b6a9eed9cc94a7af5837490dfb333877

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_EFI_APPLICATION
Compilation Date 1978-Dec-10 22:07:00

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Suspicious The PE is possibly packed. Unusual section name found: .bss16
Unusual section name found: .payload
Section .payload is both writable and executable.
The PE only has 0 import(s).
Info The PE is digitally signed. Signer: Microsoft Windows UEFI Driver Publisher
Issuer: Microsoft Corporation UEFI CA 2011
Safe VirusTotal score: 0/66 (Scanned on 2018-03-14 21:30:50) All the AVs think this file is safe.

Hashes

MD5 b6a9eed9cc94a7af5837490dfb333877
SHA1 a6e9636bac913efb4fc6557c1b1a2e53945d8646
SHA256 c45b8e37880e423d891cc218d99a0013d7a2a4678f9fcee43dfde12104fa3ba6
SHA3 d11db9a3868d5a17666590cbd234137b3a0ca11890220a4ee980b02f167b3abe
SSDeep 768:r8EH3V3B9rCCcErBj+j57Ny3CNsCgtDoeNMzWSP:rZH39nrCCcErJ+j5xOSshceNM9
Imports Hash d41d8cd98f00b204e9800998ecf8427e

DOS Header

e_magic MZ
e_cblp 0
e_cp 0
e_crlc 0
e_cparhdr 0
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x40

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 1978-Dec-10 22:07:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 42.0
SizeOfCode 0x448f
SizeOfInitializedData 0x1961
SizeOfUninitializedData 0x33a20
AddressOfEntryPoint 0x00004CB0 (Section: .payload)
BaseOfCode 0x327c
BaseOfData 0x7708
ImageBase 0x20000
SectionAlignment 0x10
FileAlignment 0x10
OperatingSystemVersion 0.0
ImageVersion 0.0
SubsystemVersion 0.0
Win32VersionValue 0
SizeOfImage 0x3a6b0
SizeOfHeaders 0xa00
Checksum 0xaadc
Subsystem IMAGE_SUBSYSTEM_EFI_APPLICATION
SizeofStackReserve 0
SizeofStackCommit 0
SizeofHeapReserve 0
SizeofHeapCommit 0
LoaderFlags 0
NumberOfRvaAndSizes 16

.bss16

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x2800
VirtualAddress 0xa00
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.payload

MD5 4c073549dfad0e1d2752a96d1b52e679
SHA1 4af02ec58339b0a40dd2013be21569286e1dfc24
SHA256 41fe35b9e54830f988d10ca81bf1a4d700704835adf2b76f234261959db3f4e8
SHA3 7c4e8e4ceb2a5747c97c90acb30b68abf4108561255a1e0d0ac3627319519987
VirtualSize 0x5df0
VirtualAddress 0x3200
SizeOfRawData 0x5df0
PointerToRawData 0xa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.58126

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x31220
VirtualAddress 0x9000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc

MD5 1a6c6a44bf804e6b1593a166c0849000
SHA1 cddef21cbf518ae064f11259b98161ee77720bde
SHA256 f530354fb430bf893ea1f0426fc7141fb07c0e90d1522c32633664c2ef58a763
SHA3 84803d2b572318fcf1cd1ce95e1c39b63e41192c65522c452efc295ca80685af
VirtualSize 0x490
VirtualAddress 0x3a220
SizeOfRawData 0x490
PointerToRawData 0x67f0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 6.60683

Imports

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not reach the requested directory (offset=0x0). [*] Warning: Section .bss16 has a size of 0! [*] Warning: Section .bss has a size of 0!