9600c6b7d7875d2b490bc5775a19508a2d4c9bfc74cdfb10da7a369a03176f97

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jun-07 00:26:12
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Tries to detect virtualized environments:
  • HARDWARE\DESCRIPTION\System
Contains a XORed PE executable:
  • 2a 16 17 0d 5e 0e 0c 11 19 0c 1f 13 5e 1d 1f 10 10 11 0a 5e ...
Miscellaneous malware strings:
  • cmd.exe
Contains domain names:
  • example.com
  • github.com
  • https://curl.se
  • https://github.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Uses constants related to Blowfish
Uses constants related to RC5 or RC6
Uses known Mersenne Twister constants
Microsoft's Cryptography API
Suspicious The PE is possibly packed. Unusual section name found: .fptable
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
  • LoadLibraryExW
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
Can access the registry:
  • RegOpenKeyExW
  • RegQueryValueExW
  • RegOpenKeyExA
  • RegQueryValueExA
  • RegCloseKey
Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteA
Uses Microsoft's cryptographic API:
  • CryptQueryObject
  • CryptStringToBinaryW
  • CryptDecodeObjectEx
  • CryptEnumProvidersW
  • CryptSignHashW
  • CryptDecrypt
  • CryptExportKey
  • CryptGetUserKey
  • CryptGetProvParam
  • CryptSetHashParam
  • CryptGenRandom
  • CryptEncrypt
  • CryptImportKey
  • CryptDestroyKey
  • CryptDestroyHash
  • CryptHashData
  • CryptCreateHash
  • CryptGetHashParam
  • CryptReleaseContext
  • CryptAcquireContextW
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Has Internet access capabilities:
  • InternetOpenA
  • InternetCloseHandle
  • InternetOpenUrlA
  • InternetReadFile
Leverages the raw socket API to access the Internet:
  • WSACleanup
  • WSAStartup
  • ntohs
  • socket
  • htons
  • recv
  • setsockopt
  • WSASetLastError
  • WSAGetLastError
  • closesocket
  • WSAWaitForMultipleEvents
  • WSAResetEvent
  • WSAEventSelect
  • WSAEnumNetworkEvents
  • WSACreateEvent
  • WSACloseEvent
  • send
  • getsockopt
  • accept
  • WSAIoctl
  • __WSAFDIsSet
  • bind
  • connect
  • getpeername
  • select
  • shutdown
  • getservbyname
  • getservbyport
  • gethostbyaddr
  • inet_ntoa
  • inet_addr
  • gethostbyname
  • gethostname
  • ioctlsocket
  • sendto
  • recvfrom
  • freeaddrinfo
  • getaddrinfo
  • listen
  • htonl
  • getsockname
Functions related to the privilege level:
  • OpenProcessToken
Interacts with services:
  • OpenSCManagerA
  • EnumServicesStatusA
Enumerates local disk drives:
  • GetDriveTypeW
  • GetVolumeInformationA
Manipulates other processes:
  • Process32FirstW
  • Process32NextW
  • OpenProcess
Reads the contents of the clipboard:
  • GetClipboardData
Interacts with the certificate store:
  • CertAddCertificateContextToStore
  • CertOpenSystemStoreW
  • CertOpenStore
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 4c26292e93e10c0a71643f48671f475a
SHA1 31e8d064b426ac3ec4220309537c634bb3422fb9
SHA256 9600c6b7d7875d2b490bc5775a19508a2d4c9bfc74cdfb10da7a369a03176f97
SHA3 6355b0bda2fc8200b6f2d48e4c9244637f27302e6877cc78274df807369cdb49
SSDeep 98304:Mah1w/K/asWjEx0o0JCCkwLI/9R5CJco/QBVXTC2rj8r+X+i:Lh147hjEx0o0JCCkX/r0JcgQBVHye+
Imports Hash ad45f71917c43004a0e2b889c937776b

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x130

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Jun-07 00:26:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x44c400
SizeOfInitializedData 0x215800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000040C068 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x667000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 3aaf63ce11ba137f54ad38b4d35fca7e
SHA1 f0d2e012989efd857bf897d8b495548740c86e17
SHA256 eae0265e7c0989ad11e13a7e654af704eab06a16cf9cff242174051f1ed2c1ec
SHA3 a4d1dc4585c7ee5661637f4715443dc8d646981c002b782457cc1db5ec6275e1
VirtualSize 0x44c260
VirtualAddress 0x1000
SizeOfRawData 0x44c400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.70331

.rdata

MD5 14947b460e5956e0293e9da2922326e4
SHA1 68cb0d522141dfd8a44855257f785c4c81f18716
SHA256 0581319f1b09a17251ca961db447f0aa9efad6a6f2903d6fa4d6229b31769ed7
SHA3 217ec4482e6510817908401addb66ba852888a8ff4da6223501f6db402e33692
VirtualSize 0x1779b2
VirtualAddress 0x44e000
SizeOfRawData 0x177a00
PointerToRawData 0x44c800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.79854

.data

MD5 85099f1727eafe8e02fc11e7209ef304
SHA1 8b999f4e336191847a8ffcc552e28d68cdb022f4
SHA256 e3cb3c75a237d3cbc68e5f83662992077479c6343d82d53730bba56a970b20c8
SHA3 1600f447d0f68db0c526ea93594da77b7ea33703a33083ac11d4ee60e56d68e1
VirtualSize 0x5b8fc
VirtualAddress 0x5c6000
SizeOfRawData 0x4b400
PointerToRawData 0x5c4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.57197

.pdata

MD5 ec361df8e214b83d4bc15e4f9883c0c1
SHA1 ce8d66a56a37e88fb762c3f4b6bc975cbf848f0b
SHA256 0ad562f707cffe216bbc1b87bdabbee0e6fc360cd355f164f10799aebe977eec
SHA3 8859bc8c2ee5d748442060ebb3ad621a3753483f38b62df3ac5142ecab1fdd5e
VirtualSize 0x3438c
VirtualAddress 0x622000
SizeOfRawData 0x34400
PointerToRawData 0x60f600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.32424

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x100
VirtualAddress 0x657000
SizeOfRawData 0x200
PointerToRawData 0x643a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 424af694b7b92be4917b0f700a119bd5
SHA1 69de31aa23f268cb3425cbb26f5ba35540180281
SHA256 4f1be3e3017e6c73c4a1326109e6cea17641123c01d50a161347ba4e0db47adc
SHA3 26866555d4046cd40035eccccfd702efc48c8e07b9936c8f7c6e7ca69411b692
VirtualSize 0x1e8
VirtualAddress 0x658000
SizeOfRawData 0x200
PointerToRawData 0x643c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.75386

.reloc

MD5 bc34142ca3ef46c7f0d2904d6d837658
SHA1 f0a4211288f1f8f112947c81cc587207f829fe08
SHA256 b5ce6678ef3b2a50e49146e863752857e7f76b6d71269581edff17069ac68bf2
SHA3 1f988862a35a266f12851b1287fd2304115609618c7254ef672ab008cfc7efa6
VirtualSize 0xdbf0
VirtualAddress 0x659000
SizeOfRawData 0xdc00
PointerToRawData 0x643e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.43992

Imports

d3dx9_43.dll D3DXCreateTextureFromFileInMemoryEx
WS2_32.dll WSACleanup
WSAStartup
ntohs
socket
htons
recv
setsockopt
WSASetLastError
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
accept
WSAIoctl
__WSAFDIsSet
bind
connect
getpeername
select
shutdown
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
gethostbyname
gethostname
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
getsockname
CRYPT32.dll CertFreeCTLContext
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertGetCertificateContextProperty
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertCreateCertificateChainEngine
CertAddCertificateContextToStore
CertOpenSystemStoreW
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertFreeCRLContext
Secur32.dll InitSecurityInterfaceW
ADVAPI32.dll OpenSCManagerA
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
CloseServiceHandle
EnumServicesStatusA
ConvertSidToStringSidA
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptGenRandom
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegCloseKey
IPHLPAPI.DLL GetAdaptersInfo
if_nametoindex
KERNEL32.dll ExitProcess
GetConsoleCP
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetConsoleOutputCP
SetFilePointerEx
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitThread
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetExitCodeProcess
CreateProcessW
GetTimeZoneInformation
ReadConsoleInputW
HeapReAlloc
SetStdHandle
SetEndOfFile
FreeLibraryAndExitThread
GetDateFormatW
CreateFileW
CloseHandle
DeviceIoControl
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
VirtualAlloc
VirtualFree
SetUnhandledExceptionFilter
GetLastError
GetCurrentProcess
GetSystemDirectoryW
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
K32GetModuleInformation
GetModuleFileNameW
GetStdHandle
GetEnvironmentVariableA
CreateDirectoryA
DeleteFileA
GetFileAttributesA
SetFileAttributesA
GetVolumeInformationA
CreateMutexA
Sleep
IsValidCodePage
CreateThread
GetCurrentThread
SetThreadPriority
SetPriorityClass
OpenProcess
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTime
GetLocalTime
GetTickCount
GetTickCount64
GetWindowsDirectoryA
GetNativeSystemInfo
VirtualProtect
GetModuleFileNameA
GetModuleHandleW
GlobalSize
LocalAlloc
LocalFree
QueryFullProcessImageNameA
GetComputerNameA
FreeConsole
GetConsoleMode
SetConsoleMode
SetConsoleCtrlHandler
SetConsoleCP
SetConsoleOutputCP
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleA
SetCurrentConsoleFontEx
GetConsoleWindow
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
FormatMessageW
SleepEx
GetFullPathNameW
MoveFileExW
WaitForSingleObjectEx
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerifyVersionInfoW
GetFileSizeEx
WriteFile
RtlVirtualUnwind
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetSystemTimeAsFileTime
GetEnvironmentVariableW
GetACP
RtlUnwind
ReleaseSemaphore
WaitForSingleObject
GetExitCodeThread
CreateSemaphoreA
GetSystemDirectoryA
FormatMessageA
LoadLibraryW
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
ReadConsoleA
ReadConsoleW
DeleteFileW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
WakeAllConditionVariable
LCMapStringEx
DecodePointer
EncodePointer
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFileInformationByHandle
GetFileAttributesExW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FindFirstFileExW
CreateDirectoryW
GetCurrentDirectoryW
GetProcessHeap
WriteConsoleW
HeapSize
TerminateProcess
InitializeCriticalSection
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
USER32.dll OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetSystemMetrics
GetKeyState
GetForegroundWindow
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorW
SendMessageW
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
GetClientRect
IsWindowVisible
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
EnumDisplayMonitors
GetMonitorInfoA
LoadIconW
GetWindow
GetWindowThreadProcessId
EnumWindows
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
MessageBoxA
GetWindowRect
GetLastInputInfo
SHELL32.dll ShellExecuteA
ole32.dll GetHGlobalFromStream
CreateStreamOnHGlobal
d3d9.dll Direct3DCreate9Ex
IMM32.dll ImmGetContext
ImmReleaseContext
ImmAssociateContextEx
ImmSetCompositionWindow
ImmSetCandidateWindow
ntdll.dll RtlCaptureContext
RtlLookupFunctionEntry
WININET.dll InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
HttpQueryInfoA
gdiplus.dll GdipAlloc
GdipGetImageEncodersSize
GdiplusStartup
GdiplusShutdown
GdipFree
GdipGetImageEncoders
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipSaveImageToStream
GdipDisposeImage
bcrypt.dll BCryptGenRandom

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x188
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.89623
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
SHA3 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jun-07 00:26:12
Version 0.0
SizeofData 1068
AddressOfRawData 0x58f598
PointerToRawData 0x58dd98

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Jun-07 00:26:12
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x14058fa10
EndAddressOfRawData 0x140593074
AddressOfIndex 0x140620330
AddressOfCallbacks 0x14044eea0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14060f780

RICH Header

XOR Key 0xf7b78766
Unmarked objects 0
C++ objects (33145) 211
C objects (33145) 45
ASM objects (33145) 25
253 (35207) 3
C objects (35207) 19
ASM objects (35207) 12
C++ objects (35207) 100
Imports (VS2012 build 50727 / VS2005 build 50727) 2
Imports (33145) 32
Unmarked objects (#2) 42
C objects (35223) 970
Imports (21202) 3
Total imports 412
C++ objects (35223) 18
Resource objects (35223) 1
Linker (35223) 1

Errors

Leave a comment

No comments yet.