6bf864d78758b19d855291bf6e9425de87b3971bd19780707399b2da228045ab

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jun-09 19:21:16
Detected languages English - Canada
English - United Kingdom
English - United States
CompanyName 1nonlywrld
FileDescription Exitlag Loader
FileVersion 1.0.0.1
InternalName loader.exe
LegalCopyright Copyright (C) 2026
OriginalFilename loader.exe
ProductName ExitlagLoader
ProductVersion 1.0.0.1

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • schtask
 Contains domain names:
  • discord.com
  • https://discord.com
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Malicious The PE contains functions mostly used by malware. Code injection capabilities:
  • WriteProcessMemory
  • OpenProcess
  • VirtualAllocEx
  • CreateRemoteThread
 Possibly launches other programs:
  • system
 Uses Microsoft's cryptographic API:
  • CryptReleaseContext
  • CryptGenRandom
  • CryptAcquireContextW
 Functions related to the privilege level:
  • CheckTokenMembership
  • OpenProcessToken
 Manipulates other processes:
  • WriteProcessMemory
  • OpenProcess
Suspicious The PE is possibly a dropper. Resources amount for 85.0583% of the executable.
Malicious VirusTotal score: 8/69 (Scanned on 2026-07-19 03:58:47) APEX: Malicious
Bkav: W32.Malware.1F915A63
CrowdStrike: win/malicious_confidence_60% (D)
Elastic: malicious (high confidence)
MaxSecure: Trojan.Malware.8328611.susgen
Symantec: ML.Attribute.HighConfidence
Trapmine: suspicious.low.ml.score
TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101FS26YX

Hashes

MD5 fe58b8562534a02c4fb479f646e71e28
SHA1 2c876ae15d44cbbbea540174d1a872e11966bf4d
SHA256 6bf864d78758b19d855291bf6e9425de87b3971bd19780707399b2da228045ab
SHA3 783a341fe1b2982faa8ca7e4320a199d406261ea53cc52e7046dd73bc1ab6e81
SSDeep 3072:kP5WfGOMiRwUM4WOKHsEM9GvMWbNPZYC1zN6zFq5i:kPkfGWi49KHi6tZN
Imports Hash 3a32bb98ecb82e74443055614ef0e7b0

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jun-09 19:21:16
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xb600
SizeOfInitializedData 0x71200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000B3D0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x80000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4e8b0bab466118876b602c816dd0bb06
SHA1 0a3b8d60345e681b76d3530c9e9c3c3480e8c261
SHA256 207aeb619c530ae5ffcce6dcfe03c25423993eff311a429a144c99ae87ba45fa
SHA3 5a8369f1425f2fc6e0c9bdcb39e1bbfed3adbaec31103f30b9b47e4fddb79584
VirtualSize 0xb466
VirtualAddress 0x1000
SizeOfRawData 0xb600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.20932

.rdata

MD5 57bdf903177f89f14821566726887d1b
SHA1 294d6ddbf80fdabb8bf920f1e71e2954dbd009bd
SHA256 6c12613bfc2a1303f478d9b7819b06f30735e1efe9df4410cd1fde7933cf32a8
SHA3 80da9d4eaba3818270d2eea746741fe0f70c22319e61a89c7c90140bc90bb688
VirtualSize 0x5f18
VirtualAddress 0xd000
SizeOfRawData 0x6000
PointerToRawData 0xba00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.2264

.data

MD5 4ca8d4861d7782241428230bdcd3495d
SHA1 f3e4ebecb3da63c4fb4cbed6d921a6b5a7bd8367
SHA256 6b75063099f297f544009cb72612e2deeb290f423379b223a6d52614b8bc26df
SHA3 9b2a01402042882a69e65c93468da4cef9f180b4fff08515db749cd593c84732
VirtualSize 0x790
VirtualAddress 0x13000
SizeOfRawData 0x200
PointerToRawData 0x11a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.19231

.pdata

MD5 6188e6f6b91af77f2dc676f29ea93e3f
SHA1 b2c6c20d4d83555a47d805c88c888caff5071cc2
SHA256 15c38cd2f6e3b6e46cc73f52b0102d9f436d8e627843e6a60f62b95d2a2548e1
SHA3 155a7eda08b33f45b847a0643fcb1adb6113157c2e95855f5c3713549572db2f
VirtualSize 0x684
VirtualAddress 0x14000
SizeOfRawData 0x800
PointerToRawData 0x11c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.06259

.rsrc

MD5 6573bc9fa01a4c8694442f2c6d41be0a
SHA1 11b8f36573fdaae7d427fdc94a628352cd61bf71
SHA256 f8872c69d0c75085c78e603b11949ccd3bd6788050ca9c4e5b27e5021f46d2f3
SHA3 0e4f9a57f54d83c71706c9ecbfcc15c7fcfc8cdddad1c812b95c897399ee39c9
VirtualSize 0x69f60
VirtualAddress 0x15000
SizeOfRawData 0x6a000
PointerToRawData 0x12400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.00979

.reloc

MD5 fc45fb38e33e7494788730c85c256a0a
SHA1 81e283867bdfae87ed512b9602b1aafa4cc6df76
SHA256 d69827601595a1e4efec7e9d34db1124eabbc9026765043718f173e5e3628f4e
SHA3 a02eee70991c144d38778536e2c884c3679c597b7712e9e945fc6e4075b436d5
VirtualSize 0x6c
VirtualAddress 0x7f000
SizeOfRawData 0x200
PointerToRawData 0x7c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.31345

Imports

ADVAPI32.dll GetTokenInformation
CryptReleaseContext
CheckTokenMembership
FreeSid
OpenProcessToken
AllocateAndInitializeSid
CryptGenRandom
CryptAcquireContextW
KERNEL32.dll FillConsoleOutputCharacterA
FindFirstFileW
WriteProcessMemory
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
EnterCriticalSection
FindNextFileW
GetCurrentProcess
SetConsoleScreenBufferSize
GetStdHandle
WriteConsoleA
WriteFile
RemoveDirectoryW
GetModuleFileNameW
SetConsoleWindowInfo
GetProcessId
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
ReadFile
GetModuleHandleA
OpenProcess
MultiByteToWideChar
Sleep
GlobalAlloc
DeleteFileW
CloseHandle
CreateThread
K32EnumProcesses
FillConsoleOutputAttribute
GetProcAddress
GlobalLock
VirtualAllocEx
GetFileSize
DeleteCriticalSection
WideCharToMultiByte
GetConsoleWindow
CreateRemoteThread
QueryFullProcessImageNameW
VirtualFreeEx
SetConsoleCursorPosition
GlobalUnlock
RtlLookupFunctionEntry
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
CreateDirectoryW
ReadConsoleA
IsProcessorFeaturePresent
TerminateProcess
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
USER32.dll CloseClipboard
EmptyClipboard
OpenClipboard
ShowWindow
SetClipboardData
SetForegroundWindow
BringWindowToTop
COMDLG32.dll GetOpenFileNameW
SHELL32.dll ShellExecuteExW
MSVCP140.dll ?_Xlength_error@std@@YAXPEBD@Z
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll __std_exception_copy
__current_exception_context
__current_exception
__std_exception_destroy
_CxxThrowException
__C_specific_handler
memset
memcpy
memcmp
memmove
wcsrchr
api-ms-win-crt-runtime-l1-1-0.dll _cexit
_initialize_onexit_table
_register_onexit_function
_c_exit
terminate
_wsystem
system
__p___argv
_invoke_watson
_seh_filter_exe
_crt_atexit
__p___argc
_set_app_type
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0.dll _wcsicmp
strcmp
api-ms-win-crt-heap-l1-1-0.dll _callnewh
malloc
free
_set_new_mode
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.28685
MD5 e399a23b12b290d7334270f7fa0922a4
SHA1 e87dce8d12633e537efa7540625452820c8bcc7a
SHA256 0b77607cd29ab180030ee0ddc0e23334eeb890369c91c46a8b6b75a68057144b
SHA3 5391ee2695eebf4fdcf07313ebb9e399865d139001a536b26a1d0f37ec272dfa

2

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.68689
MD5 9a70ca1330cbcc7931a625993f669c46
SHA1 c263e8f22080760f002439bcba6ad6329e03a6d7
SHA256 04a0317c4f171fa4fced38116e67873b080e86a8e034378a3cc7f08f90ca0b7a
SHA3 cdeb22da74f37c332297cee13680c9f5927b28c21a65017e1018cb0f0b9b7ef2

3

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.1899
MD5 0d55f4964b390ce88073025125cd9142
SHA1 6a1cdd41f73352de68fa40a23b3f02e3ce244476
SHA256 1a5a5e742640e502f078bf365126724f9a0e97152edb8464b0e12ee223fa1f9f
SHA3 e2a222d48b7a7973f46ee4b346752089fd8d0062d36208714af92d70c7e728bf

4

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72562
MD5 0e6ad237190f751b40173313e4829859
SHA1 cace26a83424ae1f85a5fc92f8694388e06644d1
SHA256 c1b56399c559d20fbc46d2557869e4f6c05a244fc881291ba2a51dfbd2c1f96b
SHA3 323b2bd679236a0ec8546de5ad7b3906f4eda98488e81283eff6525b8f5c4e7a

5

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.51983
MD5 8df70bba47c340a03c4748c84429014c
SHA1 d919511c84a4cdec5c9ef3baa28866cc51e74d2e
SHA256 40560fad525c3074de82fd126134b9064398f7c6cfdd7840b4eea33c07b8968a
SHA3 bd3f0595486f9d3df174e3a62dfc85a9a35928677b5351831f26ac06263d2117

6

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.38805
MD5 4ce4f22b920f85a2351d5715761640b2
SHA1 4395dfce1c7c6e3bee84cc822b31261df34563a5
SHA256 9a4237857c4ef11d5462fb8ebbd1c6e047fcb0a2567702f97bac8f225f4fa567
SHA3 77e2ae5b3115f22c13e6830199e1dcadc0b2d2cc45418ad147bf9d885b6e09f1

7

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.23668
MD5 e3335f8f9a91d2f4021b157de27dd344
SHA1 305cbbcae94067e52bb23596dc2904f4788fc824
SHA256 be511a01269c61d705ce166f6fca542aefd301f0c37eb788d8d7c2e6a7caaf1e
SHA3 45aed49e3fdd7f5d6c129bed00cfc9b99776e51f19cfee12dd315a61125255d8

8

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.09496
MD5 89177db544625fb1daa0ddbd6dc5770c
SHA1 223bd3f08669cb6ebbbc867e1d8d17b27a3c371d
SHA256 2ac74982287f75f7c8110a799ed1f014d29c6bf9099dcb7332503f642b815f24
SHA3 be682207a09a99d4c506bb4aeb3fe7757deb53b6bffd827e3a456665d352a03b

9

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.77442
MD5 8ceb61d9b7ffe02daec63beeda4074d9
SHA1 e2cdb073064bab557e014c904b858a1e36068158
SHA256 ca67e51d398ff3b40cc5a63dafa7ea415cc00a53d9c67e4c0c3ae352fb876835
SHA3 7c765b9a2110f879fe412f0d4d0c30739a7b7fbbb338abf6a107aef7ed84c419

101

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01226
Detected Filetype Icon file
MD5 8bd3cd6b83e995093febc060ec76aeb3
SHA1 b0338c581ad2beceda2bccbaa46d96383d3dc4a1
SHA256 4f16960f06a3608a7d49573795526ff6790c65d8015f0419d72a373e55ed8ac7
SHA3 dab5ecc0662f74eef0913882133480a1e4285be23cab87b03392d82bdce0c981

1 (#2)

Type RT_VERSION
Language English - United Kingdom
Codepage UNKNOWN
Size 0x2c0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31284
MD5 8f21d5627f878493724f43eff6e256dc
SHA1 ef028af97478bb8c92f253d17541f194c1bfefb1
SHA256 a34df347220e30915d652a805916019afc75984591e4d420c8251d9fe819d1a5
SHA3 3daf55066240027cb5ba9d1f00787e0de9ed3b39fac1fd72591ea87e421a6d8d

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.1
ProductVersion 1.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - Canada
CompanyName 1nonlywrld
FileDescription Exitlag Loader
FileVersion (#2) 1.0.0.1
InternalName loader.exe
LegalCopyright Copyright (C) 2026
OriginalFilename loader.exe
ProductName ExitlagLoader
ProductVersion (#2) 1.0.0.1
Resource LangID English - United Kingdom

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jun-09 19:21:16
Version 0.0
SizeofData 720
AddressOfRawData 0x10ce4
PointerToRawData 0xf6e4

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Jun-09 19:21:16
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140013040

RICH Header

XOR Key 0x65d5bc0a
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 12
ASM objects (35207) 3
C objects (35207) 10
C++ objects (35207) 27
Imports (35207) 6
Imports (33145) 11
Total imports 131
C++ objects (LTCG) (35224) 1
Resource objects (35224) 1
151 1
Linker (35224) 1

Errors

Leave a comment

No comments yet.