a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Feb-22 19:26:05 |
| Detected languages |
English - United Kingdom
English - United States |
Plugin Output
| Info | Libraries used to perform cryptographic operations: | Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .|rJ
Unusual section name found: .GCT Unusual section name found: .)>, |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 50/71 (Scanned on 2026-09-27 03:43:29) |
ALYac:
Gen:Variant.Application.Tedy.7956
AVG: Win64:MalwareX-gen [Misc] AhnLab-V3: Malware/Win.VMProtect.R761993 Alibaba: Packed:Win64/VMProtect.e033ab9c Antiy-AVL: Trojan[Packed]/Win64.VMProtect Arcabit: Trojan.Application.Tedy.D1F14 Avast: Win64:MalwareX-gen [Misc] Avira: TR/W64.Agent BitDefender: Gen:Variant.Application.Tedy.7956 Bkav: W32.Malware.22B2F38C CTX: exe.trojan.vmprotect CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 99) DeepInstinct: MALICIOUS DrWeb: Trojan.Inject6.27414 ESET-NOD32: Win64/Packed.VMProtect.AC suspicious application Elastic: malicious (high confidence) Emsisoft: Gen:Variant.Application.Tedy.7956 (B) F-Secure: Trojan.TR/W64.Agent Fortinet: Riskware/Application GData: Gen:Variant.Application.Tedy.7956 Google: Detected Gridinsoft: Trojan.Heur!.02212023 Ikarus: PUA.VMProtect K7AntiVirus: Riskware ( 005cde2a1 ) K7GW: Riskware ( 005cde2a1 ) Kingsoft: Win32.Troj.Undef.a Lionic: Trojan.Win32.VMProtect.4!c Malwarebytes: Trojan.MalPack.PES.Generic McAfeeD: ti!A849E0C77415 MicroWorld-eScan: Gen:Variant.Application.Tedy.7956 Microsoft: Trojan:Win64/Tedy!pz Paloalto: generic.ml Panda: Trj/GeneticOnn.gen Sangfor: Trojan.Win64.Tedy.Vlcv SentinelOne: Static AI - Suspicious PE Skyhigh: Artemis Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence TrellixENS: Artemis!FC4C13973D35 TrendMicro: Trojan.Win32.ZYX.USBLEH26 TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLEH26 VBA32: Trojan.Inject VIPRE: Gen:Variant.Application.Tedy.7956 Varist: W64/ABApplication.UZWG-5117 Webroot: Win.Trojan.Gen Yandex: Riskware.VMProtect!qD6zQfxiwXw alibabacloud: Riskware:Win/Wacatac.B9nj tehtris: Generic.Malware |
Hashes
| MD5 | fc4c13973d35400640794fef290476ab 🔍 |
|---|---|
| SHA1 | 1f363819b1644942838c972be35ed95e42defee7 🔍 |
| SHA256 | a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c 🔍 |
| SHA3 | 23f40b87b7906835a3d05ddca1d5b6d045381b44d401e45fc675c87950774b30 🔍 |
| SSDeep | 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Yw:ee3Zqd5My9lqnSw 🔍 |
| Imports Hash | 61721c42ee4289228270e26dbfe3b6e9 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 10 |
| TimeDateStamp | 2026-Feb-22 19:26:05 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x482200 |
| SizeOfInitializedData | 0x15a800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000120D796 (Section: .)>,) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x21eb000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x482140 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.rdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x9aa1a |
| VirtualAddress | 0x484000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.data
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x69924 |
| VirtualAddress | 0x51f000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.pdata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x34a70 |
| VirtualAddress | 0x589000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
.fptable
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x100 |
| VirtualAddress | 0x5be000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.|rJ
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xa2fb26 |
| VirtualAddress | 0x5bf000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
.GCT
| MD5 | 2b912de5bc5f083a262d1e40807fae02 🔍 |
|---|---|
| SHA1 | 86461a63ac8479bee5077bc8a83ca9a83e53722a 🔍 |
| SHA256 | 871a50b2a6fc79b8824483aae61562ba194fa49c5e09f2ed3daece2d7df249f7 🔍 |
| SHA3 | 70e97bfb1312d72d4beba99133cd63afcf41acc6a17a87cfafe8a48f8473db9c 🔍 |
| VirtualSize | 0x1ba8 |
| VirtualAddress | 0xfef000 |
| SizeOfRawData | 0x1c00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.33528 |
.)>,
| MD5 | 17e75fe8da740f5e038dd712a8c8cbb0 🔍 |
|---|---|
| SHA1 | 9ca0f88993bf4ba36eba33c99aa9b879a4fb2124 🔍 |
| SHA256 | 4739ad1f1d14b984a73f012752d0f8674bcf0d1a7089b7f5be60e4e5cfa4cb32 🔍 |
| SHA3 | 86d330a1a5d8df91e8629d5cf98aed8c547db2a9ecf3ea892e5b5c79e8f7365b 🔍 |
| VirtualSize | 0x11d9958 |
| VirtualAddress | 0xff1000 |
| SizeOfRawData | 0x11d9a00 |
| PointerToRawData | 0x2000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
|
| Entropy | 7.7392 |
.rsrc
| MD5 | d93892d8b7d48e903c0e17122698cf5a 🔍 |
|---|---|
| SHA1 | 667c71aba3faac83f0370d6fd5bdf041e1c11cd4 🔍 |
| SHA256 | 19031e391d0399eb8b2f31b5c286f0523fe7bfe4078d8c0931625195a9adb943 🔍 |
| SHA3 | 637b3fd3fefa05dd01ccb877a5d6a2eaf8b86538a4ea3181cf89b3219a26c5a6 🔍 |
| VirtualSize | 0x1e298 |
| VirtualAddress | 0x21cb000 |
| SizeOfRawData | 0x1e400 |
| PointerToRawData | 0x11dba00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.27411 |
.reloc
| MD5 | 192b64e57da7c60d53ac660f0e35d6eb 🔍 |
|---|---|
| SHA1 | 2dae67eef607111ec489455092afc0102c41276a 🔍 |
| SHA256 | aa1d0579d5f2d99a3cab49ed8bd65af61fa71dc23e18fa762b8f09fd123f35c2 🔍 |
| SHA3 | 2d4ff0b95ac6cfad22404219c9c11dbb735845492026c8a7bdccaea5de33ec21 🔍 |
| VirtualSize | 0xbc |
| VirtualAddress | 0x21ea000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x11f9e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 2.10346 |
Imports
| KERNEL32.dll |
RemoveVectoredExceptionHandler
HeapDestroy HeapAlloc HeapReAlloc HeapFree GetProcessHeap DeviceIoControl InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetCurrentThreadId CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetProcessMitigationPolicy SetProcessMitigationPolicy GetSystemTimeAsFileTime GetTickCount64 GetWindowsDirectoryW GetSystemWindowsDirectoryW GetModuleFileNameA GetModuleHandleW GetModuleHandleExA LocalAlloc LocalFree CopyFileW MoveFileExA MoveFileExW ReplaceFileW FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx CreateToolhelp32Snapshot Module32FirstW Module32NextW SetFileAttributesA InterlockedPushEntrySList RtlUnwindEx WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage AddVectoredExceptionHandler HeapQueryInformation HeapSize ReadConsoleW GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetErrorMode GetLastError CloseHandle GetTempPathA ReadFile GetTempFileNameW GetFullPathNameW GetFileTime GetFileSize GetFileInformationByHandle FlushFileBuffers GlobalAlloc FindNextFileW FindNextFileA FindFirstFileW FindFirstFileA FindClose DeleteFileA CreateFileA CreateDirectoryW GetCommandLineW RtlDeleteFunctionTable LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock RaiseException CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue RtlPcToFileHeader GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FlsGetValue WriteFile SetFileTime SetFilePointerEx GetTimeZoneInformation GlobalUnlock RtlUnwind FlsAlloc GetStdHandle GetModuleFileNameW GetModuleHandleExW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError GetFileSizeEx MapViewOfFile UnmapViewOfFile CreateFileMappingA FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW CreateFileW FindFirstFileExW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx InitializeCriticalSectionAndSpinCount |
|---|---|
| USER32.dll |
OpenClipboard
CloseClipboard SetClipboardData GetClipboardData EmptyClipboard TrackMouseEvent GetKeyState GetCapture SetCapture ReleaseCapture ScreenToClient IsWindowUnicode GetForegroundWindow IsIconic DefWindowProcW wsprintfW LoadCursorW ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect |
| ADVAPI32.dll |
SetSecurityDescriptorOwner
AdjustTokenPrivileges AllocateAndInitializeSid ConvertSidToStringSidW SetNamedSecurityInfoW SetEntriesInAclW CryptGenRandom CryptReleaseContext CryptAcquireContextW StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle RegSaveKeyW RegRestoreKeyW RegQueryValueExW RegOpenKeyExW RegFlushKey RegCloseKey LookupPrivilegeValueW GetFileSecurityA SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorOwner GetSecurityDescriptorDacl FreeSid OpenProcessToken |
| SHELL32.dll |
CommandLineToArgvW
SHCreateItemFromParsingName |
| ole32.dll |
CoSetProxyBlanket
CoUninitialize CoInitializeEx CoCreateInstance |
| OLEAUT32.dll |
SafeArrayGetElement
SafeArrayGetLBound VariantInit SysFreeString SysAllocString VariantClear SafeArrayGetUBound |
| IMM32.dll |
ImmGetContext
ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow |
| D3DCOMPILER_47.dll |
D3DCompile
|
| NETAPI32.dll |
NetUserGetInfo
NetApiBufferFree |
| bcrypt.dll |
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider BCryptGenRandom |
| PROPSYS.dll |
PSGetPropertyKeyFromName
|
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | UNKNOWN |
| Size | 0x59cf |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.96519 |
| Detected Filetype | PNG graphic file |
| MD5 | 6d130ddf0dc907da98d164a1e66de4d0 🔍 |
| SHA1 | 21932fb10c737c7f0cea862777df643ddf03c04c 🔍 |
| SHA256 | f4394bcb20b6f4b861ea50c92a9de6e8d1b46be488718e57d94e354a0a274abd 🔍 |
| SHA3 | 7e45bcf945589e79448a78659a7625a9d7f9626f1485d5926753ddaad97a9d0e 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.57501 |
| MD5 | afae166293e950eaa28c2b8a082c3efb 🔍 |
| SHA1 | 15f7e1cc0c2dde5c08545cce9f610dc51396c7b3 🔍 |
| SHA256 | 53528abc82fb81396b800b97c592486d75a460016e13fac687c0508ac441e0c8 🔍 |
| SHA3 | 80d4707017c5ac3a4e5727a610347457166ffb33793a35ed3c95d32e38c5a004 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.26968 |
| MD5 | 7b78dc311d9569a6c5b0c0eec06f8bbb 🔍 |
| SHA1 | 7f54fa19a899e782c8d0a1351b672f657e034d0f 🔍 |
| SHA256 | 37fd79b56275e4357c2a06c72a2b5f5adcc3058aeb48dee2ca6c4692563ce810 🔍 |
| SHA3 | cb0d41efa75b7040686eaeb0d15cc04e0d56b51ee4fe2516642dcd2c50f396bb 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.67864 |
| MD5 | 937f9d57799b30a173d05eaf71c184f0 🔍 |
| SHA1 | 0d7c6aa6755cf7439d72c47fa586a5f5a6164f38 🔍 |
| SHA256 | 8c3d4fdbf568c87d313f84ecf91d6c0573ecdd91250374902b000fadb8d9da40 🔍 |
| SHA3 | 5258be10260c70bcba7a2591604915c44bbbaf4cc0d459c86df68e3ff3e64632 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.39456 |
| MD5 | d591393de3ae04ab7de7ee8918afe00e 🔍 |
| SHA1 | 67c45ffd1e98bded66432b9ef160b24837218070 🔍 |
| SHA256 | 6b8490187e38d61535c29e646a2ff137be7271ed96340aa594d6b5370976d816 🔍 |
| SHA3 | 27192bb34e1789a4e44acb03d0a45943a35596c6f5699060ed6f260f64306838 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.14686 |
| MD5 | e79621cac296ba2d4c39e96d735dbda7 🔍 |
| SHA1 | a8a7db68fc7dee607358c69e38a39675daf9a9a2 🔍 |
| SHA256 | 302ff7c4c9f44260b2d0e22ffc1b3f8c252be265688004bbf0d904e854214244 🔍 |
| SHA3 | 5f0c3266309100872701ea99e1186e1b2c77e20d4b49afb407de2a5c6605bbce 🔍 |
101
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | UNKNOWN |
| Size | 0x5a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.79908 |
| Detected Filetype | Icon file |
| MD5 | 27e5893af3d7bbb7f501ec66f8399252 🔍 |
| SHA1 | 93507faa0adb4f62b150387b5825ba8ee7699820 🔍 |
| SHA256 | 3aac4fbc2090903ba9f6a0fb0b2f4809afe0d248bf132fb8ee216f4c3e8e1ff1 🔍 |
| SHA3 | 5190017b4310807a893e15c9cfe2d594cb1da00ea9d88ee5aa788a317f8778b6 🔍 |
1 (#2)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x188 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.89623 |
| MD5 | b8e76ddb52d0eb41e972599ff3ca431b 🔍 |
| SHA1 | fc12d7ad112ddabfcd8f82f290d84e637a4d62f8 🔍 |
| SHA256 | 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8 🔍 |
| SHA3 | 37f83338b28cb102b1b14f27280ba1aa3fffb17f7bf165cb7b675b7e8eb7cddd 🔍 |
Version Info
TLS Callbacks
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140573a40 |
RICH Header
Errors
[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .rdata has a size of 0!
[*] Warning: Section .data has a size of 0!
[*] Warning: Section .pdata has a size of 0!
[*] Warning: Section .fptable has a size of 0!
[*] Warning: Section .|rJ has a size of 0!
Leave a comment
No comments yet.