af09bf587303feb4a9e9088b17631254

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2016-May-21 04:25:40
Detected languages English - United States
TLS Callbacks 1 callback(s) detected.
Debug artifacts E:\Developpement\CSandbox\x64\Release\CSandbox.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig4 (h)
Microsoft Visual C++ 8.0
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • GetProcAddress
Uses Microsoft's cryptographic API:
  • CryptAcquireContextW
Info The following exploit mitigation techniques have been detected Stack Canary: enabled
SafeSEH: enabled (0 registered handlers)
ASLR: enabled
DEP: enabled

Hashes

MD5 af09bf587303feb4a9e9088b17631254
SHA1 605970dd08620c99972dcf4a268e833ae5499be8
SHA256 f34d727fd304e219a1337c2fa47da7e240ab0071d9c4fcdf90bd334b5cee24b3
SHA3 ddc87fd7ca11d32cf6f06282d1df120f590e6cb19705bb25ed2db78d007b839c
SSDeep 192:Nmq5wYm55AZxlgxmDIHHdQFqLxyHqYWyFBqAc3Q5tfyyH+I:4ewYVxlMmDsjLxyHjc3Lo
Imports Hash 1e3dfa54ef487af8ee950d495e17839d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2016-May-21 04:25:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1800
SizeOfInitializedData 0x2600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x1ae4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xb000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7a5ddca6f858307407f67cb70355ec2d
SHA1 763c3704d1e22a95d141b8d03e4a1e5ddd1fee3a
SHA256 776ce073a33139695710621349020fb517f17762a4246e523fdf3b0502e28a36
SHA3 386f506dd0264b97709b0f8b86630128c44bdda607fc5abf86aa750fc205e3b6
VirtualSize 0x1608
VirtualAddress 0x1000
SizeOfRawData 0x1800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.87407

.rdata

MD5 b94b9de09f5b5ab4fe783c35c6854040
SHA1 b724ed8bb74e7d48ddb50e9a967f48bc35b6aadf
SHA256 56786b388b1a74f9664f92c5060030bf5bbe0fdf99f600073c29847490f9d8d2
SHA3 66001b895c42991365a6facd6c693c1264ce3d26d5efd3a575bb229290c1422f
VirtualSize 0x124e
VirtualAddress 0x3000
SizeOfRawData 0x1400
PointerToRawData 0x1c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.07696

.data

MD5 68b406c04bc9e4ec5ff79e9f763b3a95
SHA1 e043fc99ab8cfdd5ec599fc1ddbbeb0dc587e648
SHA256 2a381f818ff8b987e871b0d6cd8c9903f41bb5c8e5704d8910eb3f72f3ab97a1
SHA3 ec60836f3f625a7ab1e5416d64d23722353d3eb923a981f129d816c7bb93888c
VirtualSize 0x698
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.519063

.pdata

MD5 dd6d98548e09bd2e526c8da520b0716b
SHA1 58770ce415ab5cca3d9562684fbe5a4c1d64a2bd
SHA256 f645ccd660cd43e0a170f99591a0aa18be6b7357029d390fff2f7ad0a83fa587
SHA3 28f5fb0f855b16cea106795414f21b8ad4feb2364401b43a544e3f503070658d
VirtualSize 0x1e0
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x3200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.63112

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 d5c44f659751a819616c58c9efe38e80f2b84cf621036da99c019bbe4f1fb647
VirtualSize 0x2
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.gfids

MD5 b125a3fa4321e0aebe343c8778f88205
SHA1 04ddd8990cb2aeb55398d4e443da5dc17635c07f
SHA256 f0d8224cb8d3e3080a89a1493ad6be0490d33e60b21b0b56256cfd75fea28d5b
SHA3 6d49401bada0cfc56c147f453aaa56753ffa4dff1718a5741b38730af3c9bc9f
VirtualSize 0x1c
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.142636

.rsrc

MD5 fb20ae2a7910d36ef7e1ed0b22953dbf
SHA1 53b0a43a879cf778730d8bd7309f76d73d40a678
SHA256 3ecd84e2d8e73672dba01382283fde59898dcd230ee8af5d9870cef983142e6a
SHA3 fb54220a9f61705a14f0e710089b97f8a702c4a7d55d8bc748583142a521eb88
VirtualSize 0x1e0
VirtualAddress 0x9000
SizeOfRawData 0x200
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

.reloc

MD5 8b16d21787000ee3b52a5815174641a9
SHA1 e727a8ce4b84af97bd06edfd86e71c0114b9d8a1
SHA256 6f9d02cd83bd42154e271b9315d6c3812a0b79273c1ce4951da091325698d54b
SHA3 4410dc676166866a6fa56b573e685df6bf6cb64ccfdcd6186e860ea89e0f44f1
VirtualSize 0x34
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x3a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.648813

Imports

VCRUNTIME140.dll __C_specific_handler
__telemetry_main_return_trigger
memset
__telemetry_main_invoke_trigger
api-ms-win-crt-stdio-l1-1-0.dll __stdio_common_vfwprintf
__acrt_iob_func
__p__commode
_set_fmode
api-ms-win-crt-runtime-l1-1-0.dll _seh_filter_exe
terminate
_register_onexit_function
_initialize_onexit_table
_set_app_type
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_crt_atexit
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
KERNEL32.dll GetLastError
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExA
GetProcAddress
GetModuleHandleW
RaiseException
ADVAPI32.dll (delay-loaded) CryptAcquireContextW

Delayed Imports

Attributes 0x1
Name ADVAPI32.dll
ModuleHandle 0x5050
DelayImportAddressTable 0x5038
DelayImportNameTable 0x3ab0
BoundDelayImportTable 0x3ad8
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 f9bb44aef537881abf673616b9f61c56530cf3a96292ccf2ae5654beffc84ec6

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2016-May-21 04:25:40
Version 0.0
SizeofData 75
AddressOfRawData 0x3538
PointerToRawData 0x2138
Referenced File E:\Developpement\CSandbox\x64\Release\CSandbox.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2016-May-21 04:25:40
Version 0.0
SizeofData 20
AddressOfRawData 0x3584
PointerToRawData 0x2184

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2016-May-21 04:25:40
Version 0.0
SizeofData 876
AddressOfRawData 0x3598
PointerToRawData 0x2198

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2016-May-21 04:25:40
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x140007000
EndAddressOfRawData 0x140007001
AddressOfIndex 0x140005098
AddressOfCallbacks 0x140003228
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_1BYTES
Callbacks 0x140001070

Load Configuration

Size 0x94
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140005000
SEHandlerTable 0
SEHandlerCount 0

Errors

[!] Error: Could not read the response (asio.ssl:335544539).