81b9fb1f7b224d1dded8a588aada3dae
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Nov-01 06:50:32 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\Users\HOPE\Desktop\JCB\SLIBIO\Hopmon\Win32\build\x64-Release\Hopmon.pdb
|
| CompanyName | HopanaTech |
| FileDescription | Hopmon |
| FileVersion | 23.10.3 |
| InternalName | Hopmon.exe |
| LegalCopyright | Copyright (C) 2023 |
| OriginalFilename | Hopmon.exe |
| ProductName | Hopmon |
| ProductVersion | 23.10.3 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/69 (Scanned on 2024-11-07 00:45:12) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x130 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2023-Nov-01 06:50:32 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2e1a00 |
| SizeOfInitializedData | 0x2e1c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000027D2BC (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x5c8000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Imports
| KERNEL32.dll |
MoveFileExW
SetEvent ResetEvent WaitForSingleObjectEx CreateEventW ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW GetOverlappedResult GetLocaleInfoA GetUserDefaultLCID VerSetConditionMask FreeLibrary GetProcAddress LoadLibraryW GlobalAlloc VerifyVersionInfoW SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime CreateMutexW OpenMutexW GetSystemTime CreateThread SetThreadPriority GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree LocalAlloc PostQueuedCompletionStatus MultiByteToWideChar WideCharToMultiByte ExitProcess GetCurrentProcess OutputDebugStringW WriteFile GetStdHandle WriteConsoleW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetACP CopyFileW FindFirstFileExW EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW GetExitCodeProcess DeviceIoControl GetFileAttributesExW SetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode GetFileType GetModuleHandleExW SetConsoleCtrlHandler LoadLibraryExW RtlUnwind RtlPcToFileHeader RtlUnwindEx HeapReAlloc RaiseException GetVersion GetModuleFileNameA ReleaseMutex GetProcessHeap HeapFree HeapAlloc CreateFileA LoadLibraryA GetSystemDirectoryA InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionAndSpinCount GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer InitializeCriticalSectionEx IsValidCodePage TerminateProcess GetCurrentProcessId WaitForSingleObject CreatePipe SetHandleInformation FormatMessageW GetCommandLineW LocalFree GetModuleFileNameW GetSystemDirectoryW GetTickCount SwitchToThread Sleep QueryPerformanceFrequency QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter GetTempPathW SetEnvironmentVariableW DeleteCriticalSection TryEnterCriticalSection SetFilePointerEx SetFileAttributesW SetEndOfFile ReadFile GetFullPathNameW GetFileTime GetFileSizeEx FlushFileBuffers FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW CreateProcessW GetProcessAffinityMask CompareStringW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GlobalLock GlobalUnlock GlobalSize GetLastError GetFileAttributesW GetModuleHandleW OpenProcess GetCurrentThreadId CloseHandle GetOEMCP |
|---|---|
| USER32.dll |
InsertMenuItemW
SetMenuItemInfoW GetAncestor IsIconic CreateIconIndirect SetLayeredWindowAttributes IsZoomed GetMenu SetMenu SetWindowRgn RedrawWindow AdjustWindowRectEx SetWindowLongPtrW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW SetMenuInfo TrackPopupMenuEx RemoveMenu DestroyMenu DestroyWindow SetWindowPos ReleaseCapture GetSystemMetrics GetForegroundWindow GetDC ReleaseDC SetWindowTextW GetWindowTextW GetDesktopWindow GetWindowLongW SetWindowLongW FindWindowW GetWindowThreadProcessId LoadCursorW LoadIconW DestroyIcon SetScrollInfo GetScrollInfo SetDlgItemTextW GetActiveWindow MessageBoxW TrackMouseEvent GetMessagePos GetMessageTime IsWindow UpdateLayeredWindow ShowWindowAsync IsWindowVisible BringWindowToTop SetFocus GetFocus MapVirtualKeyW GetCapture SetCapture EnableWindow IsWindowEnabled BeginPaint EndPaint InvalidateRect GetClientRect GetWindowRect GetCursorPos ClientToScreen ScreenToClient GetWindow MonitorFromWindow PeekMessageW UnregisterClassW GetWindowLongPtrW GetRawInputData RegisterRawInputDevices GetSysColor SetParent SetCursor DestroyCursor GetKeyState SetForegroundWindow EnumDisplaySettingsW GetMonitorInfoW EnumDisplayMonitors GetWindowTextLengthW CreateWindowExW CreateMenu CreatePopupMenu RegisterClassExW |
| GDI32.dll |
SetTextColor
SetBkMode SetBkColor CreateSolidBrush CreateRoundRectRgn CreateEllipticRgn CreateDIBSection CreateBitmap GetDeviceCaps CreateDCW BitBlt EnumFontFamiliesExW CreateFontW StretchDIBits SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap |
| COMDLG32.dll |
GetOpenFileNameW
GetSaveFileNameW |
| ADVAPI32.dll |
SetServiceStatus
RegCloseKey FreeSid CheckTokenMembership AllocateAndInitializeSid CryptGenRandom CryptReleaseContext CryptAcquireContextW GetUserNameW RegEnumValueW RegOpenKeyExW RegSetValueExW ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx StartServiceW ImpersonateNamedPipeClient InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCreateKeyExW RegQueryInfoKeyW RegQueryValueExW RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegDeleteValueW RegOpenKeyExA RegQueryValueExA OpenServiceA QueryServiceStatus |
| SHELL32.dll |
ShellExecuteExA
SHGetPathFromIDListW SHGetMalloc SHBrowseForFolderW ShellExecuteExW Shell_NotifyIconW SHGetFolderPathW DragQueryFileW |
| ole32.dll |
CoTaskMemFree
OleDuplicateData CoInitializeEx ReleaseStgMedium DoDragDrop RevokeDragDrop RegisterDragDrop OleInitialize CoCreateInstance CoUninitialize CoInitialize |
| COMCTL32.dll |
#413
InitCommonControlsEx #410 |
| VERSION.dll |
GetFileVersionInfoSizeW
VerQueryValueW GetFileVersionInfoW |
| WS2_32.dll |
freeaddrinfo
htonl WSAStartup WSAGetLastError htons ntohs WSACleanup ntohl inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname WSASetLastError getprotobyname |
| SETUPAPI.dll |
SetupCopyOEMInfW
|
| gdiplus.dll |
GdipSetPenColor
GdipGetPenColor GdipGetPenFillType GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetSmoothingMode GdipSetInterpolationMode GdipSetWorldTransform GdipTranslateWorldTransform GdipGetWorldTransform GdipDrawLine GdipDrawLines GdipDrawArc GdipDrawRectangle GdipDrawEllipse GdipDrawPie GdipDrawPolygon GdipDrawPath GdipFillRectangle GdipFillPolygon GdipFillEllipse GdipFillPie GdipFillPath GdipDrawImageRectRect GdipSetClipRect GdipSetClipPath GdipGetClipBounds GdipSaveGraphics GdipRestoreGraphics GdipDrawString GdipAddPathEllipse GdipCreateTexture GdipCreateLineBrush GdipSetPenLineCap197819 GdipSetLineWrapMode GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterPoint GdipGetPathGradientPointCount GdipSetPathGradientPresetBlend GdipSetPenMiterLimit GdipSetPenDashStyle GdipSetPathFillMode GdipStartPathFigure GdipClosePathFigure GdipAddPathLine GdipAddPathBezier GdipGetCellAscent GdipGetEmHeight GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipGraphicsClear GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipAlloc GdipSetPenLineJoin GdipDeletePen GdipClonePen GdipCreatePen1 GdipGetSolidFillColor GdipSetSolidFillColor GdipCreateSolidFill GdipGetBrushType GdipDeleteBrush GdipCloneBrush GdipGetMatrixElements GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipWidenPath GdipAddPathString GdipDeletePath GdipClonePath GdipCreatePath GdiplusStartup GdipCreateBitmapFromHBITMAP GdipGetCellDescent GdipGetImageWidth GdipGetStringFormatFlags GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipGetFontSize GdipGetFontStyle GdipDeleteFont GdipGetFamily GdipCreateFont GdipSetLinePresetBlend GdipGetLineSpacing GdipGetImageHeight |
| IPHLPAPI.DLL |
GetAdaptersAddresses
|
| SHLWAPI.dll |
PathFileExistsA
|
Delayed Imports
1
2
3
4
5
6
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 23.10.3.0 |
| ProductVersion | 23.10.3.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | HopanaTech |
| FileDescription | Hopmon |
| FileVersion (#2) | 23.10.3 |
| InternalName | Hopmon.exe |
| LegalCopyright | Copyright (C) 2023 |
| OriginalFilename | Hopmon.exe |
| ProductName | Hopmon |
| ProductVersion (#2) | 23.10.3 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Nov-01 06:50:32 |
| Version | 0.0 |
| SizeofData | 99 |
| AddressOfRawData | 0x3a1d04 |
| PointerToRawData | 0x3a0b04 |
| Referenced File | C:\Users\HOPE\Desktop\JCB\SLIBIO\Hopmon\Win32\build\x64-Release\Hopmon.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Nov-01 06:50:32 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x3a1d68 |
| PointerToRawData | 0x3a0b68 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Nov-01 06:50:32 |
| Version | 0.0 |
| SizeofData | 1008 |
| AddressOfRawData | 0x3a1d7c |
| PointerToRawData | 0x3a0b7c |
IMAGE_DEBUG_TYPE_ILTCG
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Nov-01 06:50:32 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
| StartAddressOfRawData | 0x1403a2190 |
|---|---|
| EndAddressOfRawData | 0x1403a2198 |
| AddressOfIndex | 0x1404d8810 |
| AddressOfCallbacks | 0x1402e4808 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1403e9f60 |
RICH Header
| XOR Key | 0x1b9a90ce |
|---|---|
| Unmarked objects | 0 |
| ASM objects (27412) | 33 |
| C++ objects (27412) | 204 |
| 253 (28518) | 5 |
| C objects (30034) | 19 |
| ASM objects (30034) | 12 |
| C++ objects (30034) | 78 |
| C objects (27412) | 46 |
| C objects (CVTCIL) (27412) | 1 |
| Imports (27412) | 29 |
| Total imports | 537 |
| C++ objects (30151) | 220 |
| C objects (30151) | 21 |
| C++ objects (LTCG) (30151) | 36 |
| Resource objects (30151) | 1 |
| 151 | 1 |
| Linker (30151) | 1 |