8044a3b136d36f24792d35d2250ee01452a0c226292c3f56a9a95071f6121839

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jul-12 18:33:44

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • OpenProcessToken
 Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 6937645 bytes of data starting at offset 0x6d600.
The overlay data has an entropy of 7.99801 and is possibly compressed or encrypted.
Overlay data amounts for 93.9342% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 1d01703a2085b406edc5845dbba4314f
SHA1 cae79c97ad1d8cc9f81e18e4d45f91458f9778e7
SHA256 8044a3b136d36f24792d35d2250ee01452a0c226292c3f56a9a95071f6121839
SHA3 7832e000fa95bafc9cbbea6062c170c7b5d3e43c5030bc41a6e92f2881b2a63a
SSDeep 196608:UHGiiFCnGCxdGjP5Gi2bjKVPy2wESLEQNwuCppAX:UH7KCnGCnGjMi2bjRoSLEkwZAX
Imports Hash cf72283be50852e418ce6bbb6b645835

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Jul-12 18:33:44
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2c800
SizeOfInitializedData 0x40a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000E120 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x75000
SizeOfHeaders 0x400
Checksum 0x7115f7
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 48a32f2799dcfc38ff2750f0f1c91fea
SHA1 66a3df6e9d5017665b3b238265e2dbca4e2f1bd9
SHA256 44a770d56fd506f83cae4ec6e37416d1911e031023bbc988a14e9a3dd282f38b
SHA3 230d8cd0f32a09386c82c5fdb3e512045513a88b20cc49b2ab60a4c31a652853
VirtualSize 0x2c640
VirtualAddress 0x1000
SizeOfRawData 0x2c800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46933

.rdata

MD5 9823e009a77c7c297c859d69316c4582
SHA1 97a80ec88f9eef0df0b2786899c9eeeb3742c2d2
SHA256 f9c4b84e7856a9f0fcba9451820761d85641dde1967e1d24f8517af4ffe1d490
SHA3 129e975aa60b786f3bb358d6191ec046b229a4d9fe18ac49f251c4fac9c383ff
VirtualSize 0x13d88
VirtualAddress 0x2e000
SizeOfRawData 0x13e00
PointerToRawData 0x2cc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.75197

.data

MD5 1a88d7a279d8f01a28b7ac98b485d559
SHA1 699d878e81fd42dfd5e39af72e6185648d37f99f
SHA256 3c0be4458afc91ce9d156b915e5df3f562412355374810ae9f7cfdfbeeb382a8
SHA3 478ecf20a5f50e7cdf77dbd7698c62339487b0ceb012f18e65bc6cf5874df9b5
VirtualSize 0x4af0
VirtualAddress 0x42000
SizeOfRawData 0xe00
PointerToRawData 0x40a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.8161

.pdata

MD5 6e00a3eb06fb1389c11bee0a7ed2ac4e
SHA1 becf794311be30c9d14fb2d8c28d502f7f4d6f25
SHA256 2b3271b92b45d3dc1f38c7c38ba3525641e201f71109c040b2e35ebd6848854b
SHA3 32084748a04458ef6a3bc63f033b6acb1817d8e8a011b4a4b1c0384dff93714f
VirtualSize 0x255c
VirtualAddress 0x47000
SizeOfRawData 0x2600
PointerToRawData 0x41800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.47011

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x100
VirtualAddress 0x4a000
SizeOfRawData 0x200
PointerToRawData 0x43e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 f743da99ae34285f23440b1f8f181c1f
SHA1 aa696d2e0b6ef95b0bf05a9061e24c3ed0626daa
SHA256 20f921e7990196127926ec7234859a4113e897f672e5d06909d79bf32b66a52c
SHA3 9f09ea49ce9d4b4ea5f730cad9b6cce3a89bb0b1dae4afcd06131b6c9fec4a7a
VirtualSize 0x28d15
VirtualAddress 0x4b000
SizeOfRawData 0x28e00
PointerToRawData 0x44000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.22482

.reloc

MD5 3ef11c94152a720d31f16a54908f30ee
SHA1 09b769842c32b72c13acbddb42917846c54cf8ff
SHA256 db40e1b51393756109b208cc78e5238a569a23b2809c459c7eee818ce70c9df2
SHA3 aede5975917d03f8177161d1fec522c097ddbb1c84e8a997033f0fa6cf0aa9c8
VirtualSize 0x768
VirtualAddress 0x74000
SizeOfRawData 0x800
PointerToRawData 0x6ce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.24535

Imports

USER32.dll CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
ADVAPI32.dll OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.54034
MD5 c29a714044bfef77eb7279741300531d
SHA1 c27266bbadd7b44a2cfe4409da277424160fd858
SHA256 a434f8956b7224c9fa33568cb43e2ee2decc0a1c00b7283f80c0e9dce27e873e
SHA3 3bc9b231ec1215a2b221ea3840fbc61598736a5202d99a40e325531a74d7f8b3

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.38139
MD5 6170e89ac6b7d6d826e0f92156e4f438
SHA1 3dafe0038a2cee9abb7265022c4d31b7778b1dcf
SHA256 02aa4ae517be70924896e50d8351076b5cd7cad228533c18d090adc404607d77
SHA3 84d42d0c0510cbb47421e8cdf5611cc45e01af9da151540b0a65b3d6d7c56bf3

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.21601
MD5 fec3584bff34b0a019a22180267c0af0
SHA1 f612fd91226174d8d2e23cce3db6d85f15f73d4d
SHA256 6a5f41f29d8a8a48e7eb949c4c9033a8525deba96f3fa91fab1210b2e3bc6bb4
SHA3 cbfcd99abad1f9c087c7736c15e71dbf7162fbd02fba164aa26c6f4902eb74eb

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.927393
MD5 58d8769ca68b8f737550767e2a08ee67
SHA1 0cd7d0468cfe51003cf3dd0e4868f8061c1b012e
SHA256 628491f65948855584f4df7ae0040b39f5a0a2fc4ca9cebdf5ccd43e9d2be6cb
SHA3 aadd64e4056f6810e4ae1344ad10dcc426ee53e3bc46cc640c694dfeef22ed79

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.86772
MD5 e54cce1fff4c5b55a88a9ea12ad62b49
SHA1 d7122c3c960046a44e23e6c8476a45bf7d23fe70
SHA256 1d2080e9ee16715a1cf6b8368a120f6f3800fa6261627e47b1900b58ca0afa0a
SHA3 42088a414ed584fdc1e1f97192f84de1d5763fdd48bafce0f7b0c0f7529233fc

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.895655
MD5 9d7a4cfb9781a2b28b1e938081f93178
SHA1 b1f92eb70faf7baa9dea5ff18b229f5fc430286b
SHA256 27e87cabd1745dcd4870da32ffb5fd28ebc0afc481009e45f3bbc68bbf2b216f
SHA3 de2c3ff4c35311da80d85f5ff6c91fe58e1b2e4e5c48b35dab7d6d6c8009f540

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.821174
MD5 7632ea20b5e9c0e6404287ea0de1b7ba
SHA1 581d1159d3d787e3b07349c76362987c751c6ea3
SHA256 ec12f3d71b467b52838d51fd9ba3e19d370fa632c67fc127bd52e958991f59b3
SHA3 d68a2f1f507958a1a5e2d8b79adb8b05f8dd4f3b59de6decd99fe870cfac94dd

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.765771
MD5 8d29e07bf4d611d6e589da20da5b033c
SHA1 a73f002b4124d713266399b4bcb1a22e3445a477
SHA256 83cc7fbff773e0a9bf95ab5cf4f088ef2b467b19d661184d4ea9ee1fb746cb83
SHA3 203e90e42f07b437dd5a55e33e9ebc98040e8fc388721d71734c969a3966ea76

9

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xd5b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.73387
Detected Filetype PNG graphic file
MD5 92ab249081d33615cb2e638354097367
SHA1 8327499e08121ab4b254622e6c76a1d0c726b4c5
SHA256 d2bd570d81fd92f3824750695dea7c5168d107e3246d9a9b71303e94836350f7
SHA3 ce444f63f4ebf252c22722f6e5e0e8c15410bd0694631cfb0db22982458fcc33

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03466
Detected Filetype Icon file
MD5 205eb6a27a16ea916c7c8f8690531af8
SHA1 a242d9ce52d5343be19ff6b8611288577deed6e2
SHA256 b4956d818471882af09f5a67bf8477633d00d39ddd4a93dc395fb7621d556fd7
SHA3 31530c0f3281c8e6b986f292c1242ebb6469e15a7955e3b5046cc33792232343

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x50d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25791
MD5 84da8dee6b319ea0b10b6de5489c6aae
SHA1 5f8991f3e065fd95614859a293f88b9c70e4bb23
SHA256 abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11
SHA3 08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jul-12 18:33:44
Version 0.0
SizeofData 816
AddressOfRawData 0x3e0b8
PointerToRawData 0x3ccb8

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140042040
GuardCFCheckFunctionPointer 5368898736
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x1ffff8b2
Unmarked objects 0
C++ objects (33145) 183
C objects (33145) 12
ASM objects (33145) 11
253 (35721) 3
ASM objects (35721) 9
C objects (35721) 17
C++ objects (35721) 39
Imports (33145) 11
Total imports 158
C objects (36246) 29
Linker (36246) 1

Errors

Leave a comment

No comments yet.