| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Mar-20 15:11:49 |
| Detected languages |
English - United States
|
| TLS Callbacks | 1 callback(s) detected. |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses known Diffie-Helman primes Uses known Mersenne Twister constants Microsoft's Cryptography API |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/47 (Scanned on 2026-03-27 00:14:47) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2026-Mar-20 15:11:49 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x4ec200 |
| SizeOfInitializedData | 0x244800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000004AA65C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x735000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| WS2_32.dll |
accept
shutdown socket getservbyname getservbyport gethostbyname gethostbyaddr ntohs inet_ntoa inet_addr sendto recvfrom getpeername WSASocketA send recv freeaddrinfo getaddrinfo WSAStringToAddressW WSASocketW WSASend WSARecv WSAIoctl WSAGetLastError WSASetLastError WSACleanup WSAStartup setsockopt select ntohl listen htons htonl getsockopt getsockname ioctlsocket connect closesocket bind __WSAFDIsSet |
|---|---|
| CRYPT32.dll |
CertGetCertificateContextProperty
CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertOpenSystemStoreW |
| KERNEL32.dll |
HeapSize
HeapReAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetConsoleOutputCP SetFilePointerEx ReadFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW GetModuleFileNameW LCMapStringW GetStdHandle CreateFileA GetFileSizeEx CloseHandle GetLastError SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ReleaseMutex WaitForSingleObject SleepEx CreateMutexW CreateEventW SetWaitableTimer Sleep WaitForMultipleObjects QueueUserAPC GetCurrentProcessId TerminateThread MapViewOfFile UnmapViewOfFile GetLocaleInfoW FormatMessageA FormatMessageW CreateWaitableTimerA CreateFileMappingA MultiByteToWideChar WideCharToMultiByte GetConsoleMode SetConsoleMode SetConsoleCP SetConsoleOutputCP InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetModuleHandleExW GetSystemDirectoryA FreeLibrary GetProcAddress LoadLibraryA InitializeCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW GetACP GetFileType WriteFile GetModuleHandleW ConvertFiberToThread ConvertThreadToFiberEx GetSystemTimeAsFileTime RtlVirtualUnwind LoadLibraryW ReadConsoleA ReadConsoleW GetConsoleScreenBufferInfo ExitThread CreateThread ExitProcess SetConsoleCtrlHandler IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation SetStdHandle IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetEndOfFile LocalFree RtlUnwind RtlPcToFileHeader RaiseException GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetNativeSystemInfo TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx LoadLibraryExW FreeLibraryAndExitThread |
| USER32.dll |
GetProcessWindowStation
GetUserObjectInformationW MessageBoxW |
| ADVAPI32.dll |
CryptEnumProvidersW
CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-20 15:11:49 |
| Version | 0.0 |
| SizeofData | 1108 |
| AddressOfRawData | 0x66e1a0 |
| PointerToRawData | 0x66c7a0 |
| StartAddressOfRawData | 0x14066e640 |
|---|---|
| EndAddressOfRawData | 0x140670df0 |
| AddressOfIndex | 0x1406ed078 |
| AddressOfCallbacks | 0x1404ee950 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_16BYTES
|
| Callbacks |
0x00000001404AA010
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1406b38c0 |
| XOR Key | 0xc9265d20 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (30795) | 11 |
| C++ objects (30795) | 194 |
| C objects (30795) | 19 |
| ASM objects (35207) | 10 |
| C objects (35207) | 19 |
| C++ objects (35207) | 102 |
| Total imports | 270 |
| Imports (30795) | 11 |
| C++ objects (35225) | 19 |
| Unmarked objects (#2) | 42 |
| C objects (35225) | 939 |
| C++ objects (35222) | 1 |
| Resource objects (35222) | 1 |
| Linker (35222) | 1 |
No comments yet.