Manalyze report for 69009e7d3bc4e612a68757456bfc81456bb602f9096a8e9e3e79eecd23a4d30d

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2025-Nov-16 23:25:41
Detected languages	English - United States
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: .buildid`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryW`
Suspicious	The PE is possibly a dropper.	`Resources amount for 90.9335% of the executable.`
Suspicious	VirusTotal score: 1/71 (Scanned on 2026-08-12 02:36:33)	`Cylance: Unsafe`

Hashes

MD5	`ed2fbc7b3dae4881f0f95b6e15162857`
SHA1	`c3537945eaba4a802c0a9ced5d35bd100aa1be39`
SHA256	`69009e7d3bc4e612a68757456bfc81456bb602f9096a8e9e3e79eecd23a4d30d`
SHA3	`8599efa46cf5cccf85474eb6d3cb0518b024f227aa0df95c88ad66fe7598d4bc`
SSDeep	`3072:tQ42J6bkWgU4I5v6xx9d7nGZM+TwIQtUPXwa/1OGdAD:A4L4I5Qd7m7TwnKfJYGdc`
Imports Hash	`8d88ee3d02e50123906bab082925025d`

DOS Header

e_magic	`MZ`
e_cblp	`0x78`
e_cp	`0x1`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x78`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2025-Nov-16 23:25:41
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x1a00`
SizeOfInitializedData	`0x17a00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000001160 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x2f000`
SizeOfHeaders	`0x400`
Checksum	`0x29d06`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x800000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`e350e5d12b865f27b329760233d88fdc`
SHA1	`0a5636c2cc88eff9cd8516bcf375a5823c8a5ec2`
SHA256	`c5bbb5f255c2e70e1e75e98e5f03f22cffe4db8f53be123cf345856fc17e7eb5`
SHA3	`9b2d28a3e3a3cd27bfd31b324eff44ee6fd855feba5fe37c9d5837e76c5f7498`
VirtualSize	`0x1976`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1a00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.88586`

.rdata

MD5	`a2acda28d16f9ba7c49956324cbc9fb3`
SHA1	`09e4d71d975500abb731a9f4f714065ab77508d3`
SHA256	`6e15ad3714bbd7f821479206a0c92f7e35bb261f02965352411784636f85853f`
SHA3	`0419ac4dc84d2c6e37b2235a53fd8eb620788d5212687716b4610b2a5f790264`
VirtualSize	`0x10e0`
VirtualAddress	`0x3000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x1e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.15833`

.buildid

MD5	`f92e554547f979967bdd33ec2fb5af11`
SHA1	`9c7698787afdcd50de7c015c37cbd15b5130bc4b`
SHA256	`d9eae1dfca724e6aedccf27a02320b8c7bbdd987418bd642210b2d12f095d2bb`
SHA3	`add2477513c27d84db792c1d063284d243120623736ae5bff099d691979b8b82`
VirtualSize	`0x35`
VirtualAddress	`0x5000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.604661`

.data

MD5	`a55b2b5b5992ee63766a195ad0506662`
SHA1	`bd06875afb641b095f71d71abba1c1a729a897ed`
SHA256	`8d92b355f9b7066015a80bb6ef849a380911026a1b98b8e070e3eaca0b049b1e`
SHA3	`9c1e93f6640bc2d0c3a2963e73c66ade186fd29d4527a6d43d0198c7d87b4ea4`
VirtualSize	`0x120`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.644065`

.pdata

MD5	`f6366b4e43edde63802c654974735b2a`
SHA1	`bc0e7f1b3ae59748ebf7cff39be19f426e08a9c0`
SHA256	`5f891542771b1b0413f66178c558ab67c52f0a22ab54d5c8591e2e70f2b7cd63`
SHA3	`83266372045ce97e826b31c98958926de0d42d571b0ae4cdfc972550336f3653`
VirtualSize	`0x138`
VirtualAddress	`0x7000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.52704`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59`
VirtualSize	`0x10`
VirtualAddress	`0x8000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`888cf7c480664f9e27225e1269324bd2`
SHA1	`e384c7d2e3ce5508c10a0117ff1cb03436ec51f4`
SHA256	`2762b31fafd77d777561115cd9a65c5d960802c5df3756ead7c99198792747b7`
SHA3	`73e2c05ff3e5af1400c0f5823ee14570accd6f98ff5b466396604ffc86dcbb9d`
VirtualSize	`0x252bc`
VirtualAddress	`0x9000`
SizeOfRawData	`0x25400`
PointerToRawData	`0x3800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.99385`

Imports

api-ms-win-crt-private-l1-1-0.dll	`__C_specific_handler` `memcpy`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `__stdio_common_vswprintf` `fwrite`
api-ms-win-crt-runtime-l1-1-0.dll	`__p___argc` `__p___wargv` `_cexit` `_configure_wide_argv` `_crt_atexit` `_exit` `_initialize_wide_environment` `_initterm` `_initterm_e` `_set_app_type` `_set_invalid_parameter_handler` `abort` `exit` `signal`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc`
api-ms-win-crt-string-l1-1-0.dll	`_wcsdup` `memset` `strlen` `strncmp` `wcslen`
USER32.dll	`MessageBoxW`
KERNEL32.dll	`DeleteCriticalSection` `EnterCriticalSection` `GetLastError` `GetProcAddress` `InitializeCriticalSection` `LeaveCriticalSection` `LoadLibraryW` `SetDllDirectoryW` `SetUnhandledExceptionFilter` `Sleep` `TlsGetValue` `VerSetConditionMask` `VerifyVersionInfoW` `VirtualProtect` `VirtualQuery`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-environment-l1-1-0.dll	`__p__wenviron`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x334`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.69634`
Detected Filetype	PNG graphic file
MD5	`f3a19eb386d9f5f9b10039f9896b6251`
SHA1	`d20077f3d186e0342d671c0724ea4b296cfe3049`
SHA256	`6a943efacf738714165eaa05ba1bae9eae94bac073a1296108c2bd808af9995d`
SHA3	`f9cd051b3a32f604078bf694433865fbc228f6318969ccbb34b156e825ad88f8`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x9ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.9145`
Detected Filetype	PNG graphic file
MD5	`1e0657af86c121ed2302326887dfa2f7`
SHA1	`378c7ae705e8bbe98ee59ff0cb4d9b804776b652`
SHA256	`06b965096048795c94b2af6f6b9df78b69beddb0a51d184a023e805222462b36`
SHA3	`c68dce22612a5e3ad7297a7b3b3303daccd6a83f0e77fb17022cef9ca1a17916`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x142a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95517`
Detected Filetype	PNG graphic file
MD5	`a5e9303c464b4d88ec0f0d143e4af4e6`
SHA1	`cc12ff9d17c7ab380791e04a2115d47e1ae19b15`
SHA256	`75f804f2a8f3004f2c842b698368203e25be73f6d04e32814eb71d2a845368c2`
SHA3	`1ec9b14271ebca994fd52e5b9f89ee98f40c894dbcc3c1b9bb7a125d562db923`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x21be`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97505`
Detected Filetype	PNG graphic file
MD5	`969fa4c40e4c19ed969e117d629d6972`
SHA1	`63600a4485c6920bdee6c81aec3dbe6ed1640b2e`
SHA256	`86f54195fbda54a3f29840c531a4ebf2b9c85137649fa4ebed002a3112fbd830`
SHA3	`5cb2a99db7c094dc27077806b573f956f134165a229f70721302becfc38407fd`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x76ab`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98841`
Detected Filetype	PNG graphic file
MD5	`7bbce8e259ef9e7dec34979e78ec59ef`
SHA1	`f48cb5270f2736794467b2810d897f6d0f64dee0`
SHA256	`0bcb7a7d0b59c1ba583958cde967edbe913ab308c483dd202fb0994b9991cd58`
SHA3	`1924aa98b7d8e5d1259ce53d48ef2847491ea5bbeb78f8358d5cafbfa190680d`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x1941c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99644`
Detected Filetype	PNG graphic file
MD5	`2853e2b303c8d796739ae421ac97e6b1`
SHA1	`b7743c885a39dea56b8212cf36b5a67197fbf78b`
SHA256	`b47e92aae092c4f5f24d6e95c59da6195666846efbeda07c90ee93afe4290816`
SHA3	`c2fe2a9122c1a74855ab460ad8e5c4342e3d5b49ee29a36541995a492b306975`

1 (#2)

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.87413`
Detected Filetype	Icon file
MD5	`73af67a70a340fe10efe782d799ce46f`
SHA1	`4ae135250e57ddbbfb95e8d26239f13c067d5e3f`
SHA256	`700a64fcc0e656a481d00be74b2bf9c847e70c4f700c141ee46d03f5c27ded3b`
SHA3	`62a7d79fe9c8a12094d8381145079fcb6fb4583d0aa721d9cc051492df459801`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2bc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.82693`
MD5	`67d470b193d92eaedadc0bb58838f5f1`
SHA1	`f3d3d4f28c3635167a46e075d490c33bdbb01496`
SHA256	`7a7ce637fc4e50b945d45254545c848c8350184f51ee13abca9188621c9bad25`
SHA3	`87048578496162e372472f4afe5412b15ce526e1ab77d805f4e73f0a59a0c7f1`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2025-Nov-16 23:25:41
Version	`0.0`
SizeofData	`25`
AddressOfRawData	`0x501c`
PointerToRawData	`0x301c`

TLS Callbacks

StartAddressOfRawData	`0x140008000`
EndAddressOfRawData	`0x140008008`
AddressOfIndex	`0x140006078`
AddressOfCallbacks	`0x1400036b8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`0x0000000140001580` `0x0000000140001600`

Load Configuration

Size	`0x138`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0`

RICH Header

Errors

[!] Error: Could not read an IMAGE_BASE_RELOCATION!

Leave a comment

No comments yet.