5b6965f5aefb6c30da49ff51da16ba7ef614e5292d808430ccba9dbff9d49d0f

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jul-19 00:22:53
Detected languages English - United States

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • crl.microsoft.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
  • http://www.microsoft.com
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
  • http://www.microsoft.com/pkiops/Docs/Repository.htm0
  • http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/windows0
  • microsoft.com
  • www.microsoft.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Suspicious The PE is possibly packed. Unusual section name found:
Unusual section name found:
Unusual section name found: petite
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
 Possibly launches other programs:
  • ShellExecuteA
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
Malicious The PE is possibly a dropper. Resource 102 detected as a PE Executable.
Resource 103 detected as a PE Executable.
Resource 104 detected as a PE Executable.
Resources amount for 85.18% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 8cf0e9d31413a08d08fdb04834fff58e
SHA1 8e4c5e114fe2e5042604680c0b9cd1956547df69
SHA256 5b6965f5aefb6c30da49ff51da16ba7ef614e5292d808430ccba9dbff9d49d0f
SHA3 236ae1f156d2e747fe314149e137501acfc6004721a1de7508f03ea35e043db1
SSDeep 12288:s1sNK17ds7HBsGvMbfaOxDBMULj7HBsGvMbfaOxDGdCUSVWly2yvhBNp9/:mT7e7hfvMba8MULj7hfvMba1SVe4hLv/
Imports Hash 9afc91f771d06ed23534aecde6163f4a

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2026-Jul-19 00:22:53
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x1d400
SizeOfInitializedData 0xaedc4
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001E1DB (Section: )
BaseOfCode 0x1000
BaseOfData 0x42000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xf8000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

Section_1

MD5 69ddf6fc1a15e4e3ccb34c631a3925e3
SHA1 3d2fc8b299c610c63621f91f66b61c5b6a56f355
SHA256 6b706ec8cf4d0c3b5f6529f8207c7e7d8f62d12ab472f0b0bdc0447abefe17cf
SHA3 07995a2bcfafa3e830bbb50559a54e4413feb467e6718087c36c86e22d0c4d6b
VirtualSize 0x44000
VirtualAddress 0x1000
SizeOfRawData 0x1d400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.98476

.rsrc

MD5 44262765ad26f1780e621bcea8198d55
SHA1 badf493735222c7f359f59998cb46afb01067de0
SHA256 06e868fd60d4b2b95e9778934071ebd71c5874ff04d2c1759cdfad1b0f583ebc
SHA3 e9e25e1bb59da15af9ba78e0d6ed2429ebae8b4dadbdfd6edc7d64946c3ed3fb
VirtualSize 0xaf000
VirtualAddress 0x45000
SizeOfRawData 0xae400
PointerToRawData 0x1d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.53494

Section_3

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x3000
VirtualAddress 0xf4000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

petite

MD5 586b28c3d0ba0142695b30381c76a1ee
SHA1 57e3b901545e10a359056f8d371658dbdc2cc842
SHA256 b3f84fe60e2b0ae71d0fdc705b4df7fced9486e7573a8477eaeb50d112718420
SHA3 20a0100dac934c43cf907414aab8439b7cb698acfbaf268d8d4a38e8947eb06e
VirtualSize 0x9c4
VirtualAddress 0xf7000
SizeOfRawData 0x9c4
PointerToRawData 0xcbc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.48365

Imports

user32.dll MessageBoxA
wsprintfA
kernel32.dll ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
COMDLG32.dll GetOpenFileNameW
ADVAPI32.dll CopySid
SHELL32.dll ShellExecuteA
ole32.dll CoInitialize
OLEAUT32.dll SysFreeString
SHLWAPI.dll PathFindFileNameW
ntdll.dll RtlFreeHeap

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.54176
MD5 79ad8b7ac3260fc8437435a0fd7700fa
SHA1 1083b46fb88c92f17fc230c90644ac236e49e8f9
SHA256 27f4ca36e1ac1f756b9582849e233f118ed4bccec79aa9e6a41d56f39e68a35e
SHA3 d15fb6f680947c64d669c37fe51f3524cf6b841030ccbcc9e33aa267554a508d

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.54176
MD5 79ad8b7ac3260fc8437435a0fd7700fa
SHA1 1083b46fb88c92f17fc230c90644ac236e49e8f9
SHA256 27f4ca36e1ac1f756b9582849e233f118ed4bccec79aa9e6a41d56f39e68a35e
SHA3 d15fb6f680947c64d669c37fe51f3524cf6b841030ccbcc9e33aa267554a508d

102

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x3f7b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.39443
Detected Filetype PE Executable
MD5 5634bac51573df428430b459ffa11474
SHA1 a8d7aefa81edba7a19db6bf68c58c11788b88b28
SHA256 c210008cb2b2d514d3f2d7d8f0198349e20c6e262961d8f6549be051d568e7f8
SHA3 c5a4206b5f90eb14b43e2369c66ef29dda48216fdac1cfff73f40cbc3095eec7

103

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x48b30
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.51519
Detected Filetype PE Executable
MD5 541d45499791723f71e0491c51a0e70b
SHA1 0c90e855d52e2869e586c7a57bb8d9d781ac111b
SHA256 fce700c17ce1d831706b9bbda6b8e6b1b8d777226f0b307be594054ce33dbfd2
SHA3 8cbe254fe83d7f6b7dd4dafd73484076499de56035fede511a23ed7848b8d01b

104

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x24b50
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.46094
Detected Filetype PE Executable
MD5 cd17feff84b207001e3c3f4020bd33a5
SHA1 57a52e24a78e066ba6b73a02bc873f668a6cef11
SHA256 6729816e459be41ae1726438b95d207a3a626ff7b87ebeb8d569f740dcbc7f51
SHA3 37c04fefc8d05401716cb7847c34150d1edbcaecbdd59f21f1fbd5f7e6498caa

MAINICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.9815
Detected Filetype Icon file
MD5 dd0739ecfcf14d5cde3b9fefc2cf4f8a
SHA1 a8c6d3902c94b9ba6072d2abf5f82893a1e850ed
SHA256 d6252cc737bc1f449bbc76aadb4ab7928e0e012296966ea530dd1b209ba39182
SHA3 331e28e534d12d99163123dd7dfc16533e87fb11a45dd344dbe33eb5d4509b0c

101

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.81924
Detected Filetype Icon file
MD5 cbee427fa121aba9b9b265ff05de5383
SHA1 24fcae33001c8e0f5ec795c6edf076a69d59589f
SHA256 494e4fd717fa1ee0c5c7bb3b4e28fdab4b7f6e95b4f9865f5ab86f03f62ae62c
SHA3 a3fa35d56632275ba55716a4964f02031270f61f06a903fc460ac2dd6bebde85

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x841a253e
Unmarked objects 0
ASM objects (35215) 12
C++ objects (35215) 178
ASM objects (35207) 21
C objects (35207) 17
C++ objects (35207) 92
C objects (35215) 24
Imports (35215) 19
Total imports 249
C++ objects (LTCG) (35228) 3
Resource objects (35228) 1
151 1
Linker (35228) 1

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Error while reading the IMAGE_LOAD_CONFIG_DIRECTORY! [*] Warning: Section has a size of 0!
Leave a comment

No comments yet.