886cb9f980d892e379efe0a04d3493cd

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2024-May-15 15:15:59
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • cmd.exe
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • FindWindowA
 Possibly launches other programs:
  • CreateProcessW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 886cb9f980d892e379efe0a04d3493cd
SHA1 3ec443a06a5764e38807810c74e799727696bbdd
SHA256 a7fde0067e7d7c511eb6d5af1c033f4ddcb45fdb5130c2ae4e34e0d7d9f05600
SHA3 ebdd155dbf773a9ed31299819d02192f28afb039951f3bcd6423b706798ba47f
SSDeep 6144:EpTZSkezr2OUt4+vUPIP+sdH9YLlYx5e:EkqOUtlNmG5
Imports Hash 67014473fefda5d9307bb858ff0b4e17

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2024-May-15 15:15:59
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x29600
SizeOfInitializedData 0xf800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000C4CA (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2b000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a25fbc47fc26fec6d22379802a5d4f41
SHA1 a7e0fc363912030b2082a526ed91bfcd24cd16ca
SHA256 39c2f397b61467d8c6f4f41e6fcb16216823828e0d662ee32e7f3ea39ee7874e
SHA3 67880b234b677a122ecfec6faf9e285f415c656c9ff0eb384e21795b0a1d94de
VirtualSize 0x29598
VirtualAddress 0x1000
SizeOfRawData 0x29600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.62958

.rdata

MD5 88b50ef3babd908be708a824ad197bc6
SHA1 f3ef45647311bdf3649953b227a4fc8ca9f5c43e
SHA256 82453f30e9ce8ae7cc94591fce4d0a4cb33550d217cef611aa241ff635afdfc9
SHA3 01905e279545b77151fdf4172c4256d488b407b56d57a71b52890e34f9534a93
VirtualSize 0xb592
VirtualAddress 0x2b000
SizeOfRawData 0xb600
PointerToRawData 0x29a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.98899

.data

MD5 96c98b2c359e38755da911e44310be85
SHA1 f1eaae7a4a4d0e45a1b239398c14db6b47a165cb
SHA256 b4fc69bf981acd7d8858fc3e12d87032a510a48c46cb4727ca7e25bc1da9fa08
SHA3 e50874e72b98ff530c6c9e17ba3937b66d3f4735430fedc3e19d2548a0d9efa5
VirtualSize 0x1f58
VirtualAddress 0x37000
SizeOfRawData 0x1200
PointerToRawData 0x35000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.08657

.rsrc

MD5 42907ffd39ad311dd3045328bb09327f
SHA1 2577479bcd479fc6c8047d70d5149d17d6ae00e8
SHA256 74bb4713dedea841249300b0aa520dcd841374f8db79aabc4dc06bfa7fadb172
SHA3 9a4cc25be1ecbc4328cd3fe3e2ef58057722956a39901cca8170c9de0e156623
VirtualSize 0x1e8
VirtualAddress 0x39000
SizeOfRawData 0x200
PointerToRawData 0x36200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.77204

.reloc

MD5 cb51e5e02372667eaba6a38d79244d8f
SHA1 5cbe076cf280ab8395270655edbc1c83cdd38077
SHA256 58e4f073120769590a24c2a19d01b1dae546c38a19fd739c176b6ec4db0e0859
SHA3 703a9a1ffa1725a57c90566d35898218d96f9056ab67218a3fc114476dc283d9
VirtualSize 0x1fc8
VirtualAddress 0x3a000
SizeOfRawData 0x2000
PointerToRawData 0x36400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.54292

Imports

KERNEL32.dll SetConsoleTitleA
GetModuleHandleA
LoadLibraryA
GetProcAddress
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
QueryPerformanceCounter
QueryPerformanceFrequency
WideCharToMultiByte
Sleep
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetConsoleCP
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CreateFileW
CloseHandle
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
ReadFile
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
USER32.dll FindWindowA
WINMM.dll timeGetTime

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-May-15 15:15:59
Version 0.0
SizeofData 852
AddressOfRawData 0x343dc
PointerToRawData 0x32ddc

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2024-May-15 15:15:59
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0xc0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x437040
SEHandlerTable 0x433fe8
SEHandlerCount 55

RICH Header

XOR Key 0x64f680e2
Unmarked objects 0
ASM objects (30795) 11
C++ objects (30795) 183
C objects (30795) 21
C objects (33218) 19
ASM objects (33218) 23
C++ objects (33218) 84
Imports (30795) 7
Total imports 127
C++ objects (LTCG) (33523) 1
Resource objects (33523) 1
Linker (33523) 1

Errors

<-- -->