8f95a4a7d0552e79f861dcec0a8bfa6d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2025-Nov-26 01:49:45
Detected languages English - United States

Plugin Output

Hashes

MD5 8f95a4a7d0552e79f861dcec0a8bfa6d
SHA1 f55e1c61fb368a68424bcc5f8ea4d34294aee700
SHA256 3f5c8dcdc569ca149e974466cd8f9c6d223f30699bc545e64e402ac5289c2787
SHA3 c698227c2e00b41670714ee472bd30b1eb4c22543d495190efab753d3f2e6fdd
SSDeep 384:I1y5qLe/t7nmF9Rrz9Fa1eRI+CE1SLyUfkVwrl3AtKPzL5ws0kz3+b9:IgMYt7nirzGemNLy1wJ3L9H389
Imports Hash 9a6a6dee9f5445a351515f1e578fc43b

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Nov-26 01:49:45
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x3600
SizeOfInitializedData 0x4800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000003610 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xd000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 41e355098c4729299d3ae56399eb49ea
SHA1 c4ee50ae17668e83a92417ab2f02816c1ec5a7fc
SHA256 b5a84bd4c07ad8f9fff33bf315ddc6ce3439172d12a6f6b7cb5064115183e14c
SHA3 354deb6f189bf01b1910043ac4c30de2aa6d4c54902dd7f5fc7aae823fbd5a83
VirtualSize 0x3487
VirtualAddress 0x1000
SizeOfRawData 0x3600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.90396

.rdata

MD5 96195c5bc3f71e5117beff0ce9e0fd43
SHA1 0f1906ed61943f089cd415596089487b43ba7b84
SHA256 476315ef769a7e4c9743bdcee23ca0af2d34dcc147ce064e8e27060eb9139754
SHA3 528f1fcab35a742e06cb01c345830bf7377a4d4127a8c0d4a4f5f9d2233bc148
VirtualSize 0x3332
VirtualAddress 0x5000
SizeOfRawData 0x3400
PointerToRawData 0x3a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.62549

.data

MD5 793d44a26236480f1592b5c2e9d36263
SHA1 44e0acee203decba10dc04da9c15190509cb15a5
SHA256 db4597925d7edb707be31c5a0856a4eb8cb28f78e2e9bd5eb53a3aecdd621e03
SHA3 5acecde91a4bebed7aa5eace00806828a93cd109ab471fe035f9d51cad184f2a
VirtualSize 0x930
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.12063

.pdata

MD5 04bd6e773e77b433328145770d23b9a6
SHA1 bda815fc6cc824a585f35c93e346921a5e38c233
SHA256 96c0f84fe4f02d1d01554a5ea056ad94dd60c161fa03455e2146802706d60eb7
SHA3 1e7684876f0d3e91115cda7e1b0e981ef8d868ed08e017e8bce56804d3b67b7f
VirtualSize 0x42c
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.14522

.rsrc

MD5 ae46018e2eb1721187fc1aeee8663872
SHA1 bed55c6c4e207dfc859421b181d7e2e87adee5e7
SHA256 52107afac0fedd9b1320a4a153a8f9aea34925aa43b039839dedcf44e55843f6
SHA3 30588b77ae212fba5738bbf96aa465ab6e30cbb5c1aa0453ec285f01bb07ca46
VirtualSize 0x1e0
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x7800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

.reloc

MD5 14d2f378f1d81435f7e1fe8e2c292ff2
SHA1 9434648ddbde4cb32c414490bc6ad88d0e466b1a
SHA256 0cfc17ade46bd3453ea82483b3725e45742900138a0c3a7d4f52d5e958cbf497
SHA3 6398aeaa8d2777dc5e92b50bbd9658983ae833a52c78f313e716891a682addb0
VirtualSize 0x94
VirtualAddress 0xc000
SizeOfRawData 0x200
PointerToRawData 0x7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.04784

Imports

KERNEL32.dll GetModuleFileNameA
SetLastError
LoadLibraryExA
GetFullPathNameA
GetCurrentDirectoryA
GetModuleHandleA
SetCurrentDirectoryA
GetLastError
GetFileAttributesA
SetDllDirectoryA
LocalFree
GetCurrentProcessId
FreeLibrary
FormatMessageA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
MSVCP140.dll ??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Id_cnt@id@locale@std@@0HA
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memcpy
__std_exception_destroy
__std_exception_copy
__std_terminate
strrchr
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
memmove
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_fseeki64
fread
fsetpos
_get_stream_buffer_pointers
setvbuf
fgetpos
__stdio_common_vsprintf
fwrite
fputc
ungetc
fflush
fclose
fgetc
_set_fmode
api-ms-win-crt-runtime-l1-1-0.dll terminate
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_seh_filter_exe
_invoke_watson
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0.dll strcpy_s
api-ms-win-crt-heap-l1-1-0.dll malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Nov-26 01:49:45
Version 0.0
SizeofData 780
AddressOfRawData 0x62e0
PointerToRawData 0x4ce0

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2025-Nov-26 01:49:45
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140009000

RICH Header

XOR Key 0xeb1da95b
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 14
Imports (35207) 6
Imports (33140) 3
Total imports 156
ASM objects (35207) 3
C objects (35207) 10
C++ objects (35207) 26
C++ objects (LTCG) (35214) 1
Resource objects (35214) 1
Linker (35214) 1

Errors

[*] Warning: Please edit the configuration file with your VirusTotal API key. [!] Error: Could not load yara_rules/bitcoin.yara! [!] Error: Could not load yara_rules/monero.yara! [!] Error: Could not load yara_rules/compilers.yara! [!] Error: Could not load yara_rules/findcrypt.yara! [!] Error: Could not load yara_rules/suspicious_strings.yara! [!] Error: Could not load yara_rules/domains.yara! [!] Error: Could not load yara_rules/peid.yara!