Manalyzer :: 840a067e8672c50fedaa2d2e86d5e545084c8a4d75c735c326e135ca3bca5289

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2024-May-24 02:48:32

Plugin Output

Suspicious	The PE is possibly packed.	`The PE only has 1 import(s).`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`181ecc8263b27a02d05135310a59badb` 🔍
SHA1	`46bff3bb79248e9fdd46b5bf5524b31686088f57` 🔍
SHA256	`840a067e8672c50fedaa2d2e86d5e545084c8a4d75c735c326e135ca3bca5289` 🔍
SHA3	`733aa8dbbbf69e9fa8efac379f67bafcd2a0c771cf89db1b76cfd072329c94c6` 🔍
SSDeep	`6:yuC2IuE0wli715vrVH9/8Ju0/ufDl6lArl:VC2IfspH9/8JpmfB` 🔍
Imports Hash	`27abfd9cfda7519d5efb3f08a2a4f3ce` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0`
e_cp	`0`
e_crlc	`0`
e_cparhdr	`0`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`3`
TimeDateStamp	2024-May-24 02:48:32
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`0.0`
SizeOfCode	`0x200`
SizeOfInitializedData	`0x400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000001000 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x4000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`8344b2f617928265f3e44ba9587e2e01 🔍`
SHA1	`b648db35d0e685c5158fa9e282861ab1ab7cdd7a 🔍`
SHA256	`288b2c1c55998f55d9ee4f911e7be3b92bee65a1fc072d13a7834ffd832c9ba3 🔍`
SHA3	`127bab1bab46e037d66fec335ca2bcd8b4bfebc7fdfe88a605111416ee5245ee 🔍`
VirtualSize	`0x20`
VirtualAddress	`0x1000`
SizeOfRawData	`0x200`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`0.374631`

.rdata

MD5	`5e7e0724f41fb204a62245508cd0a783 🔍`
SHA1	`7a275f2217325647f32d598f1c9cd975e196ac00 🔍`
SHA256	`5f81ec266af2f8a8cc29d3185fd30273812a8d4f268f06af7903cec64af621b2 🔍`
SHA3	`c63ce00fa696e6d740f005986e21f38fdd22484c8ea8db39d0db6481a4b3dc2f 🔍`
VirtualSize	`0x200`
VirtualAddress	`0x2000`
SizeOfRawData	`0x200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.651906`

.data

MD5	`ed797710ab75cef924f78c32cc555bc1 🔍`
SHA1	`9f7e9511fc33271e7650af3ee2096c9079bca5d5 🔍`
SHA256	`9ed79129e40ad5b5a73d896cb139ea85ab38a825679842e286d918c344c46ab7 🔍`
SHA3	`c15bfae45724943368b565805adebdf5fc72138601ee9d45df33b99e4dbc2619 🔍`
VirtualSize	`0x93`
VirtualAddress	`0x3000`
SizeOfRawData	`0x200`
PointerToRawData	`0x600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.25875`

Imports

KERNEL32.dll	`GetTickCount`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.