afd5c6a1c774f41dd398bf2a07db4dea07d84994b437115485572f2cfd76877b

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Aug-28 00:41:37
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Malicious The PE contains functions mostly used by malware. Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • CreateRemoteThread
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
 Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • Process32FirstW
  • Process32NextW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 76d52c07e7ada648621cad25a6d2a7b8 🔍
SHA1 7d2426afcb3369f08bc3db493a429612afa89bb6 🔍
SHA256 afd5c6a1c774f41dd398bf2a07db4dea07d84994b437115485572f2cfd76877b 🔍
SHA3 85cebfbb9b7b4a7d3b93e15c0f3d1b802f2cfbe4b6fd0675148403b9e17cd9d4 🔍
SSDeep 384:SLVBa48YhIK/kD4tb7trk3E7dHe7gnaR:SLwYhdzJmEhWsQ 🔍
Imports Hash 52c0eaebbe48554d7678e56077f8b882 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Aug-28 00:41:37
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x2000
SizeOfInitializedData 0x2a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000024A0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x9000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b2f34eabd70b8410838ddc7cae4aeb1e 🔍
SHA1 77c48acaba6657dac25d02ad497a5e8780cbfaf7 🔍
SHA256 efa9b7ecd414ea5f71f177448bfec92105bbee566807fb51c9255aee79f25dfb 🔍
SHA3 fa24210421dc1d4482543a989f4a0466125b1c94c0caf9f23cdaaf3769c7c6f8 🔍
VirtualSize 0x1e38
VirtualAddress 0x1000
SizeOfRawData 0x2000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.87708

.rdata

MD5 9a9b9deca7526121214165b05fbdf3ee 🔍
SHA1 573d832b87ee5b13b5856c98e7ff51d0bfe529c2 🔍
SHA256 e2ffffb10f416120251df1f6a192c195727f0d5b25dc6d710c66ff97cabcc148 🔍
SHA3 30cb4d1ef1b70c90462ee27834c0adcf5a3520560f4dbc7aa45d3a02f7d00d51 🔍
VirtualSize 0x1ebe
VirtualAddress 0x3000
SizeOfRawData 0x2000
PointerToRawData 0x2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.06279

.data

MD5 a39d387ae965af5d138783d713aeda00 🔍
SHA1 6e2f2b44ec621515af28401e7e310f65fdfd408c 🔍
SHA256 579c7b22bf575d8efafc4a14421b26689678bc16c15b207cf31f9f19a72e76de 🔍
SHA3 f838718c20c3d490ce115e1e92c41fcd04c8d86ff37cf95c19706064a0cb5243 🔍
VirtualSize 0x110
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.53249

.pdata

MD5 d37733f4e1c1b7d60d855ae12530cb24 🔍
SHA1 0ef459283849a1705b10127a306dd790aba6cb65 🔍
SHA256 202a3c4da91fdd52a07b82a5ecacc7f304a08320a424c317fadda57a9be14d20 🔍
SHA3 bc9de8f6421bbab9b5d3f9633f8a734f31ad084fcb9c461204e199bb992e0941 🔍
VirtualSize 0x24c
VirtualAddress 0x6000
SizeOfRawData 0x400
PointerToRawData 0x4600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.57316

.rsrc

MD5 0b35de07beeb30d1d6013cbca2846303 🔍
SHA1 c98626ce4d587471d115df6f42cb0f5221f13689 🔍
SHA256 c9ed38ed40cfe8c1718cbf78be16bb4aa76b76097a449f9ea315aee9fd20df0d 🔍
SHA3 76678b071daa4ec33980be3b819260aea5ade31193b0580e19b41e16156137cf 🔍
VirtualSize 0x1e0
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x4a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

.reloc

MD5 9a63b8dd8aac3f87bcafd59e4e3ee827 🔍
SHA1 d3bc3c27141165e370d0dbf29e69486d1dc630bf 🔍
SHA256 280d1454e6ee5a327b71ab579b80d1e5f87a74759ee55c799bb6efbf9da8343b 🔍
SHA3 af51bac251fa4fa305c6de5a0b6cb1631ebf5bd996969916083d286c9643ae47 🔍
VirtualSize 0x2c
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x4c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.671628

Imports

KERNEL32.dll GetStdHandle
GetFileAttributesW
GetFullPathNameW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
CreateRemoteThread
OpenProcess
GetTickCount64
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
QueryPerformanceCounter
USER32.dll IsWindowVisible
GetWindowTextW
GetWindowTextLengthW
EnumWindows
GetWindowThreadProcessId
VCRUNTIME140.dll __C_specific_handler
memset
wcsrchr
__current_exception
__current_exception_context
memcpy
api-ms-win-crt-string-l1-1-0.dll _wcsicmp
wcscpy
wcslen
wcsncpy
api-ms-win-crt-conio-l1-1-0.dll _getwch
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
_kbhit
__p__commode
_set_fmode
__stdio_common_vfwprintf
fflush
api-ms-win-crt-utility-l1-1-0.dll qsort
api-ms-win-crt-convert-l1-1-0.dll wcstoul
api-ms-win-crt-runtime-l1-1-0.dll _initterm_e
exit
_initterm
_get_initial_wide_environment
__p___argc
__p___wargv
_initialize_wide_environment
_c_exit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_set_app_type
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
_cexit
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-28 00:41:37
Version 0.0
SizeofData 644
AddressOfRawData 0x3e54
PointerToRawData 0x3254

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140005000

RICH Header

XOR Key 0x1165cb32
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 18
Imports (35721) 2
ASM objects (35721) 4
C objects (35721) 10
C++ objects (35721) 19
Imports (33145) 5
Total imports 88
C objects (36256) 1
Resource objects (36256) 1
Linker (36256) 1

Errors

Leave a comment

No comments yet.