aa6a1f39db7644973ca5b80c433a1c93

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2022-May-14 11:37:47

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • qEMu
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Functions related to the privilege level:
  • OpenProcessToken
Enumerates local disk drives:
  • GetDriveTypeW
Suspicious The file contains overlay data. 11083335 bytes of data starting at offset 0x58800.
The overlay data has an entropy of 7.98722 and is possibly compressed or encrypted.
Overlay data amounts for 96.8329% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 aa6a1f39db7644973ca5b80c433a1c93
SHA1 c036f615d7ecf49c1d8d66d8869226ca4b8db45c
SHA256 3e66c5ef8ff31136816be679282c5f3500469f68d29a8ad89beaebf087f16fa4
SHA3 202a46bbe12f61dabf07ce8b883c409bc436e00cedfc7fcb3305dae862d683b6
SSDeep 196608:JqFXXLfBAsJL2Vmv6+DkaSAADVnNgwQ+dtLZ7k21z/UwG+s90JbJeCaWv45SO:IXbfLL2Vmv6m4phNjd7r1LUw39eCjvd
Imports Hash 1e92fd54d65284238a0e3b74b2715062

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2022-May-14 11:37:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x28400
SizeOfInitializedData 0x30000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000ADD0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x6d000
SizeOfHeaders 0x400
Checksum 0xaef528
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b49d09f7901f9de2daf24c470cb771e7
SHA1 73ad2628305e067829b8b1f3d0009efcd5b53884
SHA256 ec0eda0c70494c3a7d48901b480ca19175309cb93d5d65ca79ea9f242239325e
SHA3 3e80d6eb6d7e76d976760916af89f4db0eae5a2f4f9dbbd1117f918e4ff529b3
VirtualSize 0x28300
VirtualAddress 0x1000
SizeOfRawData 0x28400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47826

.rdata

MD5 023db8808916d6c032febbfb1df806ac
SHA1 50404b5793f968b27f5aa0f49062abfb62c20e73
SHA256 cd06a79dfdc3ab78193f6c2071122a4fd770f9cd7c6a90299a0b191afa9f5cb2
SHA3 a7daac0ef3173e51650da64734cc5692e81eb25197f5f82cc2cb690e97538919
VirtualSize 0x11ece
VirtualAddress 0x2a000
SizeOfRawData 0x12000
PointerToRawData 0x28800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.72469

.data

MD5 d1c1e87e5f7741ab9fca5beefaac90e4
SHA1 50af998308d4da834bae865eaa94254f4d0f9802
SHA256 92855026b84877393d9277b6424fa20718a8cd4cc0b15de4f7c1de41eace32b8
SHA3 495d2326e39eea5dbc40c5179b457b151bb1b5a93a72cc0ccca9cfbd54cb91c8
VirtualSize 0x103f8
VirtualAddress 0x3c000
SizeOfRawData 0xe00
PointerToRawData 0x3a800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.81872

.pdata

MD5 b09be0fa5052107ddcdc36458a350376
SHA1 07b21f3e1fe7f8c4bc9a36fd9dcd398b88050ca8
SHA256 6fa24c43ac65054b8573caea9ce6d9fce06471b6f74aa8e9fb6b0a84b1145d13
SHA3 09d7a65b8a2920a90e6ebc4f643fe57e8bc12d90fa0d12ed54615ed69e815c87
VirtualSize 0x20a0
VirtualAddress 0x4d000
SizeOfRawData 0x2200
PointerToRawData 0x3b600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.29452

_RDATA

MD5 09aebb00bfe76bd823369406de8f86be
SHA1 fca2ec268df91a171c8a372686c20f06fb2e1256
SHA256 535cbd3c3a7c0a6336cf0adecf9a240065ef4778f5fc66cda98883ab87053fdc
SHA3 af63bf3f154c7a2be36e55dad2947ed3de53b4932c712593ab064de0004864f6
VirtualSize 0xf4
VirtualAddress 0x50000
SizeOfRawData 0x200
PointerToRawData 0x3d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.95769

.rsrc

MD5 871e66afbe49b81a92f39534183c37e1
SHA1 bf44dce66cdf7f447425ff25b11288a4f08978ea
SHA256 406a8dbceed0944d0a118f5cbf6fb93795552b1d73b38075ca0058f96e93b795
SHA3 54b790142c98393e3804a3b962324c1066099bf45a8cc66d3c5f3e27fa2b42ef
VirtualSize 0x1a424
VirtualAddress 0x51000
SizeOfRawData 0x1a600
PointerToRawData 0x3da00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.28533

.reloc

MD5 05c299686e71f4c1774832a18d66b110
SHA1 99c701200e54ad64dcf4ff5d26953ec9981bd965
SHA256 62caad3bc4fbed574d3900c5aba7fd7f91696a754ba95a642fb5bd6d8e814574
SHA3 9d788f253a0d11ff15b78882555a61ef8195904d9c7fcc05cb13b55c5c86c579
VirtualSize 0x764
VirtualAddress 0x6c000
SizeOfRawData 0x800
PointerToRawData 0x58000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.2414

Imports

USER32.dll CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
COMCTL32.dll #380
KERNEL32.dll IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetCPInfo
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
ADVAPI32.dll OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GDI32.dll SelectObject
DeleteObject
CreateFontIndirectW

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x175a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.87089
Detected Filetype PNG graphic file
MD5 a92b36e34e8164ead1acb2402751f8f9
SHA1 9ab225b3a5cc99856cf7c2c66dd3ab30bc68e977
SHA256 b79515df7350c5d9b5329587444d1aaebdd8f74232162b7e5d99170c3eacb604
SHA3 5b076ec2bf9d4ce2ee8dbacf658497a5d3b60cba9979c92f1a5580498b533dda

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.54072
MD5 d9f9f5b96a663b642f97cc769ac5c790
SHA1 86c990e7afa63c4b89a083d66a99354bf7073cf8
SHA256 57c167455530be8a51b5d136009368f5a79beb26195ebb804691f0fb0e874cce
SHA3 61901145f5afe4a3d238aed48363c05c614cfc8e30466fa43787e37f372b168f

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72145
MD5 ec07aa7d0bba4923df0859db5cfcb8a5
SHA1 9ba8162aee9ddea908052bddb144bfd81ddc06a1
SHA256 e89d00a17f3ac84349a8f301ff43c7feca6d9673372f04424cec404a66a14ce0
SHA3 3f9ebe78208ed4847e3266c0fe31de44595339b355fb95de1b9c271fa34c323d

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.89066
MD5 a0caa78553ed90e3a979aa3ff5c1a0ea
SHA1 90a3c958d845ccb757535f7edbd64dfb3723a532
SHA256 c543fab55ce1434f55c3b25978ab969ff6ef2d402e4fd55c94d096f6b622d64e
SHA3 91da757d9b2d5454f4ee39cf63a85f949b96f7e536f4ac7d0b4f3f16fdc59c5d

5

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.14875
MD5 17be8ab5f569de82aa0f756b3ecaddb8
SHA1 2c8787de913c20c617c509e6d177676ccc53a0bf
SHA256 1e27f41b73af9e6413a3417859db329c687948e8e467456dee10cae75edb468f
SHA3 80b569ab6b0cfd250aeb59b1898312f1637cadf535e3205edcfacba43f3ba416

6

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29959
MD5 795d53cce4e8806556dbe4d5b51f58bd
SHA1 dea5b321a7829da274c0dd5316bb26b3771df1e9
SHA256 237162d2aa53de996fc281d111ccce4c88d2ad7472eadbb76ff7e3946a14961d
SHA3 204705da70f61165f6387c42e801c327ff983dac37486967ab0f0174f91a6a59

0

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79908
Detected Filetype Icon file
MD5 5d0d3f1edf971abc079b81bef90bcfe5
SHA1 9d58827f692c2e19b47a465f56c8778cb8702b97
SHA256 6a8124dbd3d705eb42a8624692816bf39a625294671431942192c8818bb44b62
SHA3 ff0833fc85e43b389adc156c0d1984db392cb6061ad712f39384f1b7acff8dba

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x589
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28542
MD5 d8c6356183d02e4b415da1b1db3d48cd
SHA1 2af122f3e3cc9570b8d88c533d3e838b60885c4a
SHA256 4651a8a4475fec58232d0c9e1443ae83a0bad0d7d105dacd1ae152fc0a8c7de4
SHA3 0f63e58fae4c487281f9143feb182cbf6ce675ec923048279d44c91bb92c9725

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2022-May-14 11:37:47
Version 0.0
SizeofData 772
AddressOfRawData 0x38d0c
PointerToRawData 0x3750c

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x14003c008
GuardCFCheckFunctionPointer 5368882200
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xd1711f86
Unmarked objects 0
ASM objects (29395) 7
C++ objects (29395) 190
C objects (29395) 10
253 (28518) 4
C++ objects (30034) 39
C objects (30034) 17
ASM objects (30034) 9
Imports (29395) 11
Total imports 139
C objects (VS2019 Update 11 (16.11.8) compiler 30138) 20
Linker (VS2019 Update 11 (16.11.8) compiler 30138) 1

Errors

<-- -->