Manalyze report for 6af76f759de9ebf23bd7c295bcdbaf829e18ce1422c469ea908ef88750e62fb5

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Sep-12 07:28:31

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: _reverse` `Unusual section name found: _t0`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`f255e2bf002a875148a86aed00e9ffec` 🔍
SHA1	`dac86c23265d64676056eabc77e48755128866a8` 🔍
SHA256	`6af76f759de9ebf23bd7c295bcdbaf829e18ce1422c469ea908ef88750e62fb5` 🔍
SHA3	`955624549221fcace6730ab06c483ac959145a965aabd6c270bbd67e4ec2b4c3` 🔍
SSDeep	`192:k4bQHukK8W936gX64Jt1jxTXyMHmCi1FlYDSpC3JbWeuHN0WPKbtyCszV:kKUuk3m3bXBX9MYHhUvPXCW` 🔍
Imports Hash	`97a696631bb404c655dbb827a5b12335` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`12`
TimeDateStamp	2026-Sep-12 07:28:31
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x1400`
SizeOfInitializedData	`0x2800`
SizeOfUninitializedData	`0x200`
AddressOfEntryPoint	`0x0000000000001490 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xe000`
SizeOfHeaders	`0x400`
Checksum	`0xcd1e`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`db4f0d0436a0c5bfebcc71606b45abb6 🔍`
SHA1	`2defb9f991b973c6cdac24dbe3ba111a8dba33dd 🔍`
SHA256	`02e277842ec3b1380dca50cbf5d9df0e61e0142ae05dd286a377a6676c4f2a12 🔍`
SHA3	`f6964f2bec868dba425074b755e36b33b30bd1887cff67fee51ecafa571c480d 🔍`
VirtualSize	`0x13f0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.02582`

.data

MD5	`2d6611a0fe3aee47e9f7d7105c5d883b 🔍`
SHA1	`93836bba776b0e27d5eb15d750735a5ec68e1b2a 🔍`
SHA256	`6ecff4c49cd3ef299a08a5be700c0416ed0c971acd564783732a6ab3a9769f0f 🔍`
SHA3	`5b07983c9d141a2d15f0d2668779b9f34db7777de3ce1e03940a883eb730cf01 🔍`
VirtualSize	`0x90`
VirtualAddress	`0x3000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.555359`

.rdata

MD5	`d83d075f1121beccaf62c9a7479ee83f 🔍`
SHA1	`b21128d42387baf3bf594b1319af06f149665451 🔍`
SHA256	`d350afbff4d03154c171e21246303f14938057cbc11a30f0cc4e7af3a048231a 🔍`
SHA3	`49f7c198ff7e071b6048bab078bc0eea1337b784af72b39da484ab11601b09f7 🔍`
VirtualSize	`0xa68`
VirtualAddress	`0x4000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x1a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.52747`

_reverse

MD5	`49d69a52653720c6f4d3567dde56aca0 🔍`
SHA1	`2a3c098493b895d70a9a1baf3983ab20583a5ce0 🔍`
SHA256	`f7fce6abbd2f6c7d2ce09961052c484aeb60eaf4b921d25b6eb284a965be2868 🔍`
SHA3	`afc8bdf2f82ccbb3e0d0caeb3dc780bc07cefbaf4b5f989ff2d8dd6594d23aa3 🔍`
VirtualSize	`0x8`
VirtualAddress	`0x5000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.129443`

_t0

MD5	`c0da3cd85494413099e1270a32b49d8d 🔍`
SHA1	`e8305270039877f7abf8e76d41f810e0934693ff 🔍`
SHA256	`8cc419e3d94632c3efa88b7f1a6641fc679b73657db993da5e52f9edace6680b 🔍`
SHA3	`066fad0d91578c2be03f3a20e6bc9b0616dfa10f0fa1fd4ce6f593b91052ab88 🔍`
VirtualSize	`0x8`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.16299`

.pdata

MD5	`34037b8eb1952f676df4b0d70f4a206e 🔍`
SHA1	`71f374f2945765791440fecbfdc7ba44a902e516 🔍`
SHA256	`5ff14fd6a357c96ceb79a29eb61d4470946e4338fc406506e011f024e1c3d10b 🔍`
SHA3	`c866e53ed02248e0d8045cbb24703b179e27234b30e0c9e474225792fac103d5 🔍`
VirtualSize	`0x1d4`
VirtualAddress	`0x7000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.42047`

.xdata

MD5	`fb2f5b321af122b4f36d2245322ce87c 🔍`
SHA1	`fe841b0503e8fbb7320680667d3a2f1eb9e46e57 🔍`
SHA256	`6ce173445317da90095aadd44db7debbdecd13e87b9443b29b0c33235bc68fa9 🔍`
SHA3	`9c5dd82bce9c3c9bf3518b10facdf9e6b3cc5224d6b47fad1ddd7b84261728ee 🔍`
VirtualSize	`0x134`
VirtualAddress	`0x8000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.56479`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x108`
VirtualAddress	`0x9000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.edata

MD5	`953c1a3164604ea0b466a8e0be868b93 🔍`
SHA1	`23f62c4880439a0eca1427eb45025f66ebffe3ff 🔍`
SHA256	`13d5a1f282f3d055a1f12e28178e9d5a27e71398a8c0cee56122c8ce2863e301 🔍`
SHA3	`60b1d05a415aed49ce015e3ed8cf8fbf97dc1a3bcff4d550ddfae99a67d1501b 🔍`
VirtualSize	`0x53`
VirtualAddress	`0xa000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.933326`

.idata

MD5	`0c403ad2a587846710b8a2d143bffe22 🔍`
SHA1	`9df3b6fd2bd3189a690c87a2d3f2837725043595 🔍`
SHA256	`7939ef3b3e6167d4afe2f621829e26203f1dec304756d6a5753f16bd761e050c 🔍`
SHA3	`a157922d68409a96ac41db5b63e77d28f3bb24dc3afd69a131c3b352ea46a176 🔍`
VirtualSize	`0x78c`
VirtualAddress	`0xb000`
SizeOfRawData	`0x800`
PointerToRawData	`0x3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.79202`

.rsrc

MD5	`302acf3589069dafe3806c6220e3778b 🔍`
SHA1	`89ae0eacdebfc43deab4cb09c7e84d7f266fdec0 🔍`
SHA256	`91a02ce157d9b9ae69686e10fc629dfcced946eb53eed88a2b7e7428039a8469 🔍`
SHA3	`c2215f2de8e1c5459ceb6d6f9510402babe325bec528362126120011af934b51 🔍`
VirtualSize	`0x4e8`
VirtualAddress	`0xc000`
SizeOfRawData	`0x600`
PointerToRawData	`0x3800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.77848`

.reloc

MD5	`d491d80163064f16d5b0a9da4fbacd40 🔍`
SHA1	`e56dca3017078ed6769065ba715e2bf5fc8ad4df 🔍`
SHA256	`4988abaa255c0cc6479d767ddf7ce9045d9753b71c23d2309d545391f9f5048f 🔍`
SHA3	`08bc635e36518ca2a3ef74f781f348f445556219b210a0a905d92a04e30c42ea 🔍`
VirtualSize	`0x48`
VirtualAddress	`0xd000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.886906`

Imports

KERNEL32.dll	`GetLastError` `SetConsoleCP` `SetConsoleOutputCP` `SetUnhandledExceptionFilter` `Sleep` `VirtualProtect` `VirtualQuery`
api-ms-win-crt-environment-l1-1-0.dll	`__p__environ`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `malloc`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-private-l1-1-0.dll	`memcpy`
api-ms-win-crt-runtime-l1-1-0.dll	`__p___argc` `__p___argv` `_cexit` `_configure_narrow_argv` `_crt_atexit` `_exit` `_initialize_narrow_environment` `_seh_filter_exe` `_initterm` `_initterm_e` `_set_app_type` `_set_invalid_parameter_handler` `abort` `exit`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `fflush` `puts` `setvbuf`
api-ms-win-crt-string-l1-1-0.dll	`strlen` `strncmp`

Delayed Imports

_wor1d!}

Ordinal	`1`
Address	`0x14e0`

1

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x48f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.13793`
MD5	`5aa04ce935e78505e230765e85c34355 🔍`
SHA1	`6c93b8c5fde8be4b2231dca6b8ec513cdc82c991 🔍`
SHA256	`a73f26a8d504043f785d7360e8febf2eeb8522ec873a0d4dd5d1d4bfd1e67d3d 🔍`
SHA3	`149467cafc03ba34b33cd8076fc2771413760822357952de205dbae2b5cb8059 🔍`

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.