| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Apr-23 08:17:57 |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
attack_01_dll_injection.pdb
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Apr-23 08:17:57 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x21a00 |
| SizeOfInitializedData | 0xfe00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000020AB0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x35000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetLastError
GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent GetProcAddress CreateRemoteThread WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteProcessMemory VirtualAllocEx CloseHandle VirtualFreeEx GetSystemTimeAsFileTime |
|---|---|
| api-ms-win-core-synch-l1-2-0.dll |
WakeByAddressAll
WakeByAddressSingle WaitOnAddress |
| KERNEL32.dll |
UnhandledExceptionFilter
InitializeSListHead RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId QueryPerformanceCounter SetUnhandledExceptionFilter GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFileInformationByHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW CreateFileW GetFinalPathNameByHandleW GetConsoleMode GetFullPathNameW GetModuleHandleA GetModuleFileNameW FormatMessageW HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep |
| ntdll.dll |
RtlNtStatusToDosError
NtWriteFile |
| VCRUNTIME140.dll |
__current_exception
__C_specific_handler _CxxThrowException memcmp memmove memcpy __CxxFrameHandler3 memset __current_exception_context |
| api-ms-win-crt-runtime-l1-1-0.dll |
__p___argc
_crt_atexit exit terminate _initterm_e _register_onexit_function _c_exit _initialize_onexit_table __p___argv _initterm _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _seh_filter_exe _set_app_type _exit _configure_narrow_argv _initialize_narrow_environment _cexit |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
__p__commode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
free
_set_new_mode |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-23 08:17:57 |
| Version | 0.0 |
| SizeofData | 52 |
| AddressOfRawData | 0x2a8fc |
| PointerToRawData | 0x296fc |
| Referenced File | attack_01_dll_injection.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-23 08:17:57 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x2a930 |
| PointerToRawData | 0x29730 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-23 08:17:57 |
| Version | 0.0 |
| SizeofData | 816 |
| AddressOfRawData | 0x2a944 |
| PointerToRawData | 0x29744 |
| StartAddressOfRawData | 0x14002ac98 |
|---|---|
| EndAddressOfRawData | 0x14002acf0 |
| AddressOfIndex | 0x140031268 |
| AddressOfCallbacks | 0x1400233c8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x000000014000CB90
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140031100 |
| XOR Key | 0x9d8e0c72 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 12 |
| Imports (35207) | 2 |
| ASM objects (35207) | 3 |
| C objects (35207) | 9 |
| C++ objects (35207) | 23 |
| Imports (33145) | 9 |
| Total imports | 190 |
| Unmarked objects (#2) | 90 |
| Linker (35222) | 1 |
No comments yet.