| Architecture |
IMAGE_FILE_MACHINE_I386
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date |
1970-Jan-01 00:00:00
|
|
Suspicious
|
The PE is possibly packed. |
The PE only has 0 import(s).
|
|
Suspicious
|
The file contains overlay data. |
440 bytes of data starting at offset 0x248.
|
|
Suspicious
|
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
| MD5 |
e6b5e968feb1f6cf14f24910cf3ef7f9
🔍
|
| SHA1 |
f4f84c44cf8a5f619c772108898df64ce5cfff4f
🔍
|
| SHA256 |
b1e95b9e5f9b5e5e1e1dce460989bcd8aa28827ba70f215d6764f2720cf8e48f
🔍
|
| SHA3 |
5d3617ecc2d1cc2de9f4b6532a065433ed4c87521a3696d50fa7b6d410e0a436
🔍
|
| SSDeep |
3:GltlVg//t/vkw/l/1ltlltvl7//llrllVltUt1l9tllFll3tslHlHl//lnll/nR:ya3t/8w9LB
🔍
|
| Imports Hash |
d41d8cd98f00b204e9800998ecf8427e
🔍
|
| e_magic |
MZ
|
| e_cblp |
0
|
| e_cp |
0
|
| e_crlc |
0
|
| e_cparhdr |
0
|
| e_minalloc |
0
|
| e_maxalloc |
0
|
| e_ss |
0
|
| e_sp |
0
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x40
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections |
1
|
| TimeDateStamp |
1970-Jan-01 00:00:00
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xe0
|
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
| Magic |
PE32
|
| LinkerVersion |
1.0
|
| SizeOfCode |
0x200
|
| SizeOfInitializedData |
0
|
| SizeOfUninitializedData |
0
|
| AddressOfEntryPoint |
0x00001000 (Section: .text)
|
| BaseOfCode |
0x1000
|
| BaseOfData |
0
|
| ImageBase |
0x400000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
0.0
|
| SubsystemVersion |
4.0
|
| Win32VersionValue |
0
|
| SizeOfImage |
0x2000
|
| SizeOfHeaders |
0x200
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve |
0x100000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
b808a19dacdf2c652d5f8c93c5885a97
🔍
|
| SHA1 |
d49f6f383cf2a30230540af386a5239ec2ff6b2c
🔍
|
| SHA256 |
db16ee96f5540451313ccbb6d2ad050161ad6680b4db3c292d08747947cbf850
🔍
|
| SHA3 |
a3098903c5b5e8dc29aa4e96ab2786d43d8dce2f68c64c299893d28928af0fac
🔍
|
| VirtualSize |
0x200
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
0.102745
|
[*] Warning: The WIN_CERTIFICATE and its alignment padding exceed the available certificate data.