8dda71e434c0d6cbb42eaba26e37536eea45f3f4dbc5c78366f1bcb43ea4169f
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Jan-04 03:05:25 |
| Detected languages |
English - United States
|
| TLS Callbacks | 2 callback(s) detected. |
Plugin Output
| Suspicious | The PE is possibly packed. | Unusual section name found: .buildid |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 95.175% of the executable. |
| Suspicious | VirusTotal score: 1/71 (Scanned on 2026-10-31 20:17:40) | Cylance: Unsafe |
Hashes
| MD5 | f26d627c6191079850f7499572971e4e 🔍 |
|---|---|
| SHA1 | 5ba713fc4dbcddffc16344db500116ea2c93983f 🔍 |
| SHA256 | 8dda71e434c0d6cbb42eaba26e37536eea45f3f4dbc5c78366f1bcb43ea4169f 🔍 |
| SHA3 | 2f8dd9aa51bd96030f9bc63fe1e9aa421744043ff35820c7805d2aad06bc6636 🔍 |
| SSDeep | 6144:1c46kxMyhhTwkceD9yLLkGVOvxPIrV+prh9A0TzEdGPSWxqqyKfVM:VJThJwkfyLLkGVoxgrVurvloWZf 🔍 |
| Imports Hash | 8d88ee3d02e50123906bab082925025d 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x78 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0 |
| e_ss | 0 |
| e_sp | 0 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x78 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-Jan-04 03:05:25 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1a00 |
| SizeOfInitializedData | 0x17a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001160 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x53000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x5b915 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | e350e5d12b865f27b329760233d88fdc 🔍 |
|---|---|
| SHA1 | 0a5636c2cc88eff9cd8516bcf375a5823c8a5ec2 🔍 |
| SHA256 | c5bbb5f255c2e70e1e75e98e5f03f22cffe4db8f53be123cf345856fc17e7eb5 🔍 |
| SHA3 | 9b2d28a3e3a3cd27bfd31b324eff44ee6fd855feba5fe37c9d5837e76c5f7498 🔍 |
| VirtualSize | 0x1976 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1a00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.88586 |
.rdata
| MD5 | a2acda28d16f9ba7c49956324cbc9fb3 🔍 |
|---|---|
| SHA1 | 09e4d71d975500abb731a9f4f714065ab77508d3 🔍 |
| SHA256 | 6e15ad3714bbd7f821479206a0c92f7e35bb261f02965352411784636f85853f 🔍 |
| SHA3 | 0419ac4dc84d2c6e37b2235a53fd8eb620788d5212687716b4610b2a5f790264 🔍 |
| VirtualSize | 0x10e0 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x1200 |
| PointerToRawData | 0x1e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.15833 |
.buildid
| MD5 | eef5cbed7d4b83104516ddabe5c50fee 🔍 |
|---|---|
| SHA1 | 70bcc31a7fc025bef13b5c7454de542ddde1fc5e 🔍 |
| SHA256 | f676b70caf240c4e7a482d324c5c41f8ebcf8cdf169f2db252660dacef3b1603 🔍 |
| SHA3 | ce729f25f7b0247d1b71fa99ad30a3bad08e6706b2126335ffd22a27a4cf62e7 🔍 |
| VirtualSize | 0x35 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.604661 |
.data
| MD5 | a55b2b5b5992ee63766a195ad0506662 🔍 |
|---|---|
| SHA1 | bd06875afb641b095f71d71abba1c1a729a897ed 🔍 |
| SHA256 | 8d92b355f9b7066015a80bb6ef849a380911026a1b98b8e070e3eaca0b049b1e 🔍 |
| SHA3 | 9c1e93f6640bc2d0c3a2963e73c66ade186fd29d4527a6d43d0198c7d87b4ea4 🔍 |
| VirtualSize | 0x120 |
| VirtualAddress | 0x6000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.644065 |
.pdata
| MD5 | f6366b4e43edde63802c654974735b2a 🔍 |
|---|---|
| SHA1 | bc0e7f1b3ae59748ebf7cff39be19f426e08a9c0 🔍 |
| SHA256 | 5f891542771b1b0413f66178c558ab67c52f0a22ab54d5c8591e2e70f2b7cd63 🔍 |
| SHA3 | 83266372045ce97e826b31c98958926de0d42d571b0ae4cdfc972550336f3653 🔍 |
| VirtualSize | 0x138 |
| VirtualAddress | 0x7000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 2.52704 |
.tls
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x10 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x3600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | 2e72de6bbd2121985808aae3f6c2718c 🔍 |
|---|---|
| SHA1 | 1e85aa1bf1c7f6ddf35e5ba83806092b2ca08650 🔍 |
| SHA256 | f1377e5b78e53ecf1b6961ca25897d3149d017717787c76e3c1f80c3d0cc5f10 🔍 |
| SHA3 | a43890d31267350684a12433cd49c1e26c8263aa49c6b33e81e77a4dd5822f6b 🔍 |
| VirtualSize | 0x49510 |
| VirtualAddress | 0x9000 |
| SizeOfRawData | 0x49600 |
| PointerToRawData | 0x3800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.18335 |
Imports
| api-ms-win-crt-private-l1-1-0.dll |
__C_specific_handler
memcpy |
|---|---|
| api-ms-win-crt-stdio-l1-1-0.dll |
__acrt_iob_func
__p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vswprintf fwrite |
| api-ms-win-crt-runtime-l1-1-0.dll |
__p___argc
__p___wargv _cexit _configure_wide_argv _crt_atexit _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal |
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
calloc free malloc |
| api-ms-win-crt-string-l1-1-0.dll |
_wcsdup
memset strlen strncmp wcslen |
| USER32.dll |
MessageBoxW
|
| KERNEL32.dll |
DeleteCriticalSection
EnterCriticalSection GetLastError GetProcAddress InitializeCriticalSection LeaveCriticalSection LoadLibraryW SetDllDirectoryW SetUnhandledExceptionFilter Sleep TlsGetValue VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-environment-l1-1-0.dll |
__p__wenviron
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.79633 |
| MD5 | 13d270a1fe0dbc788a148df3020ec487 🔍 |
| SHA1 | 9d14e72516729d2bd822794fb24a98f193fe6e72 🔍 |
| SHA256 | fe869125b53ff65fd44a9110de33e07c9945134c75558420fec5305769754684 🔍 |
| SHA3 | a588f8be31e376b0b2ffa2d6c5d1047030311ef77ff0c3630871b74eda79ba5e 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.96706 |
| MD5 | de3328ec5711e40deb6f6144558761c6 🔍 |
| SHA1 | a52c954d019d84b10f3ee10f264fc26a6f48723e 🔍 |
| SHA256 | b73e7c28792661d6c5c6804367972f3d98e3af45f0572a03885c3536a674c0ff 🔍 |
| SHA3 | f763ae4851fb7da76f6601d2c2b41cce4cf6c00491f50fe003c29c289d4ea172 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.00071 |
| MD5 | 46d887b91c2cdd23b86b3d48b5a190f4 🔍 |
| SHA1 | ada14650b53f71ca4f60febcc30ca213b1ff7bb2 🔍 |
| SHA256 | a1966abba1c5e1e54a4bd82b8e07346003c8b4449ee55bf44f58372cb782ebbb 🔍 |
| SHA3 | 00a42673b979d6ce46881411c56d185c422366d2bbd425e49458cfa8091188c3 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.95464 |
| MD5 | 3a4fa1dc10deb59aceacf073bf68b7b1 🔍 |
| SHA1 | 57ecbdd2e3937a869bbb6f9652fc3f82792d8408 🔍 |
| SHA256 | c197ae8cf7f527449efeccdd71c1a28019edeb689f7e98ce0d8d13ee4b3796c4 🔍 |
| SHA3 | c626c3f124c7bcab19f7ce5df5291d8bad3357b184c782f86d57bb4a3e8e4ece 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.95332 |
| MD5 | e5d57f963ee4a9765b92bdcd5bca4c8c 🔍 |
| SHA1 | e8545555df12ba61f4a6d1fa3e1d73f55f9fa6b1 🔍 |
| SHA256 | 5ff1d500eb2d04e709fdc41900d5fbaf084824a0118e0a9436d9500ad2110cdd 🔍 |
| SHA3 | 48a73e697096c75cb00abcda98b22450e5d362b8c8c052863465c1670576c81b 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5488 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.90477 |
| MD5 | 2a66a69bdafef6699cd332f5bbcc7f1d 🔍 |
| SHA1 | a4457b34ec3abe1835c60712e01708dc5c92d534 🔍 |
| SHA256 | 7e23d43169b45233da53b4746176576d9046afc1ec2d0ae1e5f1d1b026ad9328 🔍 |
| SHA3 | b045bb6199d3763aa5cce6d4744eaefcff0518e464771b43052cebf261d5ee60 🔍 |
7
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x94a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.86305 |
| MD5 | 1c3fcd08e8f77f826389cf31e65469b0 🔍 |
| SHA1 | a14fad5681e94cd59afc6b9c524a96139ecebd39 🔍 |
| SHA256 | 1d3724d158b46c4c7f2ee82688417d3ca6e6111ca15d1466cd97f5b66b5e7b33 🔍 |
| SHA3 | 8430623679d5f7c353a9242153e97b3594777990969a0c937d28c15fe5c029a6 🔍 |
8
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.81499 |
| MD5 | ec4403339f70e4e04a33ea9902db8c13 🔍 |
| SHA1 | 1ed16e7719a91c19444ddc0690e198fd566953d9 🔍 |
| SHA256 | 081e0260d56d57c9c36688cfadcf708e9479fc64239afd0cb2e8de020ebfb26a 🔍 |
| SHA3 | 30422f8d697c4b9c580304d9fda75c16a67aecfc5869b9607aa45ed89fb6b0ce 🔍 |
9
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x217a7 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.98814 |
| Detected Filetype | PNG graphic file |
| MD5 | a29f43def70a84fea7be36c2d915c0e7 🔍 |
| SHA1 | 8466bc417336ca1da67dbc706c20df64c0cddb72 🔍 |
| SHA256 | c84f2afbc64c2da1ec74a13d67701de9e64e9cbc93a9f34534719e9afb50f22d 🔍 |
| SHA3 | 59f82e8ddcfc5476bb6efe8369f8ba5d60dd6712a013b6d7b7c95b66746dc649 🔍 |
1 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x84 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.07647 |
| Detected Filetype | Icon file |
| MD5 | e728209a1defb68ae66033812465c0d0 🔍 |
| SHA1 | 159c4e4327d402aba24654421071942860adb0e8 🔍 |
| SHA256 | 2bc27f6ccd3b7b52d9b3232db5b61579a6233aed3e56872863eec9086ffd0caf 🔍 |
| SHA3 | bed170daab5923878e339de2ef9cf26ab23508bb56a3344926bb4628124c90e6 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x2bc |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.82693 |
| MD5 | 67d470b193d92eaedadc0bb58838f5f1 🔍 |
| SHA1 | f3d3d4f28c3635167a46e075d490c33bdbb01496 🔍 |
| SHA256 | 7a7ce637fc4e50b945d45254545c848c8350184f51ee13abca9188621c9bad25 🔍 |
| SHA3 | 87048578496162e372472f4afe5412b15ce526e1ab77d805f4e73f0a59a0c7f1 🔍 |
Version Info
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jan-04 03:05:25 |
| Version | 0.0 |
| SizeofData | 25 |
| AddressOfRawData | 0x501c |
| PointerToRawData | 0x301c |
TLS Callbacks
| StartAddressOfRawData | 0x140008000 |
|---|---|
| EndAddressOfRawData | 0x140008008 |
| AddressOfIndex | 0x140006078 |
| AddressOfCallbacks | 0x1400036b8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x0000000140001580
0x0000000140001600 |
Load Configuration
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0 |
RICH Header
Errors
[!] Error: Could not read an IMAGE_BASE_RELOCATION!
Leave a comment
No comments yet.