621bff60b096f55b4b56637b68f3a53de3bfa7742fe91c75e35e41e8bf3dd2e1

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jun-23 00:40:20
Detected languages English - United States
Debug artifacts C:\Users\wrld\source\repos\exitdll - Copy\x64\Release\exitdll.pdb

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Malicious VirusTotal score: 4/63 (Scanned on 2026-07-09 01:50:45) Bkav: W32.Malware.2450E909
CrowdStrike: win/malicious_confidence_60% (D)
Cynet: Malicious (score: 100)
MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 21a9e955c8fd011a9c01f6b0e36804af
SHA1 749aa1506d1486a2528c25ccf88b7a06f34a31f0
SHA256 621bff60b096f55b4b56637b68f3a53de3bfa7742fe91c75e35e41e8bf3dd2e1
SHA3 42e32cda43fcefcc3995507d1874795358e73e47ceaf31aace1fda3e636fd699
SSDeep 384:uKsHjWSBICb/sRKmLfktQBwvQA/Tgmo6UKfbXW8Zh/MMm3MZNjTr:VsjoLLfjwvRbzo6fJsb3MDP
Imports Hash b7cc4314966e4a686f32d2e4f368500d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jun-23 00:40:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x3e00
SizeOfInitializedData 0x3800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000003648 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xc000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 cb25746c930182ca73f84af314f4edbe
SHA1 679733e64eba8c73b6a0241ae8ced5b16942c602
SHA256 d54bea3b360c6b17540f028178b4995e0eb32dac22453c7b256846ecf8aa72b9
SHA3 a2e558eb45453fa7e41568f949fd6e64715fa9b8991c5766d5aa3daac83a475f
VirtualSize 0x3d48
VirtualAddress 0x1000
SizeOfRawData 0x3e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.28868

.rdata

MD5 c3018c4ec13c05d28bc1b1c3cf21d5ff
SHA1 437fadaf57f27bdc22ff984d7b1a79aa871de849
SHA256 9644f1e03ebe401c335a68db6a1d7ace833f3b5339a77758f34b4e7aff6cc6f4
SHA3 dadaaf3e9e3da549673a1121d25bca7e2f021ce551dc96122a62f8dc0e1b5ad7
VirtualSize 0x20da
VirtualAddress 0x5000
SizeOfRawData 0x2200
PointerToRawData 0x4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.32127

.data

MD5 f5583d8069786f8490e1adf037af3606
SHA1 6cfa84f3d82d0203aacccfeba89c11b80c487dc2
SHA256 4a6e97d806eb236895a68683eda77c594f9fda392b9727e483dcf812a5539f84
SHA3 eb9f357c4ff2397532e18e3c72afd0e23914b88f05accf65c7e593bbca2f3ff9
VirtualSize 0xb80
VirtualAddress 0x8000
SizeOfRawData 0x600
PointerToRawData 0x6400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.15791

.pdata

MD5 97287cda93db9b0367ec66ac7fe4a800
SHA1 399caae876ddd664c17fa0ecdce122e10153153d
SHA256 778dee7540d88d83e0cd3d835e39c899f89641756381160724fd0466180416f3
SHA3 10abc7ad46765c6220124d6cb948d7cc37a63a2d5bc77dc4dbd2c78e1a866525
VirtualSize 0x4d4
VirtualAddress 0x9000
SizeOfRawData 0x600
PointerToRawData 0x6a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.63933

.rsrc

MD5 7f77341ca10dad16840e75bf70bc8baf
SHA1 d443885ae0f47283bb53da0d3f37916734f48283
SHA256 abd3fd3cbbfe1233e6a75b6c7070774d606ba53080e351dada014d9f128e5878
SHA3 d881041e8c22a90693b3ae74e56f1076345ef4a30fd2e88465f1b49991cbbefa
VirtualSize 0xf8
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x7000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.51196

.reloc

MD5 776d601e8ec612e863dcfb7215558205
SHA1 7ee47665e541e5058016f5bccdb4bf6eeb7f23ed
SHA256 263c4c675e8502124d109a728c408d65f9a677cb9ce1bc361549f7236c8cad0a
SHA3 5d7a1aad3deaf3b1d6aaa3daeece5eccc32422763ab3a5b0b2ca70d18d6d8df2
VirtualSize 0x50
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.10911

Imports

KERNEL32.dll CreateFileW
GetFileSize
ReadFile
CloseHandle
Sleep
CreateThread
DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
MultiByteToWideChar
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualFree
OpenThread
SetThreadContext
FlushInstructionCache
GetModuleHandleW
GetCurrentProcessId
GetThreadContext
HeapDestroy
HeapAlloc
HeapReAlloc
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
GetCurrentProcess
HeapFree
VirtualProtect
HeapCreate
GetStartupInfoW
OLEAUT32.dll SysAllocString
SysFreeString
MSVCP140.dll ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_Xbad_alloc@std@@YAXXZ
SHELL32.dll SHGetFolderPathW
VCRUNTIME140.dll strchr
strstr
memcpy
__C_specific_handler
__std_type_info_destroy_list
__current_exception
__current_exception_context
_CxxThrowException
memset
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0.dll free
calloc
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0.dll wcslen
wcscmp
api-ms-win-crt-runtime-l1-1-0.dll _initterm_e
_crt_atexit
_execute_onexit_table
_initialize_narrow_environment
_seh_filter_dll
_configure_narrow_argv
_crt_at_quick_exit
_initterm
terminate
_register_onexit_function
_cexit
_initialize_onexit_table

Delayed Imports

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x91
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8858
MD5 f7ad1eab748bc07570a57ec87787cf90
SHA1 0b1608da9fef218386e825db575c65616826d9f4
SHA256 d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04
SHA3 6c9541b36948c19ae507d74223621875b3af4064f7cd8200bdb97e15a047e96a

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jun-23 00:40:20
Version 0.0
SizeofData 90
AddressOfRawData 0x5c40
PointerToRawData 0x4e40
Referenced File C:\Users\wrld\source\repos\exitdll - Copy\x64\Release\exitdll.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jun-23 00:40:20
Version 0.0
SizeofData 20
AddressOfRawData 0x5c9c
PointerToRawData 0x4e9c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jun-23 00:40:20
Version 0.0
SizeofData 732
AddressOfRawData 0x5cb0
PointerToRawData 0x4eb0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180008200

RICH Header

XOR Key 0xf8054fa4
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 8
ASM objects (35207) 3
C objects (35207) 8
C++ objects (35207) 18
Imports (35207) 4
C objects (LTCG) (35224) 4
Imports (33145) 7
Total imports 82
C++ objects (35224) 2
Resource objects (35224) 1
Linker (35224) 1

Errors

Leave a comment

No comments yet.