7f16d3cec237d492ece5ddda3a38a854

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Jan-10 01:02:59

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • qeMu
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Functions related to the privilege level:
  • OpenProcessToken
Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 18795788 bytes of data starting at offset 0x51a00.
The overlay data has an entropy of 7.99813 and is possibly compressed or encrypted.
Overlay data amounts for 98.2523% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 7f16d3cec237d492ece5ddda3a38a854
SHA1 0866ada152e5664865f8b448cf153b78d9d41e08
SHA256 4f760b4a89618547a1aca0073de1a719028efa86a8e8da46c02c0d6ab50f07c0
SHA3 bedae851b25f62f709eaf5e7ade8a0bf6176631ab5cae48ac2a581bb599249b4
SSDeep 393216:WXUoJ1V2SW8077z1+TtIiFYUzG5ZKSpIau504NsIinPw2TzWyCVc5YpoiG:WX7jW80L1QtIxUzYF450DIkwG/5Y
Imports Hash 72c4e339b7af8ab1ed2eb3821c98713a

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Jan-10 01:02:59
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2a000
SizeOfInitializedData 0x27600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000CE20 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x59000
SizeOfHeaders 0x400
Checksum 0x124c49b
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b8c3814c5fb0b18492ad4ec2ffe0830a
SHA1 418be033195bda8b6dc47678c496ae7b9230f361
SHA256 a35bef23a039b57da0c2a013766a48d28706b2eb5cb3448edd27f50bc13225d8
SHA3 1009eacd73a65dc8b1503e240a04c33afeb171f1fe4feab42b84444837d7c482
VirtualSize 0x29f70
VirtualAddress 0x1000
SizeOfRawData 0x2a000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48921

.rdata

MD5 b10a58d6a5113e20f075aa7114aa706c
SHA1 f550739ae5d941d5a16d636d0dc7334eb26faecd
SHA256 90d980ee9741d5ee7088b5a3fb4648a95bdf37c303192541f072fea69131ff4f
SHA3 4637578c26eb5ded18541351223fe294626aa4d1c65bab7c3b91e0c340309012
VirtualSize 0x12a28
VirtualAddress 0x2b000
SizeOfRawData 0x12c00
PointerToRawData 0x2a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.75078

.data

MD5 dba0caeecab624a0ccc0d577241601d1
SHA1 069fd3959f91e690643115a296bf21044144de01
SHA256 17a374764a97598eeb35b9f9e96bad505b780b2a64a325822e5c002f7fdc1966
SHA3 6f4a62f5b3771451f1409b76e8ad2c44d754c804580f1209eff1f5a96fb6decd
VirtualSize 0x53f8
VirtualAddress 0x3e000
SizeOfRawData 0xe00
PointerToRawData 0x3d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.83922

.pdata

MD5 9cd1eac931545f28ab09329f8bfce843
SHA1 bdd10338a6f9f29e6c03bfb8c9296cc1dd35a204
SHA256 4d142e809bfe10b33c8e078519f136d2ea034f7810794404d73a9ca00ee31b3c
SHA3 788479b1bc0db9cbefb1481a27965184c1b3e1970d607c8c41d3064bee247cc9
VirtualSize 0x2238
VirtualAddress 0x44000
SizeOfRawData 0x2400
PointerToRawData 0x3de00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.26452

.rsrc

MD5 83fd7d3b49f7ea1344c272073c3cacdf
SHA1 c0f0c2c84718ab1bef7fe84e736cdfa13f37e86e
SHA256 cf44ee08685b4ca8f4654a5c320430867e4af257f48b03cb808231f57ad0cac6
SHA3 ab85d24797ab22aa3b542ecdfd32886945e80712142ad56029d6710a19230f31
VirtualSize 0x10e34
VirtualAddress 0x47000
SizeOfRawData 0x11000
PointerToRawData 0x40200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.02441

.reloc

MD5 816c68eeb419ee2c08656c31c06a0fff
SHA1 d73caf6099972c4407ac22954a7454e922084dc0
SHA256 b6f0828ba5501d261d26c59b0f79c32c6638d04e3c645417a5fa7e400a5016af
SHA3 62d280821f21ecb72eb7058070711484d2bae903b66ceb7cdbbf8f2b3bde274a
VirtualSize 0x764
VirtualAddress 0x58000
SizeOfRawData 0x800
PointerToRawData 0x51200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.28095

Imports

USER32.dll CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
FlsFree
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsSetValue
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
ADVAPI32.dll OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.743131
MD5 1f359dc9d66f6f51e48acca5245ea6d0
SHA1 a1ab885f5f12334b384a4df58676ef2b3b807e23
SHA256 ff2196bf7a4e75d76e1cc1e16848ed977d0ea24f76748534063be373e8e61b9b
SHA3 b1950225d3f9b7db1d943d5d1f802ac7780e4a74777660885619cc186b113074

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.98048
Detected Filetype Icon file
MD5 38388dda6548693f4d42f2241a4218d7
SHA1 78bedd12a20f97e31e58742381f3d0ca1edb4715
SHA256 cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba
SHA3 9ace1e9f008d60580379cdfdcd4119706c82d52d2e5fdb9e5745fa00864cc1a8

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Jan-10 01:02:59
Version 0.0
SizeofData 796
AddressOfRawData 0x3a474
PointerToRawData 0x39874

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003e040
GuardCFCheckFunctionPointer 5368886432
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x60fe5c30
Unmarked objects 0
ASM objects (30795) 7
C++ objects (30795) 180
C objects (30795) 10
253 (33808) 3
ASM objects (33808) 9
C objects (33808) 17
C++ objects (33808) 40
Imports (30795) 11
Total imports 155
C objects (34123) 25
Linker (34123) 1

Errors

<-- -->