8f2e258542d85b368c7ce1a0758102ffb1112efc04193aa9a768eeac90ec9a56

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Aug-20 15:21:12
Detected languages English - United States
Debug artifacts C:\Users\b\source\repos\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Malicious The PE contains functions mostly used by malware. Functions related to the privilege level:
  • CheckTokenMembership
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 abdf817cbd64cb0716e979d896937f97 🔍
SHA1 d0b3faff4709ab5e6881fc97a43451e031e77f70 🔍
SHA256 8f2e258542d85b368c7ce1a0758102ffb1112efc04193aa9a768eeac90ec9a56 🔍
SHA3 a12a581c1d1daa31af35c6a0ea1c8701d5abbdc24faeeadd6b7c757ea0fb4c87 🔍
SSDeep 384:FMT6A/wKO3nZE+KOmWYvnIjNitTuvTh4L3I:FU/wKun1vDYvILW3 🔍
Imports Hash 806993d28d3a10a9a110c9388226a71b 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-20 15:21:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2200
SizeOfInitializedData 0x2a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000002540 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ea7ea5233ae7d66bb6d919f7cdf89f27 🔍
SHA1 7c77caa9be1bebef38ffa0d09f6c4adb26c163ea 🔍
SHA256 2075533e09b46cecd67cdfd8961f2f30042015c7524f9e0989711aa5d063a57f 🔍
SHA3 7ebc0534adf561f195ed077f1e6c1d6f4899aaa2ca300d9b21e1ecfbf113ab9b 🔍
VirtualSize 0x2148
VirtualAddress 0x1000
SizeOfRawData 0x2200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.98285

.rdata

MD5 12f6376c19bc71cc92dd0be858ec5fde 🔍
SHA1 2c827bf53d271740e99dd19d5140b67a5f954704 🔍
SHA256 3cdc1151d6b37f0c5e3c16abec068c9a0018414be52ebf0dbc47c7351e8e0ba5 🔍
SHA3 796451ec500308061256ef6976484083b0d6b42f1c66bab9dcdd790909f7aadb 🔍
VirtualSize 0x177a
VirtualAddress 0x4000
SizeOfRawData 0x1800
PointerToRawData 0x2600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.59119

.data

MD5 6a2a823c5af96cbb43df0e02faa831e7 🔍
SHA1 b090e5987ac8893c35866939939cb16bd8986265 🔍
SHA256 157c77b71ef1c4e6944bcb5d916a992ca379fb93189ebf6829da613a13828f57 🔍
SHA3 13f111d68d982aa9ed7f58121b1c612a8b1c10cd9a1254ca439653c3a6b2dfc0 🔍
VirtualSize 0x948
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.606504

.pdata

MD5 eeb0f28da84a0a146eb8e8f249fae0b2 🔍
SHA1 dcf6d6cee2d14e26e1dfa6cdd0bb9fd074636bdf 🔍
SHA256 ed399ae585fa7576f87b8a56e8502353c02608fdb988ae2f955165f46a9f264b 🔍
SHA3 cc285dfc31c7faf2a755f16b50d3ea6c98b478465d90c4016877d5be8f6b744c 🔍
VirtualSize 0x1f8
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x4000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.77833

.rsrc

MD5 bc0c0a8057dc4583fdf5c03bd189df47 🔍
SHA1 e3d531e4fcc82e531293e20cd973b4f9979b180e 🔍
SHA256 b2cd347410c5ac733163c589d30b6761a80af057625dea8a20d2c6b0264f1c6e 🔍
SHA3 6474074e1829412d37252cc4ab9b71582a02c1aac0d480be575f367375149251 🔍
VirtualSize 0x2b0
VirtualAddress 0x8000
SizeOfRawData 0x400
PointerToRawData 0x4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.01213

.reloc

MD5 17c52d31be0e2ae6e15de7112ac57c2f 🔍
SHA1 4d7c5db3067186b53c74e0616ecb9781b86369d1 🔍
SHA256 a94931f1b75d3d12a1e1ec4dc2f9176706b37f44995a5e3da31e3c78470d493f 🔍
SHA3 c53c17dd201de154a861c26f0315410356dd1495dc3af70581390ed214eeb742 🔍
VirtualSize 0x2c
VirtualAddress 0x9000
SizeOfRawData 0x200
PointerToRawData 0x4600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.653294

Imports

KERNEL32.dll CloseHandle
GetLastError
IsDebuggerPresent
GetCurrentProcessId
CreateFileW
DeviceIoControl
GetFileSize
CreateFileA
ReadFile
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
ADVAPI32.dll FreeSid
CheckTokenMembership
AllocateAndInitializeSid
VCRUNTIME140.dll strstr
__current_exception
__C_specific_handler
__current_exception_context
memcpy
api-ms-win-crt-heap-l1-1-0.dll free
_set_new_mode
calloc
malloc
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vfprintf
__acrt_iob_func
getchar
_set_fmode
__p__commode
api-ms-win-crt-runtime-l1-1-0.dll __p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_initterm_e
_initterm
__p___argc
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_exit
_seh_filter_exe
exit
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-string-l1-1-0.dll strcmp

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x249
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.06044
MD5 f7e7c81035fc42015d50fadd75b9300f 🔍
SHA1 df759518191bad6608c336186b31c120b3dadb34 🔍
SHA256 72ae19a66b5d012088d762d3e2de6498a9b3b8fc153352ca6c76cf045d1fe96e 🔍
SHA3 1038ef4fa889f000231ecd6b7f2eb0759548ed2a8e5da6ca3e19b38062e60dbd 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Aug-20 15:21:12
Version 0.0
SizeofData 104
AddressOfRawData 0x4a54
PointerToRawData 0x3054
Referenced File C:\Users\b\source\repos\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Aug-20 15:21:12
Version 0.0
SizeofData 20
AddressOfRawData 0x4abc
PointerToRawData 0x30bc

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-20 15:21:12
Version 0.0
SizeofData 644
AddressOfRawData 0x4ad0
PointerToRawData 0x30d0

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Aug-20 15:21:12
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140006000

RICH Header

XOR Key 0xbcf807d2
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 12
Imports (35721) 2
ASM objects (35721) 3
C objects (35721) 10
C++ objects (35721) 20
Imports (33145) 5
Total imports 58
C++ objects (LTCG) (36256) 1
Resource objects (36256) 1
Linker (36256) 1

Errors

Leave a comment

No comments yet.