| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2024-Feb-24 18:42:26 |
| TLS Callbacks | 2 callback(s) detected. |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: /4
Unusual section name found: .xdata |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. | 14 bytes of data starting at offset 0x21800. |
| Suspicious | VirusTotal score: 2/74 (Scanned on 2024-09-05 10:16:05) |
AVG:
Win64:AdwareX-gen [Adw]
Avast: Win64:AdwareX-gen [Adw] |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 11 |
| TimeDateStamp | 2024-Feb-24 18:42:26 |
| PointerToSymbolTable | 0x21800 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x14800 |
| SizeOfInitializedData | 0x21400 |
| SizeOfUninitializedData | 0xe00 |
| AddressOfEntryPoint | 0x00000000000013F0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2a000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x2a90f |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| libwim-15.dll |
wimlib_add_image_multisource
wimlib_create_new_wim wimlib_delete_image wimlib_export_image wimlib_extract_image wimlib_extract_image_from_pipe_with_progress wimlib_extract_pathlist wimlib_extract_paths wimlib_extract_xml_data wimlib_free wimlib_get_compression_type_string wimlib_get_error_string wimlib_get_image_property wimlib_get_version_string wimlib_get_wim_info wimlib_global_cleanup wimlib_global_init wimlib_image_name_in_use wimlib_iterate_dir_tree wimlib_iterate_lookup_table wimlib_join_with_progress wimlib_load_text_file wimlib_open_wim_with_progress wimlib_overwrite wimlib_print_available_images wimlib_print_header wimlib_reference_resource_files wimlib_reference_resources wimlib_reference_template_image wimlib_register_progress_function wimlib_resolve_image wimlib_set_default_compression_level wimlib_set_image_property wimlib_set_output_chunk_size wimlib_set_output_compression_type wimlib_set_output_pack_chunk_size wimlib_set_output_pack_compression_type wimlib_set_print_errors wimlib_set_wim_info wimlib_split wimlib_update_image wimlib_verify_wim wimlib_write wimlib_write_to_fd |
|---|---|
| ADVAPI32.dll |
ConvertSecurityDescriptorToStringSecurityDescriptorW
|
| KERNEL32.dll |
DeleteCriticalSection
EnterCriticalSection FreeLibrary GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LocalFree MultiByteToWideChar SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte |
| msvcrt.dll |
__C_specific_handler
___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno fwprintf _fmode _gmtime64 _initterm _lock _onexit _putws _setmode _unlock _wcserror _wcsicmp _wfopen _wgetenv _wstat64 abort calloc exit fclose ferror fflush fprintf fputc fputwc fputws free fwrite getenv iswctype localeconv malloc memcpy memmove memset realloc signal strerror strlen strncmp vfprintf wcscat wcschr wcscmp wcscpy wcsftime wcslen wcsncmp wcsrchr wcstoul _wcsdup _isatty |
| StartAddressOfRawData | 0x140028000 |
|---|---|
| EndAddressOfRawData | 0x140028008 |
| AddressOfIndex | 0x1400241ec |
| AddressOfCallbacks | 0x140027038 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000140009060
0x0000000140009030 |