b65cfdc4a25cd4b713f1c6c6de2d1cac0a018a32c05fca30ebda1bbbe3987a15

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jul-18 18:04:53
Detected languages English - United States

Plugin Output

Info Libraries used to perform cryptographic operations: Microsoft's Cryptography API
Suspicious This PE is packed with Themida Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found:
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • ShellExecuteW
 Uses Microsoft's cryptographic API:
  • CryptGetHashParam
  • CryptProtectData
 Has Internet access capabilities:
  • WinHttpCrackUrl
Malicious VirusTotal score: 15/71 (Scanned on 2026-08-18 10:29:09) APEX: Malicious
Bkav: W32.Malware.4B7E5F96
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
ESET-NOD32: Win64/Packed.Themida.L suspicious application
Elastic: malicious (high confidence)
Malwarebytes: Malware.Heuristic.2025
MaxSecure: Trojan.Malware.300983.susgen
McAfeeD: Real Protect-LS!6C6D35DDE8F8
Sangfor: Trojan.Win32.Save.a
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
Trapmine: malicious.moderate.ml.score
tehtris: Generic.Malware

Hashes

MD5 6c6d35dde8f86bf0371df280a6e63a4f 🔍
SHA1 ce495d95cab211cb3705a8b508412e1a47635614 🔍
SHA256 b65cfdc4a25cd4b713f1c6c6de2d1cac0a018a32c05fca30ebda1bbbe3987a15 🔍
SHA3 e2fe7c71ff3926a9d333f83dfaadbe7476b278216f229a424855051b0adf301b 🔍
SSDeep 98304:hgHmg/lm83+17bXTI3E8Ac0XAa7lwIwkwPDhHXiuETHEybe4kap4IVpz:he/lt3+57R8V3a7+IwkwtHX5F8Tlp4q1 🔍
Imports Hash bcc4b306c86bb2c204e9854d586d47f5 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 12
TimeDateStamp 2026-Jul-18 18:04:53
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1e8200
SizeOfInitializedData 0x148600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000AAC058 (Section: .boot)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xf6a000
SizeOfHeaders 0x400
Checksum 0x679812
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 0936a41b196bd66d109e06702cc56542 🔍
SHA1 ad62498805a2abccc3d4badbca687640c3f5ce5a 🔍
SHA256 b4baf44c8a8767e84b29dd54407141f172be9a6ef2ba8c23a0050233317cea86 🔍
SHA3 98506b3998b188b009583938c4adc7fcbda01c7fa6b3e3fc2f6cb51f92fd026b 🔍
VirtualSize 0x1e8181
VirtualAddress 0x1000
SizeOfRawData 0xc5000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.98551

(#2)

MD5 6f05a73365b4482c3cdb5c7412244201 🔍
SHA1 8c66adc722e57f5406035d767f4efbe2d98c9e0d 🔍
SHA256 8d79b0f4aabe993d3cad0e107ac37bb0c363ed611e5c98cf0b4bcb2bf7776776 🔍
SHA3 99fe936c9c1fd1983e73b9652f3261cc7a46a834f23129ae230f55ba47b3ac86 🔍
VirtualSize 0x10d4f8
VirtualAddress 0x1ea000
SizeOfRawData 0xc7600
PointerToRawData 0xc5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.95212

(#3)

MD5 62236ea76ba2e1ba4546fa6d6e6ce961 🔍
SHA1 c12c0f35f9c90099f348a448989a919376e75461 🔍
SHA256 8bc974b1e4f183f7a17b58e62022d0cecd1dbc81b9d25c5e83ed06fec78b66c4 🔍
SHA3 0fcd22e12227bc7d78175ec8d47fa829aa1dd48cada9489bf1af2e83f0db9267 🔍
VirtualSize 0x1c620
VirtualAddress 0x2f8000
SizeOfRawData 0x3000
PointerToRawData 0x18ca00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.93922

(#4)

MD5 4b82475352bebfdb377d348d9b328921 🔍
SHA1 1d00d197b721cd83b2d0fced573b9c3f71816d44 🔍
SHA256 0b98859ee942e3b6bb2832fc315543bc78ae83047116eae1df798f2f55cec073 🔍
SHA3 05f1bf5fa4915f3f4c23a7f10b9dddd5263b3f5baeb8a0968d77e7f23f9571ab 🔍
VirtualSize 0x11d78
VirtualAddress 0x315000
SizeOfRawData 0xa400
PointerToRawData 0x18fa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.69225

(#5)

MD5 2d8e7086cf9eae1ca24c543af05ab151 🔍
SHA1 bb12a341bd03b434d350ebad5c65e4a6526126bf 🔍
SHA256 b5a13b1003e60343e9f4f76b31825bde56e89e9453b067fc0122b0489f241e2c 🔍
SHA3 e4213d3b54950866d44e3a6f58c8aaf0d19467dcecdcb2c638b7c8a049e860bd 🔍
VirtualSize 0x9c80
VirtualAddress 0x327000
SizeOfRawData 0x9e00
PointerToRawData 0x199e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.97022

(#6)

MD5 ed938732bf7029f983c75efcb4df9d9e 🔍
SHA1 4ce294f80017c7a1440e3c6f26a9cec148a3bacd 🔍
SHA256 7830a91b9f88ad3a4e1d39809ddc603833f438987d58aad38e2b4dfcf910f97a 🔍
SHA3 02f23182c41ef5758470d52e0dbda1b2e6549b0e2fe2b66510cad6ca1aa4945d 🔍
VirtualSize 0x2b90
VirtualAddress 0x331000
SizeOfRawData 0x800
PointerToRawData 0x1a3c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.97565

.idata

MD5 d4e5bb4d326549bb288a0292b7640391 🔍
SHA1 99841c6512c53f5eab14c5b9a27a11e29ea13711 🔍
SHA256 ac31ba5fb95b456840cf3c557cd5a5252877462c51b726156f0e2ef06260e58b 🔍
SHA3 080ca763ad8a567a2c5ac6ba8994eab5c54a3d0dad8868b18527f9987dfb7f98 🔍
VirtualSize 0x1000
VirtualAddress 0x334000
SizeOfRawData 0x800
PointerToRawData 0x1a4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.85559

.tls

MD5 6a8c3179ac7c1fe31ba481492886078c 🔍
SHA1 7a0c945484f0ad26c85598e19f7f699457c6d16a 🔍
SHA256 bc35b44384476e2a8d428157545d6f530850048cb4787c34c97ac6730b3aadd2 🔍
SHA3 3911a4e1abfc95b954550032ff8b2f029163785598365109414c2301e8e1d5b0 🔍
VirtualSize 0x1000
VirtualAddress 0x335000
SizeOfRawData 0x200
PointerToRawData 0x1a4c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.27823

.rsrc

MD5 dee4e4502a9297b4bd1a43c2f344a273 🔍
SHA1 837aa1ad864ba3bd3fcf978e14f1a8da0cce5e00 🔍
SHA256 5c71897145bc407eb4c3d2d4fb87661cbf267f437005246a0319c0378f049e9f 🔍
SHA3 7f88d3999f95536666fd7eca08946f41cff1ff95c6b3f5995e74f6bbeb3d8816 🔍
VirtualSize 0x9e00
VirtualAddress 0x336000
SizeOfRawData 0x9e00
PointerToRawData 0x1a4e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.93771

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x76c000
VirtualAddress 0x340000
SizeOfRawData 0
PointerToRawData 0x1aec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 ffdb642fc293284e0527aab2f3d773d5 🔍
SHA1 3df11dc3bf67ad008c2d8a319808a8104560fdd3 🔍
SHA256 131ba8b9a65a6e113618522cc516b23ce84ce26adb30e9613ad1c8d53a6f2256 🔍
SHA3 117086f091064f7be1d5ff868367b126c37a9cdc11eb38011773caf562e7ce33 🔍
VirtualSize 0x4bc800
VirtualAddress 0xaac000
SizeOfRawData 0x4bc800
PointerToRawData 0x1aec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.95916

.reloc

MD5 633e64f989e49a7d9cd10a828028c714 🔍
SHA1 4d777e322b5fb9cb631f19e64c1dfb9ee6132bbe 🔍
SHA256 c329bf5b00dbed183d7632492a01b7f306d2c6004d26464f4d77399f5e1b0eda 🔍
SHA3 fb902b0a92ffb8f25062176dca295ea24badefbeba44483a7bca056eaf36369b 🔍
VirtualSize 0x1000
VirtualAddress 0xf69000
SizeOfRawData 0x10
PointerToRawData 0x66b400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
Entropy 2.4746

Imports

kernel32.dll GetModuleHandleA
d3d11.dll D3D11CreateDeviceAndSwapChain
USER32.dll ScreenToClient
GDI32.dll GetStockObject
ADVAPI32.dll CryptGetHashParam
SHELL32.dll ShellExecuteW
MSVCP140.dll _Strcoll
WINHTTP.dll WinHttpCrackUrl
CRYPT32.dll CryptProtectData
SHLWAPI.dll PathRemoveFileSpecA
bcrypt.dll BCryptOpenAlgorithmProvider
IMM32.dll ImmSetCompositionWindow
D3DCOMPILER_47.dll D3DCompile
VCRUNTIME140_1.dll __CxxFrameHandler4
VCRUNTIME140.dll __C_specific_handler
api-ms-win-crt-runtime-l1-1-0.dll _beginthreadex
api-ms-win-crt-convert-l1-1-0.dll strtol
api-ms-win-crt-string-l1-1-0.dll strcmp
api-ms-win-crt-heap-l1-1-0.dll malloc
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
api-ms-win-crt-time-l1-1-0.dll _time64
api-ms-win-crt-filesystem-l1-1-0.dll _unlock_file
api-ms-win-crt-locale-l1-1-0.dll ___lc_collate_cp_func
api-ms-win-crt-math-l1-1-0.dll acosf
api-ms-win-crt-utility-l1-1-0.dll qsort

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2ab
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.59989
Detected Filetype PNG graphic file
MD5 18a7b0e953c26c1496d4136a7eb1bc96 🔍
SHA1 4602739a0fedd609cc8b34e7b03d8faf4ec26a22 🔍
SHA256 e029b1fd2904193fd48157e29ab7fbff6ae1aa03a315785df86ea363d9937010 🔍
SHA3 5a3c4a2a73fa7318f4efd24e08f58faa572357238f05f521f908f4cb673fbe8c 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x447
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.77374
Detected Filetype PNG graphic file
MD5 b3c7fb55c321b5a4580ca6f17db28fec 🔍
SHA1 65499c12f7d3150ab1feb58a774ea7b108451def 🔍
SHA256 89b0de3a7a8aaa0dea1672f8a6ae547f8c9af8f598d3bbfc1debeac106bf2b66 🔍
SHA3 7bccd014c43b1abb509ea2d11a33205169a36b22876f44401dbdacfd435cca4c 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x61f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.8586
Detected Filetype PNG graphic file
MD5 1c5ede52917ecf363452ba03bab4c4c2 🔍
SHA1 cab571d004de0c48d580dda72a8ce1fa38819d87 🔍
SHA256 73a33b949c0998450bdb883c96032d68922dc51f1ef907a1273cb0ed09ea84fc 🔍
SHA3 985b40c09b36997ed027d6570ddc5149988f34ce29e0f53765849830a007e03d 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xac3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.92795
Detected Filetype PNG graphic file
MD5 d7c637d3333d1e1412255763002fbfe3 🔍
SHA1 a2ec3dae3668512edd58fafa7e9fd09eb5ab6d4a 🔍
SHA256 1328187a3d3667a46fe296003c47efe193f3d1900e672a7f9acd5dfd694995bd 🔍
SHA3 e49c9fc8fdc49daf3d8bf2019191dabc77807fe14d4c2e3de859b24f232757c8 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xfeb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93958
Detected Filetype PNG graphic file
MD5 7995338fa2a32b569cada02889c7a62f 🔍
SHA1 f472deae48f6b4129d5dd5c184b5e9cc519a61c8 🔍
SHA256 1cb589479cfa18427d167f88505ac37e7a7618b98da4e0685b600bc67c30dbca 🔍
SHA3 3a1665e81f77b469c9f57d0dc94e4d6567de1a047d3d3700b274f15c9eab6de9 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x27b7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.97235
Detected Filetype PNG graphic file
MD5 96309a864478097102c713d3cf58e070 🔍
SHA1 c10433ef67fe7694287558afa2321d93f2cf3829 🔍
SHA256 e5dfdb6b480d3f2e8d3e96b4551a50cfb7d798559b4ecbfab25f4bf140d1cdf6 🔍
SHA3 0d2e5c55ab14cd00ca76720e8f9f88e93654902813aa75d90f1a1919d47ab8de 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x48fb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96912
Detected Filetype PNG graphic file
MD5 03be9cf86a334301b46d8109d86d2496 🔍
SHA1 ca3f60f645e2ba88bafcc0cb877bc8c56fdd06fa 🔍
SHA256 241985141afd385e4c2ad2949fad4aaa3a6d860ff137f3231b136ecf003f2e3a 🔍
SHA3 9c74659a54a5ea989fa2a92ff67455240898945cb60a9319990ca198d6d1c494 🔍

105

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92127
Detected Filetype Icon file
MD5 465c17c7d07c727c9db7ecf11d6e3704 🔍
SHA1 6840baa4d3cda309604407ef949e927cdf940fe7 🔍
SHA256 27496384bc5084fffc57523bc3f1439ebe6a7d4f1bac6b082a9b30a1906d32e6 🔍
SHA3 3de8affd3e0e33f967bf82c13bacac9db710284ed286d1544bc31826bc388953 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x77f031b6
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 20
ASM objects (35721) 4
C objects (35721) 10
C++ objects (35721) 39
Imports (35721) 6
Imports (35215) 29
Total imports 492
C++ objects (LTCG) (36243) 24
Resource objects (36243) 1
151 2
Linker (36243) 1

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .themida has a size of 0!
Leave a comment

No comments yet.