Manalyze report for b74daf3f3886c09dad47a70ff3fcb832decbdd671039cc9fc3dd7d90740bfee1

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Sep-09 15:46:54

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Looks for Qemu presence: QEmu qemu`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Possibly launches other programs: CreateProcessW` `Can create temporary files: GetTempPathW CreateFileW` `Functions related to the privilege level: OpenProcessToken` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: OpenProcess Process32FirstW Process32NextW`
Suspicious	The file contains overlay data.	`16921047 bytes of data starting at offset 0x6b000.` `The overlay data has an entropy of 7.99762 and is possibly compressed or encrypted.` `Overlay data amounts for 97.4753% of the executable.`
Malicious	VirusTotal score: 6/66 (Scanned on 2026-09-09 19:33:06)	`APEX: Malicious` `Bkav: W32.Malware.213D647A` `Cylance: Unsafe` `Elastic: malicious (high confidence)` `SentinelOne: Static AI - Suspicious PE` `Zillya: Dropper.Agent.Win32.746397`

Hashes

MD5	`d43fcbfc0ed2e533cadcf5a034537e1f` 🔍
SHA1	`536379ae5912a0450b5a8e5715e371f1d762598c` 🔍
SHA256	`b74daf3f3886c09dad47a70ff3fcb832decbdd671039cc9fc3dd7d90740bfee1` 🔍
SHA3	`631a4c1bda63f59f5c4f956e7e395a57369d56933d059112aa754f7c05b0a623` 🔍
SSDeep	`393216:B1Ddssu+CbyTOuQH3Y1DdH+ETYr9RnXcwX:B1JhfHQH3Y1JeE8r9RXjX` 🔍
Imports Hash	`1dcd477cce07724ec6b817b3be71540e` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x100`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`7`
TimeDateStamp	2026-Sep-09 15:46:54
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x2ca00`
SizeOfInitializedData	`0x3e200`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000000000000E310 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x73000`
SizeOfHeaders	`0x400`
Checksum	`0x1091fc9`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x1e8480`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`dbc45db5c828d067c8d8296eea39eeef 🔍`
SHA1	`bd42bb6b0c3fa8341ece53429f64671d6929940e 🔍`
SHA256	`6fcaee6735d961a7ded1c1d8fd789ef6d4a8ac7a5c551b04afbad8e32c1da4e3 🔍`
SHA3	`c60d549bf5f5cf4d2a3b1e6a527c9b2eb6122117e6238df50118d2b59cccd5bc 🔍`
VirtualSize	`0x2c820`
VirtualAddress	`0x1000`
SizeOfRawData	`0x2ca00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.46488`

.rdata

MD5	`a6ecd6d5eeae37155798ff4f1fffaa06 🔍`
SHA1	`1d2f2da06f74662b6e9f09e7e1bf9d86a32d80d1 🔍`
SHA256	`f6d55049e186916b8cf82fa899e4420c58c96711b4d09075ee7611a6dd60e35c 🔍`
SHA3	`61522c1325baff4c49d3a6deea8a4926bbf4fecdf216eb048e46802841d10e4f 🔍`
VirtualSize	`0x142a0`
VirtualAddress	`0x2e000`
SizeOfRawData	`0x14400`
PointerToRawData	`0x2ce00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.72227`

.data

MD5	`95520b60937e1af52257bbc6c81c4470 🔍`
SHA1	`cfdd3067015dccad0f22501b09f2a32d678fa817 🔍`
SHA256	`c840049dc4e32cac0b18bae3e0a03a6b98c41b0ab11db51012d4504ec9445544 🔍`
SHA3	`974b380d2237ce4ad6a5143f0cbae708b6402677f514bc2710a5f78248bb987e 🔍`
VirtualSize	`0x4af0`
VirtualAddress	`0x43000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x41200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.8178`

.pdata

MD5	`90e5a87777f5ea746fb444a9f48d1387 🔍`
SHA1	`b923bf23d1f527437890fddfbd2d7d9190f0f64c 🔍`
SHA256	`17ecd4bd75d90dfb496e49b5c9b4f56ace348b772642753479cf3c821b1460f7 🔍`
SHA3	`5d6ee8d42dd16e0212c959044f324dfc7472b6c3aad7874ca1aa2ad1702a1931 🔍`
VirtualSize	`0x2538`
VirtualAddress	`0x48000`
SizeOfRawData	`0x2600`
PointerToRawData	`0x42000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.43496`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x4b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x44600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`0b18b6c8a0913ed124c0dfcdd9c67c84 🔍`
SHA1	`ba39b5cd56929dc784a5e86612bbd0ad8676a371 🔍`
SHA256	`cc9cc6827a2091b513c9dc7d25d9ce51d6f11b5a6c73990765a9ffab446500a0 🔍`
SHA3	`e094934da733bf42274519812395dc7fa2cf6da463139b831f606c57ff38e863 🔍`
VirtualSize	`0x25ef0`
VirtualAddress	`0x4c000`
SizeOfRawData	`0x26000`
PointerToRawData	`0x44800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.99501`

.reloc

MD5	`d64e371659660ce2dd5153b51730a694 🔍`
SHA1	`d26b5588366a5395483d1ee0529ff11c0c5b4011 🔍`
SHA256	`2995bcb2f152a69d2241f279f3ba9a3ea0dfd9db1cfe3f5b5083852750cd32ba 🔍`
SHA3	`481a7388d59ebb0f78df69cf3917426231e61c30a91015d9cb14185f26994db9 🔍`
VirtualSize	`0x760`
VirtualAddress	`0x72000`
SizeOfRawData	`0x800`
PointerToRawData	`0x6a800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.2433`

Imports

USER32.dll	`CreateWindowExW` `ShutdownBlockReasonCreate` `MsgWaitForMultipleObjects` `ShowWindow` `DestroyWindow` `RegisterClassW` `DefWindowProcW` `PeekMessageW` `DispatchMessageW` `TranslateMessage` `GetMonitorInfoW` `MonitorFromPoint` `GetCursorPos` `GetSystemMetrics` `PostMessageW` `GetMessageW` `MessageBoxW` `MessageBoxA` `SystemParametersInfoW` `DestroyIcon` `SetWindowLongPtrW` `GetWindowLongPtrW` `GetClientRect` `InvalidateRect` `ReleaseDC` `GetDC` `DrawTextW` `GetDialogBaseUnits` `EndDialog` `DialogBoxIndirectParamW` `MoveWindow` `SendMessageW`
COMCTL32.dll	`#380`
KERNEL32.dll	`GetACP` `IsValidCodePage` `GetStringTypeW` `GetFileAttributesExW` `SetEnvironmentVariableW` `FlushFileBuffers` `LCMapStringW` `CompareStringW` `VirtualProtect` `GetCurrentDirectoryW` `HeapAlloc` `GetFileSizeEx` `GetConsoleOutputCP` `GetOEMCP` `GetCPInfo` `GetLastError` `FreeLibrary` `GetProcAddress` `LoadLibraryExW` `GetModuleHandleW` `MulDiv` `FormatMessageW` `CloseHandle` `GetCurrentProcess` `QueryFullProcessImageNameW` `GetEnvironmentStringsW` `CreateSymbolicLinkW` `SetErrorMode` `GetCurrentProcessId` `OpenProcess` `CreateToolhelp32Snapshot` `Process32FirstW` `Process32NextW` `CreateDirectoryW` `GetCommandLineW` `GetEnvironmentVariableW` `ExpandEnvironmentStringsW` `DeleteFileW` `FindClose` `FindFirstFileW` `FindNextFileW` `GetDriveTypeW` `RemoveDirectoryW` `GetTempPathW` `QueryPerformanceCounter` `QueryPerformanceFrequency` `WaitForSingleObject` `Sleep` `TerminateProcess` `GetExitCodeProcess` `CreateProcessW` `GetStartupInfoW` `LocalFree` `SetConsoleCtrlHandler` `K32EnumProcessModules` `K32GetModuleFileNameExW` `CreateFileW` `FindFirstFileExW` `MultiByteToWideChar` `WideCharToMultiByte` `SetFilePointerEx` `FreeEnvironmentStringsW` `GetProcessHeap` `GetTimeZoneInformation` `HeapSize` `HeapReAlloc` `WriteConsoleW` `SetEndOfFile` `SetDllDirectoryW` `GetCurrentThreadId` `GetSystemTimeAsFileTime` `InitializeSListHead` `SetUnhandledExceptionFilter` `RtlUnwindEx` `SetLastError` `FlsAlloc` `FlsGetValue` `FlsSetValue` `FlsFree` `EnterCriticalSection` `LeaveCriticalSection` `InitializeCriticalSectionEx` `DeleteCriticalSection` `RtlLookupFunctionEntry` `EncodePointer` `RaiseException` `RtlPcToFileHeader` `GetCommandLineA` `GetFileInformationByHandle` `GetFileType` `PeekNamedPipe` `SystemTimeToTzSpecificLocalTime` `FileTimeToSystemTime` `ReadFile` `GetFullPathNameW` `SetStdHandle` `GetStdHandle` `WriteFile` `GetModuleFileNameW` `ExitProcess` `GetModuleHandleExW` `IsProcessorFeaturePresent` `RtlCaptureContext` `RtlVirtualUnwind` `IsDebuggerPresent` `UnhandledExceptionFilter` `HeapFree` `GetConsoleMode` `ReadConsoleW`
ADVAPI32.dll	`ConvertSidToStringSidW` `OpenProcessToken` `GetTokenInformation` `ConvertStringSecurityDescriptorToSecurityDescriptorW`
GDI32.dll	`SelectObject` `DeleteObject` `CreateFontIndirectW`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x458`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.75836`
Detected Filetype	PNG graphic file
MD5	`913b4c5e72cdcc43696b3f10407f6e38 🔍`
SHA1	`893eaad58331a805236918a907c1894bb5852101 🔍`
SHA256	`3657f0bc61618a6a1f59bcf9a0bcf50216f85179919968cf163118d28fbfea26 🔍`
SHA3	`47e3693bfbfbd0399a5a639a207e76efe224ae9210897c85318c6f5e6289e761 🔍`

2

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0xbb0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.91659`
Detected Filetype	PNG graphic file
MD5	`8d0720527b22c47d7c4c2e71dd52c20c 🔍`
SHA1	`7f1339ac721a92b504c8ee4e0a632bc0344c7a30 🔍`
SHA256	`f16dbd8b715082c5ec285c30ba975d87a1fdc5ce853cec822899e0c5aff5b17b 🔍`
SHA3	`8b0baf6aed7fb22c7c04d206078b9c9ecf6f00a356e44aee032927b39202d9ca 🔍`

3

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x16dd`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96096`
Detected Filetype	PNG graphic file
MD5	`d7b298c9761dd5452985f756e526ea99 🔍`
SHA1	`e956d29a5d5adede977aae4d7e37775f37cbacd2 🔍`
SHA256	`38b5af5cfef15bee57afdc09d857a0a4ddde49c2d88db48d28ed62bc2eb9c9a6 🔍`
SHA3	`a8c8cb21ae528ffd14af8ca92c24bacf8c1afb5eff638449a1949973cf4177cd 🔍`

4

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x257f`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97333`
Detected Filetype	PNG graphic file
MD5	`52259e5d91a642090e8ea69ea8dd66c6 🔍`
SHA1	`2f37957c05c0f9f32986b2df8593cad401150b1c 🔍`
SHA256	`b83c9d78a0c0c61df240cadd27cf6bcef4e019e4806689d8b177a4c3ac93b665 🔍`
SHA3	`3f923aa825e352bdd147314a858dc99012f19daafd6ddbd979e5bad99166e4ec 🔍`

5

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x7d11`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98937`
Detected Filetype	PNG graphic file
MD5	`6be6f6289d05a17033de082377889f57 🔍`
SHA1	`ac9b1890bf0ab94d223d17f01faa104147fa75ab 🔍`
SHA256	`1d1152c96b13890c41aac46a306c3d874cc3a617401ac302732dd35e174252dc 🔍`
SHA3	`8168049add81c4bb14dce5be140731b5c5219f591aafc92a69b0ec75d35008bb 🔍`

6

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x18e30`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99605`
Detected Filetype	PNG graphic file
MD5	`78eb5d043f42d9b54639747f0715eff2 🔍`
SHA1	`7467f759ba041ee7f15a242f5bd8645480cbfd1b 🔍`
SHA256	`92e0845bac87d560825be0cb14618aed75b8ead38bbd38ce8c8b29b6a25fc38d 🔍`
SHA3	`af7a09ab4f95ee28df4a94fe2ccf2758121dea8c85271ff799064b6c113b8116 🔍`

1 (#2)

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x5a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.6353`
Detected Filetype	Icon file
MD5	`ef83fa777e72bc10c350b3cb2d5bac21 🔍`
SHA1	`18bab1990491f1cd6a5d45607d521ba505ce66fb 🔍`
SHA256	`c287644f80d5390cb25f05733c8c8556972beea8de65d64195abf84a67e34413 🔍`
SHA3	`b8cc6b446de34f469cd387c5e8948c1a14783b04debf07c1d90b512e38672fb1 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	Latin 1 / Western European
Size	`0x50d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.25791`
MD5	`84da8dee6b319ea0b10b6de5489c6aae 🔍`
SHA1	`5f8991f3e065fd95614859a293f88b9c70e4bb23 🔍`
SHA256	`abf8f2022f12f350789d961aceaf9ccfd53e7ec58d8c9934cfce77779b4eac11 🔍`
SHA3	`08f0562915b54bedce5a84e9d32cb2efcc538268785103b1852338e20a3b4606 🔍`

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Sep-09 15:46:54
Version	`0.0`
SizeofData	`816`
AddressOfRawData	`0x3e5b8`
PointerToRawData	`0x3d3b8`

TLS Callbacks

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140043040`
GuardCFCheckFunctionPointer	`5368898768`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

XOR Key	`0xe0284a65`
Unmarked objects	`0`
C++ objects (33145)	`183`
C objects (33145)	`12`
ASM objects (33145)	`11`
253 (35721)	`3`
ASM objects (35721)	`9`
C objects (35721)	`17`
C++ objects (35721)	`39`
Imports (33145)	`11`
Total imports	`163`
C objects (36246)	`30`
Linker (36246)	`1`

Errors

Leave a comment

No comments yet.