Manalyze report for a0dbdb44b1a43675fa5571fee95f599490c7b3ce7f5d03fbd0affc7956651e58

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	1970-Jan-01 00:00:00
TLS Callbacks	2 callback(s) detected.

Plugin Output

Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32`
Suspicious	The PE is possibly packed.	`Unusual section name found: .xdata`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryExW` `Possibly launches other programs: CreateProcessW` `Leverages the raw socket API to access the Internet: ntohl`
Suspicious	The file contains overlay data.	`7581619 bytes of data starting at offset 0x20600.` `The overlay data has an entropy of 7.9974 and is possibly compressed or encrypted.` `Overlay data amounts for 98.281% of the executable.`
Suspicious	VirusTotal score: 1/71 (Scanned on 2026-05-29 16:05:00)	`Jiangmin: Trojan.Agent.alia`

Hashes

MD5	`926463696b58c9f38ed90ae4aaaa48e0`
SHA1	`797194f8ef2721d635469460325f695db14a82d0`
SHA256	`a0dbdb44b1a43675fa5571fee95f599490c7b3ce7f5d03fbd0affc7956651e58`
SHA3	`c45c7e5dbe1691308c595f2a20c11c8733aa8a4531f9d8b6f39ef8040f49e651`
SSDeep	`196608:vt7KBA4PrEm8TAJcnZ995Qjxp/8BZKlXHoLL:M68sTvli1EmH6`
Imports Hash	`fc48893dea2e5ba567bdf2b66e0b85a9`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x9e00`
SizeOfInitializedData	`0x20200`
SizeOfUninitializedData	`0xce00`
AddressOfEntryPoint	`0x0000000000001520 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x33000`
SizeOfHeaders	`0x400`
Checksum	`0x2905f`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`dd50ee7747f4ffb85be7cce5fe41b1ea`
SHA1	`7b29ff111e0549212a68e2c5181f315f7104b517`
SHA256	`c5c0dd5b45f47376be3e31426ef3b5c11f0a4f2c8c6b2ed2d256b6de338910bf`
SHA3	`165a9cfb17fb2102d71e8b7220b976dcbb8599f0cfd1df4abeefb50385f6bf51`
VirtualSize	`0x9da8`
VirtualAddress	`0x1000`
SizeOfRawData	`0x9e00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.23042`

.data

MD5	`3d1e4d2b2ef261b334dd7772cc5deeaf`
SHA1	`d2ed76f752d593571690032da7a4a02fb7273e75`
SHA256	`2b1907a9332bba83cb9ba56b7597648bc0bafa1ff39fcccde035ecff31ed7b8e`
SHA3	`9c88194ef2fa37df687685bd20dcf0bc44a0e9396de023df059c1f98d4894367`
VirtualSize	`0xa8`
VirtualAddress	`0xb000`
SizeOfRawData	`0x200`
PointerToRawData	`0xa200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.69358`

.rdata

MD5	`3c9c11ee04beaa11aa5e66273bb45407`
SHA1	`38d595e7f2c5fc83e29fda625e622e057ff8c649`
SHA256	`be4001764e2f769ddda871ac677b17e070318bcca51d500f4219c2a960f7e698`
SHA3	`d4aa8e32cc5f4fc7e2d9658322849a2fece90933407c3102ebf894e0745d0da4`
VirtualSize	`0x5000`
VirtualAddress	`0xc000`
SizeOfRawData	`0x5000`
PointerToRawData	`0xa400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.74304`

.pdata

MD5	`fefba85ad53532cc035422d39f56dfa6`
SHA1	`c7440b5e823258e2c719086eb01375033e2de370`
SHA256	`62a0d74707ea652e000141ffd925a05e8a6f80eb71049ed41f3e94d00e6a1a50`
SHA3	`305751da0bc6acac676225829ba13c8d69719797790495b1bc81bf5b43f332fc`
VirtualSize	`0x7ec`
VirtualAddress	`0x11000`
SizeOfRawData	`0x800`
PointerToRawData	`0xf400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.65982`

.xdata

MD5	`296b8c01afb07118bba614d6d5e2bd11`
SHA1	`7b184dea073ade07144d1d230044193e71ce5d46`
SHA256	`d59c7d7517a5013030570f9bbd2784c7a09d28e4324c9b50d9cc2f6d5d36ec2a`
SHA3	`3d73ec2bffebaf04da61cba24dc148adac8ce0941ab88d038ed37ec7af32bc58`
VirtualSize	`0x76c`
VirtualAddress	`0x12000`
SizeOfRawData	`0x800`
PointerToRawData	`0xfc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.09042`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0xcca0`
VirtualAddress	`0x13000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`ecc2d4ae01eded08a63e52d1169bc36f`
SHA1	`82ddb39adbeb9c38482005d59573996c4dd73ab4`
SHA256	`045908bed7f790da84b2d89a335fddc2a42498b9f9dd8e8b957a93b136f52b8d`
SHA3	`89377e9ebdd1a8f04c5214d45f14692858a3cd8a0611ce9ea58eceb6f3d3352c`
VirtualSize	`0x1044`
VirtualAddress	`0x20000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x10400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.00583`

.CRT

MD5	`24918bc30a33206e408823e8d30e41f3`
SHA1	`ee060d2599dccebcfe4c07a88e2a8336c4074f1e`
SHA256	`7d8dca5b6d7a43c58bd1d870bea358678e5fd5353d9781c5dba62a6a6751c0c1`
SHA3	`c9b73becee5509c54958ed89c77ac3f5aaba5c52ee91b4e7bc3fabd1be7882b4`
VirtualSize	`0x68`
VirtualAddress	`0x22000`
SizeOfRawData	`0x200`
PointerToRawData	`0x11600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.267208`

.tls

MD5	`a604488ebfb6b2ae11aea87c5586711a`
SHA1	`a31eb1d41167c8c5415c0a143ca388d8c9e310ce`
SHA256	`c49137e8fc80e2c0d41add323a5f68ca8240a804e555cc805044cbbeb9fe7ce5`
SHA3	`3323d653e77b4655945a0decddc1a98b74ffdfaed19f30b9254eb372f07b195a`
VirtualSize	`0x68`
VirtualAddress	`0x23000`
SizeOfRawData	`0x200`
PointerToRawData	`0x11800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.210826`

.rsrc

MD5	`30936b641a143484392e7bbcbaaa7bba`
SHA1	`d6cf1d83f3aef94490acacb7635a20bde5b98201`
SHA256	`137cd5ef88ac39ebecc20f2aa59cc14af192dd6dee355cf7a61780921f6567ca`
SHA3	`ae515188d79ecbcaa6a76e629935e8e6bbfdee661e3089c80540b34c7b77a548`
VirtualSize	`0xea38`
VirtualAddress	`0x24000`
SizeOfRawData	`0xec00`
PointerToRawData	`0x11a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.29705`

Imports

KERNEL32.dll	`CreateProcessW` `DeleteCriticalSection` `EnterCriticalSection` `ExpandEnvironmentStringsW` `FormatMessageA` `GetCommandLineW` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThreadId` `GetEnvironmentVariableW` `GetExitCodeProcess` `GetLastError` `GetModuleFileNameW` `GetModuleHandleA` `GetProcAddress` `GetShortPathNameW` `GetStartupInfoW` `GetSystemTimeAsFileTime` `GetTempPathW` `GetTickCount` `InitializeCriticalSection` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryExW` `MultiByteToWideChar` `QueryPerformanceCounter` `RtlAddFunctionTable` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `SetDllDirectoryW` `SetEnvironmentVariableW` `SetUnhandledExceptionFilter` `Sleep` `TerminateProcess` `TlsGetValue` `UnhandledExceptionFilter` `VirtualProtect` `VirtualQuery` `WaitForSingleObject` `WideCharToMultiByte` `__C_specific_handler`
msvcrt.dll	`__argc` `__dllonexit` `__iob_func` `__lconv_init` `__set_app_type` `__setusermatherr` `__wargv` `__wgetmainargs` `__winitenv` `_amsg_exit` `_cexit` `_fileno` `_findclose` `_fmode` `_fullpath` `_get_osfhandle` `_getpid` `_initterm` `_lock` `_onexit` `_setmode` `_stat64` `_strdup` `_unlock` `_vsnprintf` `_vsnwprintf` `_wcmdln` `_wfindfirst64` `_wfindnext64` `_wfopen` `_wmkdir` `_wremove` `_wrmdir` `_wstat64` `_wtempnam` `abort` `calloc` `clearerr` `exit` `fclose` `feof` `ferror` `fflush` `fprintf` `fread` `free` `fseek` `ftell` `fwrite` `getenv` `malloc` `mbstowcs` `memcpy` `setbuf` `setlocale` `signal` `sprintf` `strcat` `strchr` `strcmp` `strcpy` `strlen` `strncat` `strncmp` `strncpy` `strrchr` `strtok` `vfprintf` `wcscat` `wcscmp` `wcscpy` `wcslen`
WS2_32.dll	`ntohl`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0xea8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.58652`
MD5	`008578f1b7acebecd90bf1f3ac6ee061`
SHA1	`a013b9ba662b5244fd84a9d09404e999dc6333ad`
SHA256	`e77bc44fd6a201637eac3e56a126a84580ab6b33761957d65207c55029764b96`
SHA3	`1538f6df4b7b6c5c7824eea77b2d381650c4cfae7bce052c6d387b2497e839c4`

2

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.05629`
MD5	`5096923956b255386181e7c44af9b552`
SHA1	`9d3f9d245fd7721707ad0dda9d133bc9398684af`
SHA256	`46c2b0eb26f174d48398a544b85203ec233adb7e17d1ced37c888eff8fcfd4c5`
SHA3	`d03024b793e39522b3ee98a5f6e0f548a989115ac2614924a5cfa436c2070a6b`

3

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x568`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.5741`
MD5	`5a64b725f24048ed51af35b9ee7d2fff`
SHA1	`a7bc3d4bf5cc5c36d68c78a5f5b323fcd59ee53e`
SHA256	`c46f3921297eea0c08a032e0d0e0378643892fd1e95814fe6728c944574399cc`
SHA3	`4aec1e212baa392dfd28bceb7027f12f5767f9337caea3a3f5a22c8cdcef2164`

4

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x909b`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.95079`
Detected Filetype	PNG graphic file
MD5	`20d36c0a435caad0ae75d3e5f474650c`
SHA1	`e9e536a2c9d009666e5de2b3e5823269204aabb6`
SHA256	`c3d7626d87aa28c33a054d30be26108fd09ea01ba470d41c94d7bdf6b80b83f2`
SHA3	`a842fc9423038b5b29fc431bb998e715979788e40d387431f74457de25a57fac`

5

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.29119`
MD5	`b21a1cea6c1a6796700a0c7ee394ff2b`
SHA1	`c9b5246eddedabf11534c9c984e305a86151be9f`
SHA256	`01e270742614e92e2a2252ba46cee5b95ad5f13448ac3516f48fb3ee0af3e6c8`
SHA3	`9f392589e26f353c6962e2b9055ac344bfbfe2d82b95cce9441273a296beff95`

6

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.43869`
MD5	`a12bdfb484bb481e1f106beb19aa4765`
SHA1	`18228c2e61981dd29f67cd938ef2a2303d75b81b`
SHA256	`b0835a0afca51295ee6e3827b5e4f79f0632f353c9d10dd78c0dcec478fab8b8`
SHA3	`01196ee531896c2f7ab6c87039bc68252b76609e8e0a26f63a0571485e3b506e`

7

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.89356`
MD5	`3343c0fa901ae372eb7c9d1159386193`
SHA1	`16944a8dcace69148c0628b723e0fa124279a79d`
SHA256	`0cd74e1b2fd85cc9e251e8ab5aca5a303329809c6b0ab70a3e440f9df1aab2be`
SHA3	`a7f6a8159086a1eac7b0d564a6c2f3ccc302ff083602fcb01d9b09a3f45b9a22`

101

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.71858`
Detected Filetype	Icon file
MD5	`d06bb5f499a7e63fdebdde478b53af68`
SHA1	`f4b46ca808dc838d436be1d2c13a40d51bdd8f4f`
SHA256	`038506ab04814afcdce660ffc0de198ebe40a5b0d8e090799549e208c689fed5`
SHA3	`af3d6a80a0ad9e117953a9e1466a44d29b3d32a19a456a9297995e94ead2efd7`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x423000`
EndAddressOfRawData	`0x423060`
AddressOfIndex	`0x41f89c`
AddressOfCallbacks	`0x422040`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000000409470` `0x0000000000409440`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.