82d73a645dafd501fe483f8fdb66ca006c12dbb16363b4f62647033f0df4c617

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Mar-18 17:41:49
Comments
CompanyName
FileDescription
FileVersion 1.0.0.0
InternalName day.exe
LegalCopyright Copyright © 2022
LegalTrademarks
OriginalFilename day.exe
ProductName
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
MASM/TASM - sig1(h)
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • %TEMP%
  • CurrentControlSet\Services
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • 2010-aia.verisign.com
  • 2010-crl.verisign.com
  • Battle.net
  • Sysinternals.com
  • Systinternals.com
  • aia.verisign.com
  • crl.microsoft.com
  • crl.verisign.com
  • csc3-2010-aia.verisign.com
  • csc3-2010-crl.verisign.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
  • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
  • http://crl.verisign.com
  • http://crl.verisign.com/pca3-g5.crl04
  • http://csc3-2010-aia.verisign.com
  • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
  • http://csc3-2010-crl.verisign.com
  • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
  • http://logo.verisign.com
  • http://logo.verisign.com/vslogo.gif04
  • http://ocsp.verisign.com0
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/winfx/2006/xaml
  • http://schemas.microsoft.com/winfx/2006/xaml/presentation
  • http://www.microsoft.com
  • http://www.microsoft.com/PKI/docs/CPS/default.htm0
  • http://www.microsoft.com/exporting
  • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
  • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
  • http://www.microsoft.com/pkiops/Docs/Repository.htm0
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crt0
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crl0
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0
  • http://www.sysinternals.com
  • https://www.sysinternals.com0
  • https://www.verisign.com
  • https://www.verisign.com/cps0
  • https://www.verisign.com/rpa
  • https://www.verisign.com/rpa0
  • logo.verisign.com
  • microsoft.com
  • schemas.microsoft.com
  • sysinternals.com
  • technet.microsoft.com
  • verisign.com
  • www.microsoft.com
  • www.sysinternals.com
  • www.verisign.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Suspicious The PE is possibly packed. The PE only has 0 import(s).
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 4a904e4aed94a0a64a9e08fc0590e99d
SHA1 926f098c687f47f7c05c4752ab420fa4cf6bb011
SHA256 82d73a645dafd501fe483f8fdb66ca006c12dbb16363b4f62647033f0df4c617
SHA3 bff92ddfd469d26f7c0688b4a2b48f477800d6a549715f538252f425de8304cb
SSDeep 49152:+I+t28QZOT1/sSBLztH5KaMW9nTYYvtPcdnebRes0Ev873M4o384wydvELqTAKz:+Jh/sSBLztVX7vtUetes6m/haLhCnOP
Imports Hash d41d8cd98f00b204e9800998ecf8427e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 2
TimeDateStamp 2026-Mar-18 17:41:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 6.0
SizeOfCode 0x5a9c00
SizeOfInitializedData 0x10e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000000000 (Section: ?)
BaseOfCode 0x2000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x5be000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x400000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x2000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 78102d0f02155cde0104cd7133992f92
SHA1 c46df4025b418f29a0d3aacd0522b72963cc8b8a
SHA256 10c7cdf7db3f75704d5939da6485485412d19f19d026fe02c4a38b24121744f1
SHA3 3dc6d332a13fbc8370d536516aab8203e5556bed57f4b1d529b68eac7bef4bf4
VirtualSize 0x5a9a50
VirtualAddress 0x2000
SizeOfRawData 0x5a9c00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.21868

.rsrc

MD5 5d99bfa14946e27973766966083f0789
SHA1 c703e371292749495b66d202092abceb91f403d5
SHA256 c8f9f648e1633670dc581b69b45c5ac243bd67f72fcfaed2dea5cb87f4ede769
SHA3 b92dda06f652e2c5c3ebaa3901786502a6100fa2afc6ec69445b93d2387c7bde
VirtualSize 0x10c08
VirtualAddress 0x5ac000
SizeOfRawData 0x10e00
PointerToRawData 0x5a9e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.32752

Imports

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.29245
MD5 cfbe17ba05c8d8c63435b9b040215f69
SHA1 18f140a2daad2a5ba7b4cc16704ff36c16bce16f
SHA256 d396a45b32a724e14a800d205f75c0bd00af52c2246bb39d2086b5796a8d59c0
SHA3 e07d4ff4880b69229ebe728165b1b0a719830a60967fe519575d50735f508580

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.98048
Detected Filetype Icon file
MD5 38388dda6548693f4d42f2241a4218d7
SHA1 78bedd12a20f97e31e58742381f3d0ca1edb4715
SHA256 cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba
SHA3 9ace1e9f008d60580379cdfdcd4119706c82d52d2e5fdb9e5745fa00864cc1a8

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x2e4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.19946
MD5 8379f9bc63c92744d2f68a9251649e17
SHA1 930e76ffd137038bd51feb11120a965bb3e99f85
SHA256 2575c8799947a3798477adad81abf1b8f27ff5c5499bb2f9c7ab8d3f2affe3ad
SHA3 15fdbd1b2fc01a0529bc335c4f3198b5200f56f22a08919e050559cdf65ed889

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription
FileVersion (#2) 1.0.0.0
InternalName day.exe
LegalCopyright Copyright © 2022
LegalTrademarks
OriginalFilename day.exe
ProductName
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.