Manalyze report for a86a91e5177843d73c83d9e135111e39c0b5d15f2ebb2ec029070812bc266fba

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Oct-12 18:05:33

Plugin Output

Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`32fd3cbbeca219dc6ef23d8f1b496f19` 🔍
SHA1	`eced20e2d08100c52289ae5fcc986fff23bf95b7` 🔍
SHA256	`a86a91e5177843d73c83d9e135111e39c0b5d15f2ebb2ec029070812bc266fba` 🔍
SHA3	`f22b9dbe973f9845f85f3d3a68642b4fce6529783f6c3739ed0ebec3d4de4ade` 🔍
SSDeep	`49152:8PvqpbJO54hRzYinBpcf1DFPhB+H3jKio+:8nqpbg54hRzYinBO1LBYKib` 🔍
Imports Hash	`5e9bee715943b425353d4c10f2ded0d4` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	2026-Oct-12 18:05:33
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x1f4200`
SizeOfInitializedData	`0xa0400`
SizeOfUninitializedData	`0x400`
AddressOfEntryPoint	`0x000000000029CB24 (Section: .sxdata)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0x3f5000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x1f4030`
VirtualAddress	`0x1000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`

.data

MD5	`4429e2b51b45e6db21aa85d8ac8f6858 🔍`
SHA1	`1138ec935568f3f9a42e622b5ee0fcd111796094 🔍`
SHA256	`7836454d394543ebc2f9aacc60254fbe0c6b7a47364cb8d9a1d4d78b06fa5d3b 🔍`
SHA3	`f6038bce0115d6078b0310544de64024cda2cd8323880059b2b99453054860cb 🔍`
VirtualSize	`0xd80`
VirtualAddress	`0x1f6000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.427433`

.rdata

MD5	`edfa26dcfea14d2bab22bc44605b0606 🔍`
SHA1	`f188a98f9336318b81ecfcea6b8d71380dedb3b0 🔍`
SHA256	`367de242b7ef12d2eb0505d0bab388ffd3b2c9fcb4d0bb9b01a4007795a56fce 🔍`
SHA3	`c520d190e25884e41c959eb703c6d3e5e562533dadffaf7481120dba946128f5 🔍`
VirtualSize	`0x790e0`
VirtualAddress	`0x1f7000`
SizeOfRawData	`0x79200`
PointerToRawData	`0x1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.75196`

.eh_fram

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x4`
VirtualAddress	`0x271000`
SizeOfRawData	`0x200`
PointerToRawData	`0x7a400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.pdata

MD5	`511443b0db5559e65bf92af7dd4b59b8 🔍`
SHA1	`2fdd18ec077eac885484005071a3e377b51f8d7b 🔍`
SHA256	`3dc734fdbf17aa5df62930b71366e958f60cf53d129ff84a6eabab149c945348 🔍`
SHA3	`46de508056f2e916be7b5af82c8de9076854152e87391b2028d1543de56eb38f 🔍`
VirtualSize	`0xdbcc`
VirtualAddress	`0x272000`
SizeOfRawData	`0xdc00`
PointerToRawData	`0x7a600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.25123`

.xdata

MD5	`24c8f5d14f903339f7a2a1fc6d84c042 🔍`
SHA1	`8f5afd159b2483575353067fafa1e12f1b0373cb 🔍`
SHA256	`0abca1b82ec7e11428596d9f36a6c27a901c854d12e04edbb86a47a4ae5c7d99 🔍`
SHA3	`9877a3c9d8569d2f1e99e1e5376a75e3cb04dd2a7f52e5abea9e69f3284fc145 🔍`
VirtualSize	`0x12078`
VirtualAddress	`0x280000`
SizeOfRawData	`0x12200`
PointerToRawData	`0x88200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.97237`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x2e0`
VirtualAddress	`0x293000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`704e8342dcb5426ddb8de549cc90eb2b 🔍`
SHA1	`77905d86df2946dd1060906e16732132a0ba4624 🔍`
SHA256	`4b5586a2c5e7cb44a52cb9401e808c7d90746ee687a98895415c9e5ca4d10e0d 🔍`
SHA3	`b0bd8ac2a1ff649e7a596a5cd292a904819b4a0a98a72ec80f16c046ad77c752 🔍`
VirtualSize	`0x31b4`
VirtualAddress	`0x294000`
SizeOfRawData	`0x3200`
PointerToRawData	`0x9a400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.40137`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x298000`
SizeOfRawData	`0x200`
PointerToRawData	`0x9d600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`fe25e2db54d8c8a41e399c8efb4b45cc 🔍`
SHA1	`f46ae10f5a1c43fda2c7f99bc46987ef90db6200 🔍`
SHA256	`9c64e9ddf0042bc33184e9b7d848c5bba1ee6789f127bfb99d033abcd10daba5 🔍`
SHA3	`be39ad07923fa5775cd016fdbf8b52bda3bddf38bb39fe88abf277436b550fab 🔍`
VirtualSize	`0x2e48`
VirtualAddress	`0x299000`
SizeOfRawData	`0x3000`
PointerToRawData	`0x9d800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.40194`

.sxdata

MD5	`f6db62db99d9bcad33eae5b9a97a6ae1 🔍`
SHA1	`7dde18c2f75cf6f43eb282ce77df32f6c1f32166 🔍`
SHA256	`410fa94df8ec21e685e64b82b9c95909425f61ef3b30e9a94228024091d9b02f 🔍`
SHA3	`1f5c7cb31bddd3b20802b6f93873560afe0c9cad596535c450946010d438c5d6 🔍`
VirtualSize	`0x158024`
VirtualAddress	`0x29c000`
SizeOfRawData	`0x158200`
PointerToRawData	`0xa0800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.97567`

Imports

bcryptprimitives.dll	`ProcessPrng`
api-ms-win-core-synch-l1-2-0.dll	`WaitOnAddress` `WakeByAddressAll` `WakeByAddressSingle`
api-ms-win-crt-environment-l1-1-0.dll	`__p__environ`
api-ms-win-crt-heap-l1-1-0.dll	`_set_new_mode` `calloc` `free` `malloc`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr` `pow` `roundf`
api-ms-win-crt-private-l1-1-0.dll	`memcmp` `memcpy` `memmove`
api-ms-win-crt-runtime-l1-1-0.dll	`_set_app_type` `__p___argc` `__p___argv` `_cexit` `_configure_narrow_argv` `_crt_atexit` `_exit` `_fpreset` `_initialize_narrow_environment` `_initterm` `_initterm_e` `_set_invalid_parameter_handler` `abort` `exit` `signal`
api-ms-win-crt-stdio-l1-1-0.dll	`__acrt_iob_func` `__p__commode` `__p__fmode` `__stdio_common_vfprintf` `fflush` `setvbuf`
api-ms-win-crt-string-l1-1-0.dll	`memset` `strlen` `strncmp` `wcslen`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not reach the TLS callback table.
[*] Warning: Section .text has a size of 0!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.