b3eb5fa950f798e33eb40b2740a9a21adb031542372c17a7b4aa381f605ba7cf

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jun-22 19:34:24
Detected languages English - Canada
English - United Kingdom
English - United States
CompanyName 1nonlywrld
FileDescription Exitlag Loader
FileVersion 1.0.0.1
InternalName loader.exe
LegalCopyright Copyright (C) 2026
OriginalFilename loader.exe
ProductName ExitlagLoader
ProductVersion 1.0.0.1

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • schtask
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • discord.com
  • https://discord.com
  • https://discord.gg
Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Malicious The PE contains functions mostly used by malware. Code injection capabilities:
  • WriteProcessMemory
  • OpenProcess
  • VirtualAllocEx
  • CreateRemoteThread
 Possibly launches other programs:
  • CreateProcessW
  • system
 Uses Microsoft's cryptographic API:
  • CryptReleaseContext
  • CryptGenRandom
  • CryptAcquireContextW
 Functions related to the privilege level:
  • CheckTokenMembership
  • OpenProcessToken
 Manipulates other processes:
  • WriteProcessMemory
  • OpenProcess
Malicious VirusTotal score: 4/68 (Scanned on 2026-07-12 04:16:56) APEX: Malicious
Bkav: W32.Malware.BBB1B9F1
Elastic: malicious (high confidence)
Symantec: ML.Attribute.HighConfidence

Hashes

MD5 cfd93685b796b67d7f1237d7801b8f99
SHA1 3a28ec5b7a529655ddd16bd0844703a25425c17f
SHA256 b3eb5fa950f798e33eb40b2740a9a21adb031542372c17a7b4aa381f605ba7cf
SHA3 23b3a898da9106098b8dbe08c4c24bc8fc13e85a244b4a101fe0e13fbf2cf22b
SSDeep 3072:waxtP28UWpC23DNmLSwaVHjEpLUM4WOKHsEM9GvMWbNPZYC1zN6zFq5i:wWjUWpFDNmLSwXpF49KHi6tZN
Imports Hash 7d63127a5b25e13d3f7fac5a37314ebf

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jun-22 19:34:24
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1b000
SizeOfInitializedData 0x74a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000019C58 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x93000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7b440fe0ceecfc11f42810be1a624209
SHA1 ff891bb726e623ba53d1ed5fd53e3ddb34f9dae3
SHA256 dcf403c2858f16d2201b587334807bbd241e55d0cea6798c643589b24a3402b9
SHA3 101a2f3d8cc20c7c4ba563ae2e3e025917449e77ce326ec803222b64e4851b72
VirtualSize 0x1afbc
VirtualAddress 0x1000
SizeOfRawData 0x1b000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.3116

.rdata

MD5 e1c0aecc000a930d23db40c81bb44ac9
SHA1 42c719b878c18de463dae309ea1da27f36338da8
SHA256 f30bfd45b41ce142eec28ed54386654848ab1d34a59b7403890222cd6bbf99a5
SHA3 cfd51a9b97b28fd39176751de437e0416bd6e25c7e02392096a5eca4adc665f8
VirtualSize 0x8bd4
VirtualAddress 0x1c000
SizeOfRawData 0x8c00
PointerToRawData 0x1b400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.56534

.data

MD5 4431f9692cc34d7c029f36a6b8362ca4
SHA1 377599bfb5dc264ae0e945458b4f200de33874f3
SHA256 0b817f940f90a617f41b08360fffa83969f14b52272d4558450c631089ace36f
SHA3 b95ac0bbb5232f49e414b30a2ea671c8a4a23c05151007f023bd891a2d1bc063
VirtualSize 0x888
VirtualAddress 0x25000
SizeOfRawData 0x200
PointerToRawData 0x24000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.65876

.pdata

MD5 0ca421c3767c6d696e31627e25e75f56
SHA1 ce34d5cac29a3af4ab2420a974c80ac4f82d251e
SHA256 321a319f8325726876678285ce55b8756e61cec0386950861690f5a8ccc59e92
SHA3 a25a2fb102e6f36d08319db4b51c294436fc907e99a9b01f277301d09496aa98
VirtualSize 0x1008
VirtualAddress 0x26000
SizeOfRawData 0x1200
PointerToRawData 0x24200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.95254

.rsrc

MD5 88921ec828fd75d2c1c517a0e567c1a1
SHA1 b25318b9d8c0b90437b5aea36bbd4ca84449da6b
SHA256 9a5225b01eb8d984b29c4a570c589053bd528aa5512502362953e7ebf89ac657
SHA3 61a714463783e1e06722aca011de972d3ac2abff9dd1f450bc33ba80db257761
VirtualSize 0x69f60
VirtualAddress 0x28000
SizeOfRawData 0x6a000
PointerToRawData 0x25400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.00983

.reloc

MD5 d9043da9fb7adf43632689bae71493f9
SHA1 2479c349fb0769423a7b028da841cfb59cb0c0b1
SHA256 6812b74cc1bac3a8853d459dde5dfcc83f56ba7764bc9128874ebf2d26c51cd1
SHA3 79f0e8335ead37199452859e2d7f02eec33d210208883938088acfdd912b1877
VirtualSize 0x8c
VirtualAddress 0x92000
SizeOfRawData 0x200
PointerToRawData 0x8f400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.7733

Imports

ADVAPI32.dll GetTokenInformation
CryptReleaseContext
CheckTokenMembership
FreeSid
OpenProcessToken
AllocateAndInitializeSid
CryptGenRandom
CryptAcquireContextW
KERNEL32.dll FillConsoleOutputCharacterA
FindFirstFileW
WriteProcessMemory
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
EnterCriticalSection
SetConsoleTitleA
FindNextFileW
GetCurrentProcess
SetConsoleScreenBufferSize
GetStdHandle
WriteConsoleA
WriteFile
SetConsoleMode
GetConsoleCursorInfo
RemoveDirectoryW
GetModuleFileNameW
SetConsoleWindowInfo
GetProcessId
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
ReadConsoleA
GetSystemDirectoryW
GetModuleHandleA
OpenProcess
MultiByteToWideChar
ReadFile
Sleep
GetConsoleMode
GetTickCount64
SetConsoleCursorInfo
GlobalAlloc
DeleteFileW
CloseHandle
CreateThread
K32EnumProcesses
FillConsoleOutputAttribute
WriteConsoleW
GetProcAddress
GlobalLock
VirtualAllocEx
GetFileSize
DeleteCriticalSection
SetConsoleCP
CreateProcessW
WideCharToMultiByte
GetConsoleWindow
CreateRemoteThread
QueryFullProcessImageNameW
SetConsoleOutputCP
VirtualFreeEx
SetConsoleCursorPosition
GetTickCount
GlobalUnlock
GetExitCodeProcess
AcquireSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
CreateDirectoryW
GetExitCodeThread
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
ReleaseSRWLockExclusive
USER32.dll OpenClipboard
CloseClipboard
SetWindowLongA
GetWindowLongA
BringWindowToTop
EmptyClipboard
ShowWindow
SetWindowPos
SetClipboardData
SetForegroundWindow
COMDLG32.dll GetOpenFileNameW
SHELL32.dll ShellExecuteExW
MSVCP140.dll ?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll memmove
_CxxThrowException
__std_exception_copy
__C_specific_handler
wcsrchr
memcmp
memcpy
__current_exception_context
__current_exception
__std_exception_destroy
memset
api-ms-win-crt-utility-l1-1-0.dll srand
api-ms-win-crt-string-l1-1-0.dll toupper
_wcsicmp
wcsncpy
tolower
strcmp
api-ms-win-crt-runtime-l1-1-0.dll __p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_set_app_type
__p___argc
_initialize_onexit_table
_initialize_narrow_environment
_invoke_watson
_seh_filter_exe
_configure_narrow_argv
_initterm_e
_get_initial_narrow_environment
terminate
_cexit
system
_crt_atexit
_register_onexit_function
_initterm
api-ms-win-crt-conio-l1-1-0.dll _getch
api-ms-win-crt-stdio-l1-1-0.dll _set_fmode
__p__commode
_kbhit
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
malloc
_callnewh
free
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.28685
MD5 e399a23b12b290d7334270f7fa0922a4
SHA1 e87dce8d12633e537efa7540625452820c8bcc7a
SHA256 0b77607cd29ab180030ee0ddc0e23334eeb890369c91c46a8b6b75a68057144b
SHA3 5391ee2695eebf4fdcf07313ebb9e399865d139001a536b26a1d0f37ec272dfa

2

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.68689
MD5 9a70ca1330cbcc7931a625993f669c46
SHA1 c263e8f22080760f002439bcba6ad6329e03a6d7
SHA256 04a0317c4f171fa4fced38116e67873b080e86a8e034378a3cc7f08f90ca0b7a
SHA3 cdeb22da74f37c332297cee13680c9f5927b28c21a65017e1018cb0f0b9b7ef2

3

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.1899
MD5 0d55f4964b390ce88073025125cd9142
SHA1 6a1cdd41f73352de68fa40a23b3f02e3ce244476
SHA256 1a5a5e742640e502f078bf365126724f9a0e97152edb8464b0e12ee223fa1f9f
SHA3 e2a222d48b7a7973f46ee4b346752089fd8d0062d36208714af92d70c7e728bf

4

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72562
MD5 0e6ad237190f751b40173313e4829859
SHA1 cace26a83424ae1f85a5fc92f8694388e06644d1
SHA256 c1b56399c559d20fbc46d2557869e4f6c05a244fc881291ba2a51dfbd2c1f96b
SHA3 323b2bd679236a0ec8546de5ad7b3906f4eda98488e81283eff6525b8f5c4e7a

5

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.51983
MD5 8df70bba47c340a03c4748c84429014c
SHA1 d919511c84a4cdec5c9ef3baa28866cc51e74d2e
SHA256 40560fad525c3074de82fd126134b9064398f7c6cfdd7840b4eea33c07b8968a
SHA3 bd3f0595486f9d3df174e3a62dfc85a9a35928677b5351831f26ac06263d2117

6

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.38805
MD5 4ce4f22b920f85a2351d5715761640b2
SHA1 4395dfce1c7c6e3bee84cc822b31261df34563a5
SHA256 9a4237857c4ef11d5462fb8ebbd1c6e047fcb0a2567702f97bac8f225f4fa567
SHA3 77e2ae5b3115f22c13e6830199e1dcadc0b2d2cc45418ad147bf9d885b6e09f1

7

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.23668
MD5 e3335f8f9a91d2f4021b157de27dd344
SHA1 305cbbcae94067e52bb23596dc2904f4788fc824
SHA256 be511a01269c61d705ce166f6fca542aefd301f0c37eb788d8d7c2e6a7caaf1e
SHA3 45aed49e3fdd7f5d6c129bed00cfc9b99776e51f19cfee12dd315a61125255d8

8

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.09496
MD5 89177db544625fb1daa0ddbd6dc5770c
SHA1 223bd3f08669cb6ebbbc867e1d8d17b27a3c371d
SHA256 2ac74982287f75f7c8110a799ed1f014d29c6bf9099dcb7332503f642b815f24
SHA3 be682207a09a99d4c506bb4aeb3fe7757deb53b6bffd827e3a456665d352a03b

9

Type RT_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.77442
MD5 8ceb61d9b7ffe02daec63beeda4074d9
SHA1 e2cdb073064bab557e014c904b858a1e36068158
SHA256 ca67e51d398ff3b40cc5a63dafa7ea415cc00a53d9c67e4c0c3ae352fb876835
SHA3 7c765b9a2110f879fe412f0d4d0c30739a7b7fbbb338abf6a107aef7ed84c419

101

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.01226
Detected Filetype Icon file
MD5 8bd3cd6b83e995093febc060ec76aeb3
SHA1 b0338c581ad2beceda2bccbaa46d96383d3dc4a1
SHA256 4f16960f06a3608a7d49573795526ff6790c65d8015f0419d72a373e55ed8ac7
SHA3 dab5ecc0662f74eef0913882133480a1e4285be23cab87b03392d82bdce0c981

1 (#2)

Type RT_VERSION
Language English - United Kingdom
Codepage UNKNOWN
Size 0x2c0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31284
MD5 8f21d5627f878493724f43eff6e256dc
SHA1 ef028af97478bb8c92f253d17541f194c1bfefb1
SHA256 a34df347220e30915d652a805916019afc75984591e4d420c8251d9fe819d1a5
SHA3 3daf55066240027cb5ba9d1f00787e0de9ed3b39fac1fd72591ea87e421a6d8d

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.1
ProductVersion 1.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - Canada
CompanyName 1nonlywrld
FileDescription Exitlag Loader
FileVersion (#2) 1.0.0.1
InternalName loader.exe
LegalCopyright Copyright (C) 2026
OriginalFilename loader.exe
ProductName ExitlagLoader
ProductVersion (#2) 1.0.0.1
Resource LangID English - United Kingdom

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jun-22 19:34:24
Version 0.0
SizeofData 892
AddressOfRawData 0x20c28
PointerToRawData 0x20028

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Jun-22 19:34:24
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x140020fc8
EndAddressOfRawData 0x140020fd0
AddressOfIndex 0x140025780
AddressOfCallbacks 0x14001c5b8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140025040

RICH Header

XOR Key 0x2e8f82a9
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 16
ASM objects (35207) 3
C objects (35207) 10
C++ objects (35207) 30
Imports (35207) 6
Imports (33145) 11
Total imports 157
C++ objects (LTCG) (35224) 1
Resource objects (35224) 1
151 1
Linker (35224) 1

Errors

Leave a comment

No comments yet.