess FreeLibraryAndExitThread ExitThread CreateThread SetConsoleCtrlHandler LoadLibraryExW InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCPInfo CompareStringEx GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer CloseHandle PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection SetEvent CreateEventA LocalFree FormatMessageA FormatMessageW WideCharToMultiByte GetLastError SetLastError CreateIoCompletionPort GetQueuedCompletionStatus CancelIoEx InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObject SleepEx CreateMutexW CreateEventW SetWaitableTimer Sleep WaitForMultipleObjects QueueUserAPC GetCurrentProcessId TerminateThread GetSystemInfo CreateWaitableTimerA GetSystemTimeAsFileTime MultiByteToWideChar GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute HeapAlloc HeapFree GetProcessHeap GetModuleHandleA GetProcAddress InitializeCriticalSection VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce GetCurrentThreadId GetACP GetConsoleCP FreeLibrary LoadLibraryExA SwitchToFiber DeleteFiber CreateFiber LocalAlloc GetWindowsDirectoryA GetSystemWindowsDirectoryA GetModuleFileNameA CreateFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileSizeEx ReadFile FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI TryEnterCriticalSection GetEnvironmentVariableW GetCurrentDirectoryW CreateDirectoryW GetFileInformationByHandle RemoveDirectoryW SetFileAttributesW SetFilePointerEx DeviceIoControl GetModuleHandleW ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared CreateFiberEx FindFirstFileW FindNextFileW GetModuleHandleExW GetSystemDirectoryA GetExitCodeThread CreateSemaphoreA GetFileType ConvertFiberToThread ConvertThreadToFiberEx RtlVirtualUnwind GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW RtlPcToFileHeader RaiseException TryAcquireSRWLockExclusive SleepConditionVariableSRW GetLocaleInfoEx GetNativeSystemInfo InitializeCriticalSectionEx |
| MSWSOCK.dll |
AcceptEx
GetAcceptExSockaddrs |
| bcrypt.dll |
BCryptGenRandom
BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider |
Delayed Imports
boost_stacktrace_impl_return_nullptr
| Ordinal | 1 |
|---|---|
| Address | 0x142a80 |
1
2
3
4
5
6
7
IDI_ICON1
1 (#2)
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Sep-16 16:33:33 |
| Version | 0.0 |
| SizeofData | 85 |
| AddressOfRawData | 0xbbac64 |
| PointerToRawData | 0xbb9e64 |
| Referenced File | C:\__build\windows\ryft_ex\mt-s\community\polynom_server.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Sep-16 16:33:33 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0xbbacbc |
| PointerToRawData | 0xbb9ebc |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Sep-16 16:33:33 |
| Version | 0.0 |
| SizeofData | 1216 |
| AddressOfRawData | 0xbbacd0 |
| PointerToRawData | 0xbb9ed0 |
TLS Callbacks
| StartAddressOfRawData | 0x140bbb1e8 |
|---|---|
| EndAddressOfRawData | 0x140bbb20d |
| AddressOfIndex | 0x140c90d90 |
| AddressOfCallbacks | 0x140933cc8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001405A59F0
0x0000000140883860 |
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140c4d380 |
RICH Header
| XOR Key | 0x3787cc6a |
|---|---|
| Unmarked objects | 0 |
| ASM objects (30795) | 29 |
| C++ objects (30795) | 213 |
| C objects (30795) | 30 |
| 253 (33808) | 11 |
| ASM objects (33808) | 21 |
| C objects (33808) | 19 |
| C++ objects (33808) | 110 |
| Imports (30795) | 19 |
| Total imports | 345 |
| C objects (33811) | 184 |
| Unmarked objects (#2) | 49 |
| C objects (33521) | 855 |
| C objects (VS2022 Update 4 (17.4.5) compiler 31942) | 43 |
| ASM objects (34120) | 1 |
| C objects (34120) | 196 |
| C++ objects (34120) | 625 |
| Exports (34120) | 1 |
| Resource objects (34120) | 1 |
| 151 | 1 |
| Linker (34120) | 1 |