Manalyze report for b4b31e19e1d9028b3d63b7ac5074d7f71ede736d6185c11d25863f6415c6ece9

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Sep-04 03:55:35

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Contains another PE executable: This program cannot be run in DOS mode.` `Contains domain names: github.com`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryW LoadLibraryExW GetProcAddress` `Possibly launches other programs: CreateProcessW` `Functions related to the privilege level: OpenProcessToken`
Malicious	The file contains overlay data.	`4548310 bytes of data starting at offset 0x3a800.` `The file contains a PE Executable after the PE data.` `Overlay data amounts for 94.9954% of the executable.`
Malicious	VirusTotal score: 5/48 (Scanned on 2026-09-04 09:14:18)	`APEX: Malicious` `Bkav: W32.Malware.56F274BB` `CrowdStrike: win/malicious_confidence_70% (W)` `Symantec: ML.Attribute.HighConfidence` `Trapmine: suspicious.low.ml.score`

Hashes

MD5	`40907bef2fa10f778980db1c537472d2` 🔍
SHA1	`2e82d36d80e0315cd6202d3f9a4f7721b72e48ae` 🔍
SHA256	`b4b31e19e1d9028b3d63b7ac5074d7f71ede736d6185c11d25863f6415c6ece9` 🔍
SHA3	`f04ebc33c513f008bb2901295405d20bc277f8feb4d488f048469f433757510a` 🔍
SSDeep	`24576:KQMm6P+nGH21cGNtNI7ZyK5k1c7NLshWfLcKLY6cfNCO3x6XtVseKuNzqN5ti3L:PAufIOhh8cgq7RFti3Lu` 🔍
Imports Hash	`e5fd6c75030a39603cf44cad39b49784` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Sep-04 03:55:35
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x24800`
SizeOfInitializedData	`0x16800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000000000000A6E0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x3f000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`6e1e4e5f3a164f736736f51fbdcf8d8e 🔍`
SHA1	`4994dec9ccfeb23d4f6be2569735425c545790c2 🔍`
SHA256	`ad28ef6b48c5061a76e1602579369ba3048b485dc729d08531b89cefb75b973f 🔍`
SHA3	`5a508984a62957d3fef2af01567e8b313cfe9736051785505d2c0a1afa0b173a 🔍`
VirtualSize	`0x24620`
VirtualAddress	`0x1000`
SizeOfRawData	`0x24800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.45571`

.rdata

MD5	`e5d91e453b6440688f5af0a60c0da93d 🔍`
SHA1	`e8a27ce0de2a9beb7dc815ed6fd83b36bc910370 🔍`
SHA256	`7b851895f555f68f17b2035f8b23df3077e41b4a310bd484d4478146f0d8251e 🔍`
SHA3	`ac1e97a214cfd073bfe1d75d02071213a3e9c18c396d47d335c7737dfa1caa11 🔍`
VirtualSize	`0x1268a`
VirtualAddress	`0x26000`
SizeOfRawData	`0x12800`
PointerToRawData	`0x24c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.2475`

.data

MD5	`7efa06f6f0e71a34cf3a07b63c6dac8d 🔍`
SHA1	`f2ca46588b2fdf8168b4c53563338f9523d83b19 🔍`
SHA256	`5f80332149478cb8d0ab7c678c3e0d3521231a79276b348117c126988d41e526 🔍`
SHA3	`649e9bebf3e3d95f41aa4265eb29f8c0f7b01dc1697734025d8ff8b87c3eadf9 🔍`
VirtualSize	`0x17e8`
VirtualAddress	`0x39000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x37400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.23288`

.pdata

MD5	`fdac4de3d24b7008eb8e9a61bbe5f564 🔍`
SHA1	`3fb9d256db7fa8d54ad2c2ed50febce519baca0b 🔍`
SHA256	`e334134619eb0c5a6c714e12a4a2394d49935d6651ef0a15816e4d85f3aab24b 🔍`
SHA3	`f6b49a6a4053d30d7ad3bf59001c690575a8c372a21ab7e2f66ee2c78d38650c 🔍`
VirtualSize	`0x1c8c`
VirtualAddress	`0x3b000`
SizeOfRawData	`0x1e00`
PointerToRawData	`0x38000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.22082`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x3d000`
SizeOfRawData	`0x200`
PointerToRawData	`0x39e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`a1b0ca9a1e9c4c8005d060eee61e67dd 🔍`
SHA1	`d1f8b8d82587741cfb15d9c7493ca94a4d7044d0 🔍`
SHA256	`48206f4341f366ab3a3c693a3654a4226aa31046da83296930dc7fd60a777124 🔍`
SHA3	`55364ff127c849ca5c0830adc08ac32b2f4db65da56dcf9a75f6f0ec5f093601 🔍`
VirtualSize	`0x7f8`
VirtualAddress	`0x3e000`
SizeOfRawData	`0x800`
PointerToRawData	`0x3a000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.40358`

Imports

bcrypt.dll	`BCryptCloseAlgorithmProvider` `BCryptCreateHash` `BCryptHashData` `BCryptFinishHash` `BCryptDestroyHash` `BCryptOpenAlgorithmProvider`
COMDLG32.dll	`GetOpenFileNameW`
ole32.dll	`CoCreateInstance` `CoUninitialize` `CoTaskMemFree` `CoInitializeEx`
SHELL32.dll	`ShellExecuteExW` `SHCreateItemFromParsingName`
ADVAPI32.dll	`OpenProcessToken` `GetTokenInformation`
dxgi.dll	`CreateDXGIFactory1`
KERNEL32.dll	`GetProcessHeap` `HeapSize` `HeapReAlloc` `SetEndOfFile` `SetStdHandle` `SetEnvironmentVariableW` `FreeEnvironmentStringsW` `GetEnvironmentStringsW` `WideCharToMultiByte` `MultiByteToWideChar` `GetCPInfo` `WriteConsoleW` `GetStringTypeW` `FlsFree` `GetOEMCP` `GetACP` `CreateFileW` `CloseHandle` `GetFileAttributesW` `DeleteFileW` `FindFirstFileW` `FindNextFileW` `FindClose` `GetModuleFileNameW` `GetCurrentProcess` `WaitForSingleObject` `GetExitCodeProcess` `LoadLibraryW` `FreeLibrary` `CreateProcessW` `LoadLibraryExW` `FindResourceW` `LoadResource` `LockResource` `SizeofResource` `QueryPerformanceCounter` `GetCurrentProcessId` `GetCurrentThreadId` `GetSystemTimeAsFileTime` `InitializeSListHead` `SetUnhandledExceptionFilter` `GetStartupInfoW` `GetModuleHandleW` `IsValidCodePage` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlPcToFileHeader` `RaiseException` `GetLastError` `SetLastError` `FlsAlloc` `FlsGetValue` `FlsSetValue` `EncodePointer` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `GetStdHandle` `WriteFile` `ExitProcess` `TerminateProcess` `GetModuleHandleExW` `GetProcAddress` `GetCommandLineA` `GetCommandLineW` `IsProcessorFeaturePresent` `RtlCaptureContext` `RtlVirtualUnwind` `IsDebuggerPresent` `UnhandledExceptionFilter` `ReadFile` `GetConsoleMode` `ReadConsoleW` `HeapFree` `GetFileType` `HeapAlloc` `VirtualProtect` `CompareStringW` `LCMapStringW` `FlushFileBuffers` `GetConsoleOutputCP` `GetFileSizeEx` `SetFilePointerEx` `FindFirstFileExW`

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Sep-04 03:55:35
Version	`0.0`
SizeofData	`816`
AddressOfRawData	`0x349bc`
PointerToRawData	`0x335bc`

TLS Callbacks

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1400390c0`

RICH Header

XOR Key	`0x13c93879`
Unmarked objects	`0`
C++ objects (33145)	`153`
ASM objects (33145)	`7`
ASM objects (35403)	`10`
C objects (35403)	`16`
C++ objects (35403)	`43`
C objects (33145)	`13`
Imports (33145)	`15`
Total imports	`115`
Unmarked objects (#2)	`1`
Linker (35727)	`1`

Errors

Leave a comment

No comments yet.