7657e4c00de35f5272eec5b8d513b36b4e0767bb941668aa37677f3f9a3d4162

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Oct-31 09:15:24
Detected languages Chinese - PRC
English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • Normal.xyz
  • Vertex.xyz
  • color.xyz
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryExW
Reads the contents of the clipboard:
  • GetClipboardData
Suspicious VirusTotal score: 1/69 (Scanned on 2026-10-03 07:38:15) APEX: Malicious

Hashes

MD5 2a11a99e9722eecfbed888e31d73d707 🔍
SHA1 4e191d5a3ad73929c5f523c4f9a6ac347a0fd25d 🔍
SHA256 7657e4c00de35f5272eec5b8d513b36b4e0767bb941668aa37677f3f9a3d4162 🔍
SHA3 9d872c900cf59ac835f7114a240557e539ae15517d72aa5eb09f1df7aae5cd84 🔍
SSDeep 49152:aDhllnXDwz1ZHJoEn3CmcKmcoq/0qAOkFqKTtdqw:y/gjmKQq/WpR 🔍
Imports Hash 37521311375be933263c5295120fe8b7 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x128

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2025-Oct-31 09:15:24
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x26f800
SizeOfInitializedData 0x180a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000022C674 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3f5000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 fe364f42137247af481a0a9b374ccd71 🔍
SHA1 32940c690ea6437ba7f227c28eec0ab678641ce8 🔍
SHA256 6e01e2fdee500cd8af3b8f3e77ee54946d66c8935b8852f96af67db36573a4a6 🔍
SHA3 097824393966c8bf1207cda2c588289073c0ad57d976e83febeccf1156a87eb8 🔍
VirtualSize 0x26f610
VirtualAddress 0x1000
SizeOfRawData 0x26f800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50441

.rdata

MD5 1f52ad56d6cfef287efa4ef12d43c327 🔍
SHA1 d456dfe445f69e69eeb00c8f2adb391b2952e9c5 🔍
SHA256 bbcc24f54cc925d4b321cb86d688b4e48e995135ac0380a74716ff30ac87eee3 🔍
SHA3 89ba4f98a3ab794941fd4e6b961135fece05d571141f0c72e37cbfb142dfba04 🔍
VirtualSize 0xf3d14
VirtualAddress 0x271000
SizeOfRawData 0xf3e00
PointerToRawData 0x26fc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.15789

.data

MD5 9819927bf8464f2f7692c0748f05ebe0 🔍
SHA1 1e9fb8dc4625eb70148040a00f815501c20708f5 🔍
SHA256 db9078a780e595c4d6b0b4bbee15015a5b091b0a10533994e395f00672bfee3f 🔍
SHA3 ca99e0979088040e9bb00e94678e1b4f9246934f7691bfc0dc90a5d1ea144f87 🔍
VirtualSize 0x12d60
VirtualAddress 0x365000
SizeOfRawData 0xf000
PointerToRawData 0x363a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.03217

.pdata

MD5 f9d7e79bd84492f8b7a9f3954fcb532b 🔍
SHA1 e6208005d5b88377318fbc1eb353ef965fd4687a 🔍
SHA256 17485e00ce4e0f1aefd3314edec0144d3e57850f18a8cfd5a8a355b7ec76001f 🔍
SHA3 7630d581301a1d8ed30b81d79fc20f27f7896bfb2269cadf0d8cd8b42d1ea6f3 🔍
VirtualSize 0x19b78
VirtualAddress 0x378000
SizeOfRawData 0x19c00
PointerToRawData 0x372a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.31005

_RDATA

MD5 4dc6d5af19dfd5423ae10eef2964aa75 🔍
SHA1 2b9b65237bbd8e43f909888a4e4710e84127ea71 🔍
SHA256 3dd22c381f96c43467b586a67435b0434fae067d85116ec66c3186f34ec1c465 🔍
SHA3 017ca14bbb05a8cd6deac7aba1b3ee6a1c28939297b3f492ee5e7d96e446614a 🔍
VirtualSize 0xf4
VirtualAddress 0x392000
SizeOfRawData 0x200
PointerToRawData 0x38c600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.42558

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x393000
SizeOfRawData 0x200
PointerToRawData 0x38c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 1d321313e419231b205bdb05b4388dbf 🔍
SHA1 9b17daf9247a79234809c1d0c45cbf7c4f1cffcf 🔍
SHA256 83430f52f828fd3c7927036557c84579490a67338de96ef8b0b0ef34efb676aa 🔍
SHA3 0582e857ef55fd6dc38c239806c0d3d3d69a238f549260605b778757d243a9e6 🔍
VirtualSize 0x5a8f0
VirtualAddress 0x394000
SizeOfRawData 0x5aa00
PointerToRawData 0x38ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.17061

.reloc

MD5 328b053a05e696730ad0e19d1caf0746 🔍
SHA1 bc5d82251dd9aac96902c301028f6e8516a1d2bc 🔍
SHA256 b740ef0240e2f3888013fc19bef64ce33ee112f41405ec5fc122cd224ea32447 🔍
SHA3 c237dc2f5d864088de66e8312e4a1b0456862821f8873eb4d536ecca18e44075 🔍
VirtualSize 0x533c
VirtualAddress 0x3ef000
SizeOfRawData 0x5400
PointerToRawData 0x3e7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.44748

Imports

WINMM.dll timeBeginPeriod
timeEndPeriod
KERNEL32.dll GetLastError
QueryPerformanceFrequency
GlobalAlloc
LoadLibraryW
GetProcAddress
GlobalLock
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
QueryPerformanceCounter
GlobalUnlock
MoveFileW
ExitProcess
CreateFileW
ReadFile
WriteFile
CloseHandle
TlsAlloc
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetACP
IsValidCodePage
FindFirstFileExW
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
GetFileSizeEx
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
VirtualProtect
HeapFree
HeapAlloc
GetFileType
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetCommandLineW
GetCommandLineA
GetStdHandle
GetFileAttributesW
FindClose
GetModuleFileNameW
FindNextFileW
SetEndOfFile
FindFirstFileW
WriteConsoleW
GetOEMCP
TlsSetValue
GetModuleHandleExW
RtlUnwind
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
TlsGetValue
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
LoadLibraryExW
TlsFree
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
USER32.dll GetCursorPos
ReleaseDC
DefWindowProcW
AdjustWindowRectEx
GetKeyState
GetWindowRect
DestroyWindow
GetDC
MessageBoxW
SetWindowLongPtrW
CreateWindowExW
ScreenToClient
UnregisterClassW
GetWindowLongPtrW
RegisterClassExW
ShowWindow
OpenClipboard
GetCapture
DispatchMessageW
ClientToScreen
CloseClipboard
EmptyClipboard
PeekMessageW
TrackMouseEvent
MoveWindow
TranslateMessage
GetClipboardData
LoadIconW
LoadCursorW
SetCapture
SetClipboardData
SetCursor
GetClientRect
IsClipboardFormatAvailable
PostQuitMessage
SetProcessDPIAware
ReleaseCapture
SetForegroundWindow
GDI32.dll ChoosePixelFormat
CreateSolidBrush
SwapBuffers
SetPixelFormat
GetPixel
COMDLG32.dll GetSaveFileNameW
GetOpenFileNameW
SHELL32.dll DragAcceptFiles
SHFileOperationW
DragFinish
DragQueryFileW
OPENGL32.dll glGetError
glGetString
glTexSubImage2D
glDepthFunc
glPixelStorei
wglMakeCurrent
glPushMatrix
glDisable
glMultMatrixf
glClearDepth
glScalef
glGetTexImage
glColor3ubv
glColorPointer
glColor4ub
glFlush
glRasterPos2i
glTexImage2D
glTranslatef
wglDeleteContext
glDrawArrays
glClearColor
glTexCoordPointer
glBegin
glReadBuffer
glDeleteTextures
glColor4ubv
glFinish
glTexParameteri
glVertex3fv
wglGetProcAddress
glColorMask
wglCreateContext
glReadPixels
glBlendFunc
glLineWidth
glFrontFace
glMatrixMode
glDisableClientState
glEnd
glLoadMatrixf
glDepthMask
glVertex3f
glEnable
glVertexPointer
glGenTextures
glBindTexture
glTexSubImage1D
wglShareLists
glPolygonOffset
glClear
glEnableClientState
glTexImage1D
glViewport
glPopMatrix
glNormal3fv
glColor3fv
glPointSize
glGetIntegerv
glLoadIdentity
glNormalPointer
VCOMP140.DLL _vcomp_fork
_vcomp_reduction_i4
_vcomp_for_static_end
_vcomp_for_static_simple_init

Delayed Imports

1

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.32941
MD5 ca0274e7af5a9a741e745adc6e1a50e6 🔍
SHA1 df0ac56958f3c087a0df3652bc5cc51c21f93425 🔍
SHA256 25773844cf7d6ee83660bad673221ace0569f8347d835e412558c2496eb5cbb7 🔍
SHA3 9d19556d9a8048da9a372e3087b9da7710e30ffeb4829c8417877584896c1c76 🔍

2

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.79388
MD5 82deb475ee3df81bf4214781857bcb81 🔍
SHA1 6004be511799c0b7cf9e58b38a410b8d6cb8ad20 🔍
SHA256 ba367220032432613205936a45b1fe612806dd4b039d32d4f6fc62f0aece9c9f 🔍
SHA3 0b827ababf6180d52910395252bc15ebc505ecb2cc369ed94ba283507844baff 🔍

3

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.45152
MD5 9cf51cfcb0262eba54719c3be92d0372 🔍
SHA1 9834a0f8e2394865f339424a9dae2871c048fc48 🔍
SHA256 44fc956137ee068efdfba6bc6ba4eb1d319deea6f89cd56bc8a066cff13f8a56 🔍
SHA3 aa48f60c854f056850dbb92f0b18a31a962e34dd27d1edec4a70c9cbe3776777 🔍

4

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.44338
MD5 f6c9cd2b7614a90748a6b455683f0825 🔍
SHA1 f5bc96b60c87d02a8e16d2b79341e6e4ef23c1c5 🔍
SHA256 43cd6d773cb23f32c19488ff464af9d172e7d198a45e421af22fbdfa77739843 🔍
SHA3 818535661cb7c80f19d811b68570cc7ca84f4f15b2df04febb0326490ee0aee1 🔍

5

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.20841
MD5 8a61b288b084e096d19c11d93f0ff409 🔍
SHA1 ea4927fd22a3443d071fe1229a7cfbe61877645b 🔍
SHA256 c7db7c59ea3cd0d710659be23ebb6373fbb491e14dfdbf3950c5abb56caa1edb 🔍
SHA3 fb1601653252799327475f4264292c6557f76f297fe873101f354188b0ae5b8f 🔍

6

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.07927
MD5 c26f1532e7b06e8cc5aeed5643e9d1a8 🔍
SHA1 13261463a8e7fced45f560db8b7ac0195668c7b6 🔍
SHA256 a0711d96e31213877e29e093ed4224c072fee6ad17ae7ec59150b04275c68b5e 🔍
SHA3 885764620e6995802a0edbd3658ab3ef0dd53bdc7b2ed1e4140cd22e65bcd744 🔍

101

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.76511
Detected Filetype Icon file
MD5 61e58469fe660c213ebc6e2cc66cbafc 🔍
SHA1 c47479da87d8390f935b337e91bdbedcc739b3eb 🔍
SHA256 c369bebe3271775e43301281caa7efcd03938e3bc1f620212d6c5617edaad403 🔍
SHA3 7c04647ad931cbf1b5c005cebc686d11b461a50e14ba9aa560e6cc1749adcb2f 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Oct-31 09:15:24
Version 0.0
SizeofData 1048
AddressOfRawData 0x3373d8
PointerToRawData 0x335fd8

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2025-Oct-31 09:15:24
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x140337838
EndAddressOfRawData 0x140337840
AddressOfIndex 0x14037506c
AddressOfCallbacks 0x140271928
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140365240

RICH Header

XOR Key 0x30b475c9
Unmarked objects 0
C++ objects (33140) 188
C objects (33140) 39
ASM objects (33140) 29
Unmarked objects (#2) 1
Imports (30034) 2
253 (28518) 1
C objects (30034) 18
ASM objects (30034) 13
C++ objects (30034) 91
Imports (33140) 15
Total imports 272
C objects (VS2019 Update 11 (16.11.14-15) compiler 30145) 27
C objects (VS2022 Update 2 (17.2.5-6) compiler 31332) 45
C++ objects (LTCG) (VS2019 Update 11 (16.11.14-15) compiler 30145) 45
Resource objects (VS2019 Update 11 (16.11.14-15) compiler 30145) 1
151 1
Linker (VS2019 Update 11 (16.11.14-15) compiler 30145) 1

Errors

Leave a comment

No comments yet.