Manalyze report for b83d083e6dc8fea63a54de9211f8f6b82dc21d4b484d3aca190cd550d79dc1d6

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Oct-24 00:20:04
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: cmd.exe` Contains domain names: adobe.be.com adobe.com api.github.com blog.demofox.org daltonmaag.com demofox.org github.com http://ns.adobe http://ns.adobe.be.com http://ns.adobe.be.com/xap/1.0/ http://ns.adobe.com http://ns.adobe.com/xmp/extension/ http://www.daltonmaag.com http://www.daltonmaag.com/http http://www.daltonmaag.comUbuntuLight https://api.github.com https://api.github.com/repos/ https://blog.demofox.org https://blog.demofox.org/2022/01/01/interleaved-gradient-noise-a-different-kind-of-low-discrepancy-sequence/ https://docs.rs https://github.com https://www.shadertoy.com https://www.shadertoy.com/view/llVGzG ns.adobe.be.com ns.adobe.com shadertoy.com www.daltonmaag.com www.shadertoy.com
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to RC5 or RC6`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryA LoadLibraryW GetProcAddress LoadLibraryExA LoadLibraryExW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot SwitchToThread` `Possibly launches other programs: CreateProcessW` `Uses Windows's Native API: NtOpenFile NtReadFile NtWriteFile NtCreateNamedPipeFile` `Uses functions commonly found in keyloggers: GetAsyncKeyState GetForegroundWindow MapVirtualKeyW` `Manipulates other processes: OpenProcess` `Can take screenshots: BitBlt CreateCompatibleDC GetDC`
Suspicious	VirusTotal score: 1/69 (Scanned on 2026-10-24 08:23:27)	`McAfeeD: ti!B83D083E6DC8`

Hashes

MD5	`e3d4c82cd224debe72beab2e24094483` 🔍
SHA1	`e59e3d58aec05ff5c466ae0c5c418485da6243e9` 🔍
SHA256	`b83d083e6dc8fea63a54de9211f8f6b82dc21d4b484d3aca190cd550d79dc1d6` 🔍
SHA3	`8050fcbca295f1de54dc107894b86f4532d27997eb05a0d1a1e83c9b74834b1d` 🔍
SSDeep	`98304:bjkFrCa5QXoicnrFSTGTU5P2G+h8dFLwKiIKZQ58iC0obWb:bIBIrd2G+h8dFl8uzb` 🔍
Imports Hash	`4847cd6214429caa408cb320d061e854` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x78`
e_cp	`0x1`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x78`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Oct-24 00:20:04
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x653c00`
SizeOfInitializedData	`0x23c800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000013D0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x895000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`3cfc7ef159c7c1948682f9f6c057778a 🔍`
SHA1	`4604e8aca98b5dd4229e03fc2185847d745e2dce 🔍`
SHA256	`40e5629f427613cdbb9db806c224bf1207e5ada4c2cd7685a6e4825ba6491708 🔍`
SHA3	`52f82db4fa2ba3579394875e2d50397ce06c5ae74d4934339ce564eb9aaf92b4 🔍`
VirtualSize	`0x653a86`
VirtualAddress	`0x1000`
SizeOfRawData	`0x653c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.39087`

.rdata

MD5	`57eeb649a8289c887b117b6616b8327b 🔍`
SHA1	`4918fb08492281b9c2d61efda51ba28a24b374a8 🔍`
SHA256	`2b86210633381096daf3a49cd87b3ae80a7575bc93865e09de0ac2460f80ac50 🔍`
SHA3	`e61d63890b37f9a1381306533ecb13b2988f0fa33e154a89d69271525b8463a1 🔍`
VirtualSize	`0x21903c`
VirtualAddress	`0x655000`
SizeOfRawData	`0x219200`
PointerToRawData	`0x654000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.10203`

.data

MD5	`4f49c232321b43e0fe5a46fd5ca9e574 🔍`
SHA1	`5416ee7ca0d3936f779fcf359084c6055c4644dd 🔍`
SHA256	`606e986749dc2b1f3569c1891a781b9a59328a908cdafa52ff42d6532b98bc8c 🔍`
SHA3	`99090385da6d2e6b314b931af1f2c8a15be0d1d195e4356f77cc316143263ec4 🔍`
VirtualSize	`0x4c10`
VirtualAddress	`0x86f000`
SizeOfRawData	`0x4800`
PointerToRawData	`0x86d200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.08311`

.pdata

MD5	`df15c4cb1795396b05e57f9e100f1e51 🔍`
SHA1	`4bee2e6b3107337768e0c901d661438683de0ac3 🔍`
SHA256	`13bb2113ca259eeaba57a6bd1bcf723b7e4518e55c027554b69a703f1672f087 🔍`
SHA3	`07594f5822d603643d5e5e2773c66ba0a77411545a7fbfd7d12848888f12c55b 🔍`
VirtualSize	`0x161ac`
VirtualAddress	`0x874000`
SizeOfRawData	`0x16200`
PointerToRawData	`0x871a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.4015`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0x88b000`
SizeOfRawData	`0x200`
PointerToRawData	`0x887c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.reloc

MD5	`896645e67ee2cf4c2c1ea7601c454d45 🔍`
SHA1	`02477b67e30d4912c4b5ef28496beea0a94cd7ae 🔍`
SHA256	`67df4a4a7b2a3ba355516d20347aafcc19841828af1b179d70b86e574acfe8fe 🔍`
SHA3	`89a961ebc4a4fb453d14a5225e463774410046a102c7f4e55439ea33dafdf6da 🔍`
VirtualSize	`0x8848`
VirtualAddress	`0x88c000`
SizeOfRawData	`0x8a00`
PointerToRawData	`0x887e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.45204`

Imports

comdlg32.dll	`GetOpenFileNameW`
dwmapi.dll	`DwmEnableBlurBehindWindow`
gdi32.dll	`BitBlt` `ChoosePixelFormat` `CreateBitmap` `CreateCompatibleBitmap` `CreateCompatibleDC` `CreateDIBSection` `CreateRectRgn` `CreateSolidBrush` `DeleteDC` `DeleteObject` `DescribePixelFormat` `GetDIBits` `GetDeviceCaps` `SelectObject` `SetBitmapBits` `SetBkMode` `SetBrushOrgEx` `SetPixelFormat` `SetStretchBltMode` `SetTextColor` `StretchBlt` `SwapBuffers`
imm32.dll	`ImmAssociateContextEx` `ImmGetCompositionStringW` `ImmGetContext` `ImmReleaseContext` `ImmSetCandidateWindow` `ImmSetCompositionWindow`
kernel32.dll	`AddVectoredExceptionHandler` `CancelIo` `CompareStringOrdinal` `CreateDirectoryW` `CreateFileMappingA` `CreateFileW` `CreateProcessW` `CreateThread` `CreateToolhelp32Snapshot` `CreateWaitableTimerExW` `DeleteCriticalSection` `DeleteFileW` `EnterCriticalSection` `ExitProcess` `FindClose` `FindFirstFileExW` `FindNextFileW` `FlsAlloc` `FlsFree` `FlsSetValue` `FreeEnvironmentStringsW` `GetConsoleMode` `GetConsoleOutputCP` `GetCurrentDirectoryW` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetEnvironmentStringsW` `GetEnvironmentVariableW` `GetExitCodeProcess` `GetFileAttributesW` `GetFileInformationByHandle` `GetFileInformationByHandleEx` `GetFullPathNameW` `GetModuleHandleW` `GetOverlappedResult` `GetStdHandle` `GetSystemDirectoryW` `GetSystemInfo` `GetSystemTimePreciseAsFileTime` `GetWindowsDirectoryW` `HeapReAlloc` `InitOnceBeginInitialize` `InitOnceComplete` `InitializeCriticalSection` `IsThreadAFiber` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryW` `MapViewOfFile` `Module32FirstW` `Module32NextW` `MoveFileExW` `MultiByteToWideChar` `OpenProcess` `QueryFullProcessImageNameW` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RaiseException` `ReadFile` `ReadFileEx` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `SetFileInformationByHandle` `SetFilePointerEx` `SetFileTime` `SetPriorityClass` `SetProcessAffinityMask` `SetThreadStackGuarantee` `SetUnhandledExceptionFilter` `SetWaitableTimer` `SleepEx` `SwitchToThread` `TlsAlloc` `TlsFree` `TlsGetValue` `TlsSetValue` `UnmapViewOfFile` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WriteConsoleW` `WriteFileEx`
ntdll.dll	`NtOpenFile` `NtReadFile` `NtWriteFile`
ole32.dll	`OleInitialize` `RegisterDragDrop` `RevokeDragDrop`
opengl32.dll	`wglCreateContext` `wglDeleteContext` `wglGetCurrentContext` `wglGetCurrentDC` `wglGetProcAddress` `wglMakeCurrent` `wglShareLists`
user32.dll	`ChangeDisplaySettingsExW` `ClientToScreen` `CloseTouchInputHandle` `CreateIconIndirect` `DrawIconEx` `DrawTextW` `EnumDisplayMonitors` `FillRect` `GetClassInfoExW` `GetDC` `GetMenuItemInfoW` `GetMonitorInfoW` `GetTouchInputInfo` `GetWindowDC` `InvalidateRgn` `MapWindowPoints` `MonitorFromPoint` `MonitorFromRect` `MonitorFromWindow` `OffsetRect` `RedrawWindow` `RegisterClassExW` `RegisterClassW` `RegisterTouchWindow` `ReleaseDC` `ScreenToClient` `SetMenuItemInfoW` `ValidateRect`
uxtheme.dll	`SetWindowTheme`
KERNEL32.dll	`__C_specific_handler`
msvcrt.dll	`__getmainargs` `__initenv` `__iob_func` `__set_app_type` `__setusermatherr` `_amsg_exit` `_cexit` `_commode` `_errno` `_exit` `_fmode` `_hypot` `_initterm` `_onexit` `abort` `calloc` `exit` `fprintf` `free` `fwrite` `log10` `malloc` `memcmp` `memcpy` `memmove` `memset` `signal` `strlen` `strncmp` `tan` `vfprintf` `wcslen`
ntdll.dll (#2)	`NtOpenFile` `NtReadFile` `NtWriteFile`
api-ms-win-core-synch-l1-2-0.dll	`WaitOnAddress` `WakeByAddressAll` `WakeByAddressSingle`
bcryptprimitives.dll	`ProcessPrng`
kernel32.dll (#2)	`AddVectoredExceptionHandler` `CancelIo` `CompareStringOrdinal` `CreateDirectoryW` `CreateFileMappingA` `CreateFileW` `CreateProcessW` `CreateThread` `CreateToolhelp32Snapshot` `CreateWaitableTimerExW` `DeleteCriticalSection` `DeleteFileW` `EnterCriticalSection` `ExitProcess` `FindClose` `FindFirstFileExW` `FindNextFileW` `FlsAlloc` `FlsFree` `FlsSetValue` `FreeEnvironmentStringsW` `GetConsoleMode` `GetConsoleOutputCP` `GetCurrentDirectoryW` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetEnvironmentStringsW` `GetEnvironmentVariableW` `GetExitCodeProcess` `GetFileAttributesW` `GetFileInformationByHandle` `GetFileInformationByHandleEx` `GetFullPathNameW` `GetModuleHandleW` `GetOverlappedResult` `GetStdHandle` `GetSystemDirectoryW` `GetSystemInfo` `GetSystemTimePreciseAsFileTime` `GetWindowsDirectoryW` `HeapReAlloc` `InitOnceBeginInitialize` `InitOnceComplete` `InitializeCriticalSection` `IsThreadAFiber` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryW` `MapViewOfFile` `Module32FirstW` `Module32NextW` `MoveFileExW` `MultiByteToWideChar` `OpenProcess` `QueryFullProcessImageNameW` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RaiseException` `ReadFile` `ReadFileEx` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `SetFileInformationByHandle` `SetFilePointerEx` `SetFileTime` `SetPriorityClass` `SetProcessAffinityMask` `SetThreadStackGuarantee` `SetUnhandledExceptionFilter` `SetWaitableTimer` `SleepEx` `SwitchToThread` `TlsAlloc` `TlsFree` `TlsGetValue` `TlsSetValue` `UnmapViewOfFile` `VirtualProtect` `VirtualQuery` `WaitForMultipleObjects` `WriteConsoleW` `WriteFileEx`
ntdll.dll (#3)	`NtOpenFile` `NtReadFile` `NtWriteFile`
oleaut32.dll	`GetErrorInfo` `SysFreeString` `SysStringLen`
d3d11.dll	`CreateDirect3D11DeviceFromDXGIDevice` `D3D11CreateDevice`
ole32.dll (#2)	`OleInitialize` `RegisterDragDrop` `RevokeDragDrop`
api-ms-win-core-winrt-l1-1-0.dll	`RoGetActivationFactory`
shell32.dll	`DragFinish` `DragQueryFileW` `Shell_NotifyIconGetRect` `Shell_NotifyIconW`
comctl32.dll	`DefSubclassProc` `RemoveWindowSubclass` `SetWindowSubclass`
user32.dll (#2)	`ChangeDisplaySettingsExW` `ClientToScreen` `CloseTouchInputHandle` `CreateIconIndirect` `DrawIconEx` `DrawTextW` `EnumDisplayMonitors` `FillRect` `GetClassInfoExW` `GetDC` `GetMenuItemInfoW` `GetMonitorInfoW` `GetTouchInputInfo` `GetWindowDC` `InvalidateRgn` `MapWindowPoints` `MonitorFromPoint` `MonitorFromRect` `MonitorFromWindow` `OffsetRect` `RedrawWindow` `RegisterClassExW` `RegisterClassW` `RegisterTouchWindow` `ReleaseDC` `ScreenToClient` `SetMenuItemInfoW` `ValidateRect`
dwmapi.dll (#2)	`DwmEnableBlurBehindWindow`

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData	`0x14088b000`
EndAddressOfRawData	`0x14088b008`
AddressOfIndex	`0x140873b1c`
AddressOfCallbacks	`0x1408252d0`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`0x0000000140652960` `0x0000000140652930`

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.