| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Aug-17 22:40:54 |
| Detected languages |
English - United States
|
| TLS Callbacks | 5 callback(s) detected. |
| Debug artifacts |
D:\a\_work\e\src\out\Release_x64\initialexe\msedge.exe.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Edge |
| FileVersion | 116.0.1938.54 |
| InternalName | msedge_exe |
| LegalCopyright | Copyright Microsoft Corporation. All rights reserved. |
| OriginalFilename | msedge.exe |
| ProductName | Microsoft Edge |
| ProductVersion | 116.0.1938.54 |
| CompanyShortName | Microsoft |
| ProductShortName | Microsoft Edge |
| LastChange | e584466f74bf872ad84fcd188ddc4b60fd2ec646 |
| Official Build | 1 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .gxfg
Unusual section name found: .retplne Unusual section name found: CPADinfo Unusual section name found: LZMADEC Unusual section name found: malloc_h |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Microsoft Corporation
Issuer: Microsoft Code Signing PCA 2011 |
| Safe | VirusTotal score: 0/71 (Scanned on 2023-08-23 22:47:53) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 14 |
| TimeDateStamp | 2023-Aug-17 22:40:54 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2bb400 |
| SizeOfInitializedData | 0x12da00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000015EAB0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x403000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x3ed87e |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| msedge_elf.dll |
GetInstallDetailsPayload
IsBrowserProcess IsExtensionPointDisableSet SignalChromeElf SignalInitializeCrashReporting |
|---|---|
| KERNEL32.dll |
AcquireSRWLockExclusive
AssignProcessToJobObject CancelIo CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DebugBreak DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessHeaps GetProcessId GetProcessMitigationPolicy GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemWow64DirectoryW GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetUserDefaultUILanguage GetUserGeoID GetVersionExW GetWindowsDirectoryW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32GetPerformanceInfo K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA PeekNamedPipe PostQueuedCompletionStatus PrefetchVirtualMemory Process32FirstW Process32NextW QueryDosDeviceW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetDefaultDllDirectories SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessMitigationPolicy SetProcessShutdownParameters SetStdHandle SetThreadAffinityMask SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory lstrlenA |
| ntdll.dll |
RtlInitUnicodeString
|
| ADVAPI32.dll (delay-loaded) |
AccessCheck
AddMandatoryAce AdjustTokenPrivileges BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW CheckTokenMembership CloseServiceHandle ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW CreateProcessWithTokenW CreateRestrictedToken CreateWellKnownSid CryptAcquireContextW CryptGenRandom CryptReleaseContext DuplicateTokenEx EnumServicesStatusExW EqualSid EventRegister EventSetInformation EventUnregister EventWrite EventWriteTransfer FreeSid GetAce GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo GetTokenInformation ImpersonateNamedPipeClient InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken OpenSCManagerW OpenThreadToken RegCloseKey RegCreateKeyExW RegDeleteValueW RegDisablePredefinedCache RegGetValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036 |
| Attributes | 0x1 |
|---|---|
| Name | ADVAPI32.dll |
| ModuleHandle | 0x33e798 |
| DelayImportAddressTable | 0x33e818 |
| DelayImportNameTable | 0x31bc28 |
| BoundDelayImportTable | 0 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
| Ordinal | 1 |
|---|---|
| Address | 0xa2fe0 |
| Ordinal | 2 |
|---|---|
| Address | 0x1d7e80 |
| Ordinal | 3 |
|---|---|
| Address | 0xa5b00 |
| Ordinal | 4 |
|---|---|
| Address | 0x1db2f0 |
| Ordinal | 5 |
|---|---|
| Address | 0x1e1430 |
| Ordinal | 6 |
|---|---|
| Address | 0x1e1410 |
| Ordinal | 7 |
|---|---|
| Address | 0x1e1440 |
| Ordinal | 8 |
|---|---|
| Address | 0x1e19b0 |
| Ordinal | 9 |
|---|---|
| Address | 0x1e1980 |
| Ordinal | 10 |
|---|---|
| Address | 0x1e19e0 |
| Ordinal | 11 |
|---|---|
| Address | 0x1e1960 |
| Ordinal | 12 |
|---|---|
| Address | 0x1e1a70 |
| Ordinal | 13 |
|---|---|
| Address | 0x1e1a60 |
| Ordinal | 14 |
|---|---|
| Address | 0x1e1a50 |
| Ordinal | 15 |
|---|---|
| Address | 0x1e16d0 |
| Ordinal | 16 |
|---|---|
| Address | 0x1db4a0 |
| Ordinal | 17 |
|---|---|
| Address | 0x1db4e0 |
| Ordinal | 18 |
|---|---|
| Address | 0x1db470 |
| Ordinal | 19 |
|---|---|
| Address | 0x1db4b0 |
| Ordinal | 20 |
|---|---|
| Address | 0x1d0320 |
| Ordinal | 21 |
|---|---|
| Address | 0x1e1a80 |
| Ordinal | 22 |
|---|---|
| Address | 0x1e1aa0 |
| Ordinal | 23 |
|---|---|
| Address | 0x1e19e0 |
| Ordinal | 24 |
|---|---|
| Address | 0x1e1e80 |
| Ordinal | 25 |
|---|---|
| Address | 0x1e1aa0 |
| Ordinal | 26 |
|---|---|
| Address | 0x1e1eb0 |
| Ordinal | 27 |
|---|---|
| Address | 0x1e1f00 |
| Ordinal | 28 |
|---|---|
| Address | 0x1db450 |
| Ordinal | 29 |
|---|---|
| Address | 0x1db670 |
| Ordinal | 30 |
|---|---|
| Address | 0x1db660 |
| Ordinal | 31 |
|---|---|
| Address | 0x1db690 |
| Ordinal | 32 |
|---|---|
| Address | 0x1db560 |
| Ordinal | 33 |
|---|---|
| Address | 0x1db460 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 116.0.1938.54 |
| ProductVersion | 116.0.1938.54 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Edge |
| FileVersion (#2) | 116.0.1938.54 |
| InternalName | msedge_exe |
| LegalCopyright | Copyright Microsoft Corporation. All rights reserved. |
| OriginalFilename | msedge.exe |
| ProductName | Microsoft Edge |
| ProductVersion (#2) | 116.0.1938.54 |
| CompanyShortName | Microsoft |
| ProductShortName | Microsoft Edge |
| LastChange | e584466f74bf872ad84fcd188ddc4b60fd2ec646 |
| Official Build | 1 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Aug-17 22:40:54 |
| Version | 0.0 |
| SizeofData | 83 |
| AddressOfRawData | 0x31927c |
| PointerToRawData | 0x317a7c |
| Referenced File | D:\a\_work\e\src\out\Release_x64\initialexe\msedge.exe.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Aug-17 22:40:54 |
| Version | 0.0 |
| SizeofData | 1636 |
| AddressOfRawData | 0x3192d0 |
| PointerToRawData | 0x317ad0 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Aug-17 22:40:54 |
| Version | 0.0 |
| SizeofData | 4 |
| AddressOfRawData | 0x319934 |
| PointerToRawData | 0x318134 |
| StartAddressOfRawData | 0x140369000 |
|---|---|
| EndAddressOfRawData | 0x14036926c |
| AddressOfIndex | 0x14033ee50 |
| AddressOfCallbacks | 0x14031b9a0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_64BYTES
|
| Callbacks |
0x00000001400F2600
0x000000014015D210 0x00000001400FD2D0 0x000000014015D290 0x00000001400FE5D0 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x14032e038 |
| GuardCFCheckFunctionPointer | 5372260352 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
No comments yet.