Manalyze report for 7e169261b7fed815439bd3f18cccedde97625ee88c552505b547cbb4ba6e6d68

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Apr-02 17:42:55
Detected languages	English - United States

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig1(h)`
Suspicious	PEiD Signature:	`UPolyX V0.1 -> Delikon`
Info	Interesting strings found in the binary:	`Contains domain names: github.com https://github.com https://scripts.sil.org https://scripts.sil.org/OFLThis https://scripts.sil.org/OFLhttps https://www.lexend.comBonnie scripts.sil.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot FindWindowA` `Uses functions commonly found in keyloggers: GetForegroundWindow GetAsyncKeyState` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect` `Can take screenshots: GetDC FindWindowA` `Reads the contents of the clipboard: GetClipboardData`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`8d707dfd2e5e040e7d948daebad21acb`
SHA1	`cf8036469d79f504a66ce197e50e75a898360fee`
SHA256	`7e169261b7fed815439bd3f18cccedde97625ee88c552505b547cbb4ba6e6d68`
SHA3	`8227f37e9dc8b93bc2534736a4ad6530c91d55a66b014d689606c3ffa912e337`
SSDeep	`12288:qgWU5MLNcJwmQld5NHIuMdw/2FSNMeNZNjnK9Ex6FjYWwVn++RRWcydzARJ1P7Y:LWHI3SNMejaYLVn++mtdzARzP`
Imports Hash	`511292d41b7ce28f3dfb1b64e78b257d`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x100`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Apr-02 17:42:55
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x6e200`
SizeOfInitializedData	`0x3fa00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000000000006B64C (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x180000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0xb2000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`ebc78235d6e3b32179268f5855296836`
SHA1	`4cf29a357613e004aadcdfc03d7a62f26f1bd894`
SHA256	`e04bb06b33df910ecf7191fbbb3947f67a5680cbb4340f62e9a7721e45315999`
SHA3	`f04253b4425bc0ea3a2daa0b92a01cd3135b4ed5a636645cf062280b5c434871`
VirtualSize	`0x6e033`
VirtualAddress	`0x1000`
SizeOfRawData	`0x6e200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.51921`

.rdata

MD5	`a59917c4abe5f5216705b01470431507`
SHA1	`b1b3b7acfe30b08dc76ea3fe1bd0e0f36111d24f`
SHA256	`807ba8e842b9567ab11ae4db3299eab63ee21fba1c42cd4a2618697b8d0901be`
SHA3	`dd9bbbe109b79015359fe366f4f3e9af3ae77f05c13f562d888a9d21eefbb752`
VirtualSize	`0x10ba4`
VirtualAddress	`0x70000`
SizeOfRawData	`0x10c00`
PointerToRawData	`0x6e600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.20642`

.data

MD5	`51ce966f2096be732c29f9f609919a77`
SHA1	`730fdd907fb2582090044402ad57424fe71813c9`
SHA256	`860ccd66c299d8831c03df6c28285eb604515cbdd2d59ac521f607468024cec0`
SHA3	`7582b88f64aad6533edc2a2ec6bc31cf39a73ffe53627f1f629efe3c225ddc51`
VirtualSize	`0x29cb0`
VirtualAddress	`0x81000`
SizeOfRawData	`0x28800`
PointerToRawData	`0x7f200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.15695`

.pdata

MD5	`5f7fde49eb7ee45aad8ac90231c3a34c`
SHA1	`007d47fa35109c74b147efdd798f7092f08b3d50`
SHA256	`50922f7fbd81f56d94139be4bea2b83529a3c21acf2af6929c97bc995e059907`
SHA3	`2b6cbfdb6df9503f3f43beac8a5519ab8b8daa0824523338e703a342a304b428`
VirtualSize	`0x4644`
VirtualAddress	`0xab000`
SizeOfRawData	`0x4800`
PointerToRawData	`0xa7a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.79182`

.rsrc

MD5	`f7b48f04eabeadec244d681290166017`
SHA1	`de4b87e137fddc18efc978e1c85051a7c56f0b86`
SHA256	`a6f0686382081d3d3f33dd3b4739f692d1bb84a3651bd491d24200e8f35517b8`
SHA3	`c16318f01bb5ce46aa17297e556f004f7ae3812ac8d1eef10ac80240cb8acf31`
VirtualSize	`0x1e0`
VirtualAddress	`0xb0000`
SizeOfRawData	`0x200`
PointerToRawData	`0xac200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.70855`

.reloc

MD5	`f65726f69c184c0dd605f55f1f7b4428`
SHA1	`73824deb04569dafe97512d36876cdf16c254b3c`
SHA256	`a2d78690ef546f01e486fd0860314b41e8939997aa03214aa24208ddddb1af7c`
SHA3	`7bd26c337a76de183799df0c55a07d97386caa870cf8119b29a519aeccb9e2a2`
VirtualSize	`0x424`
VirtualAddress	`0xb1000`
SizeOfRawData	`0x600`
PointerToRawData	`0xac400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`4.43184`

Imports

d3d11.dll	`D3D11CreateDeviceAndSwapChain`
D3DCOMPILER_47.dll	`D3DCompile`
KERNEL32.dll	`GetProcAddress` `GetTickCount` `GlobalAlloc` `GlobalUnlock` `GlobalLock` `GlobalFree` `MultiByteToWideChar` `WideCharToMultiByte` `FreeLibrary` `LoadLibraryA` `GetLocaleInfoA` `GetSystemInfo` `VirtualAlloc` `VirtualFree` `VirtualQuery` `HeapCreate` `HeapDestroy` `HeapAlloc` `HeapReAlloc` `HeapFree` `GetCurrentProcess` `GetCurrentProcessId` `QueryPerformanceFrequency` `OpenThread` `SuspendThread` `ResumeThread` `GetThreadContext` `SetThreadContext` `FlushInstructionCache` `VirtualProtect` `CreateToolhelp32Snapshot` `Thread32First` `Thread32Next` `TerminateProcess` `IsProcessorFeaturePresent` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `IsDebuggerPresent` `RtlVirtualUnwind` `RtlLookupFunctionEntry` `RtlCaptureContext` `SleepConditionVariableSRW` `WakeAllConditionVariable` `AcquireSRWLockExclusive` `ReleaseSRWLockExclusive` `GetModuleHandleA` `QueryPerformanceCounter` `FreeLibraryAndExitThread` `InitializeSListHead` `DisableThreadLibraryCalls` `CreateThread` `Sleep` `CloseHandle` `GetSystemTimeAsFileTime` `GetCurrentThreadId`
USER32.dll	`IsWindowUnicode` `GetForegroundWindow` `SetCursorPos` `ClientToScreen` `ScreenToClient` `ReleaseCapture` `GetClientRect` `EmptyClipboard` `GetClipboardData` `SetClipboardData` `CloseClipboard` `OpenClipboard` `SetCapture` `GetCapture` `GetKeyState` `GetMessageExtraInfo` `TrackMouseEvent` `GetCursorPos` `GetDC` `LoadCursorA` `SetWindowLongPtrW` `ClipCursor` `GetKeyboardLayout` `MessageBoxA` `FindWindowA` `GetAsyncKeyState` `SendInput` `DestroyWindow` `CreateWindowExA` `RegisterClassExA` `UnregisterClassA` `CallWindowProcW` `DefWindowProcA` `SetCursor`
GDI32.dll	`GetPixel`
MSVCP140.dll	`?_Throw_Cpp_error@std@@YAXH@Z` `_Mtx_unlock` `_Mtx_lock` `?_Xlength_error@std@@YAXPEBD@Z`
IMM32.dll	`ImmGetContext` `ImmSetCompositionWindow` `ImmSetCandidateWindow` `ImmReleaseContext`
VCRUNTIME140.dll	`__std_terminate` `memmove` `__current_exception` `__current_exception_context` `__std_type_info_destroy_list` `memchr` `memset` `memcmp` `__std_exception_copy` `strstr` `memcpy` `__C_specific_handler` `_CxxThrowException` `__std_exception_destroy`
VCRUNTIME140_1.dll	`__CxxFrameHandler4`
api-ms-win-crt-runtime-l1-1-0.dll	`_execute_onexit_table` `terminate` `_initterm` `_initterm_e` `_cexit` `_crt_atexit` `_invalid_parameter_noinfo_noreturn` `_seh_filter_dll` `_configure_narrow_argv` `_initialize_narrow_environment` `_initialize_onexit_table` `_register_onexit_function`
api-ms-win-crt-string-l1-1-0.dll	`tolower` `strcpy_s` `strncpy` `strcmp` `strncmp` `strncpy_s`
api-ms-win-crt-math-l1-1-0.dll	`sqrtf` `ceilf` `pow` `logf` `log` `atan2f` `acosf` `powf` `fmodf` `cosf` `sinf`
api-ms-win-crt-stdio-l1-1-0.dll	`__stdio_common_vsprintf` `__stdio_common_vfprintf` `fwrite` `ftell` `fseek` `_wfopen` `__stdio_common_vsscanf` `__stdio_common_vsprintf_s` `fread` `__acrt_iob_func` `fflush` `fclose`
api-ms-win-crt-convert-l1-1-0.dll	`atof`
api-ms-win-crt-heap-l1-1-0.dll	`_callnewh` `malloc` `free`
api-ms-win-crt-utility-l1-1-0.dll	`qsort`

Delayed Imports

2

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Apr-02 17:42:55
Version	`0.0`
SizeofData	`832`
AddressOfRawData	`0x77e7c`
PointerToRawData	`0x7647c`

TLS Callbacks

StartAddressOfRawData	`0x1800781e0`
EndAddressOfRawData	`0x1800781e8`
AddressOfIndex	`0x1800aa6f8`
AddressOfCallbacks	`0x180070780`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1800a9500`

RICH Header

XOR Key	`0x71616992`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`14`
ASM objects (33731)	`4`
C objects (33731)	`8`
C++ objects (33731)	`21`
Imports (33731)	`6`
Imports (33145)	`15`
Total imports	`179`
C++ objects (33821)	`12`
C objects (33821)	`5`
Resource objects (33821)	`1`
Linker (33821)	`1`

Errors

Leave a comment

No comments yet.