ba013a89e0b10e80c38d4e0d0fd65a0c29716542d772e5ee5b944cda4c3552fb

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jul-04 16:30:28
TLS Callbacks 1 callback(s) detected.
Debug artifacts C:\Users\vhuse\.gemini\antigravity\scratch\main_v10.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Looks for VMWare presence:
  • VMware
Info Cryptographic algorithms detected in the binary: Uses known Mersenne Twister constants
Suspicious The PE is possibly packed. Unusual section name found: .smc
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Suspicious VirusTotal score: 1/71 (Scanned on 2026-09-29 05:56:34) APEX: Malicious

Hashes

MD5 52795cecc0a561ee01cc7480553ce9b9 🔍
SHA1 be3770630d4efe651c153e17bfef8d5ff5dbbe30 🔍
SHA256 ba013a89e0b10e80c38d4e0d0fd65a0c29716542d772e5ee5b944cda4c3552fb 🔍
SHA3 b77760ec045a0b57eea9b24b17b6a618cfe0549a68c353946b9bf69c13aba075 🔍
SSDeep 6144:CQZCOtmzDfMSSokBVWC00c5+lfyikWo689DgyvXnaD2OFyVrcA+v8lk42:CQkP7Sok7X00c5+tn89Dgyv3Ahkll2 🔍
Imports Hash 510f804b6352d7938fc54b09479ce7aa 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 9
TimeDateStamp 2026-Jul-04 16:30:28
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x87e00
SizeOfInitializedData 0x17800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00002CCF (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x89000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa5000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 28e6f8bb0015d5280469d4daf7260b00 🔍
SHA1 103041b113ce11074563df7d13648a9d4c636730 🔍
SHA256 938623e3a3ac8ed3a1584ad7f059b7c72f564b5a324c3f553d9ab12822c1a56f 🔍
SHA3 064236d4313d99e8bb5c0e35a2ff0f3e689324baf4ab5eba4e35fa38be4f315f 🔍
VirtualSize 0x87c50
VirtualAddress 0x1000
SizeOfRawData 0x87e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.7572

.rdata

MD5 00125783c2b560484f539bd9335c24b3 🔍
SHA1 3693e208a4031fd3ac5fc7169648a768ceed15da 🔍
SHA256 28bd5659a8ce0dde517d97026627e0807e64e4f37e772531757c90ea8b89e45f 🔍
SHA3 b2f6bba7cb09846ea3900cc592c95bc32d96337bb341bf195f69b084076199d8 🔍
VirtualSize 0xfee2
VirtualAddress 0x89000
SizeOfRawData 0x10000
PointerToRawData 0x88200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.8323

.data

MD5 9c8c7ead3dfc76c771e201a48121d0dc 🔍
SHA1 a86bf0468b5d976c8b411a5f88d67a5831c11f6d 🔍
SHA256 b0daf4b11c48a4e36af0d871564bfe570a008c61850d18b36a866e72928aecde 🔍
SHA3 d5c49b1d2105b1ca5a56218b1239444db3e8889a30765d18b99f7de2bdc497f3 🔍
VirtualSize 0x2760
VirtualAddress 0x99000
SizeOfRawData 0x1200
PointerToRawData 0x98200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.20685

.idata

MD5 8f15c4595cab6be8cc046a601ccdab1e 🔍
SHA1 cb4852629d613316be73fb162593b95d31765ee8 🔍
SHA256 264f50d967c0be97cf00ae3ee49cd4496e2ca6208ca7df058f139eeffde585d4 🔍
SHA3 0d8f4ea6dac492ebdd49af87455d15b1c64044db36b409031a3a7702df60869b 🔍
VirtualSize 0xfaf
VirtualAddress 0x9c000
SizeOfRawData 0x1000
PointerToRawData 0x99400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.82273

.tls

MD5 d3a752fa3189fb5cdc631a237131a346 🔍
SHA1 02756778a769970c4cd7c1c7c44f40f9c94b8b4d 🔍
SHA256 cd7d4bf765fda31564370b2f4fcf3f4b7d6d88f60f6f78b810c6a76927e5fb18 🔍
SHA3 9d4c99d62f866e1de7f358ff91166a2ecda6b62936632348d2403b5b96913c11 🔍
VirtualSize 0x322
VirtualAddress 0x9d000
SizeOfRawData 0x400
PointerToRawData 0x9a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0111738

.smc

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x101
VirtualAddress 0x9e000
SizeOfRawData 0x200
PointerToRawData 0x9a800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 0

.00cfg

MD5 63ca40e32b38e69f03695e735e50471c 🔍
SHA1 db679af19cb8554855bc13036e8eeafa6c784198 🔍
SHA256 55034ed9d3f8f10a712f318ccfdd6bd1073b56ca095381a0a320d776ba7adb9f 🔍
SHA3 817c8c56af3fd7e56f086da20fd58fc4e1b9ace1f969be8c801f5b259d40d8b8 🔍
VirtualSize 0x10e
VirtualAddress 0x9f000
SizeOfRawData 0x200
PointerToRawData 0x9aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.110557

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x199
VirtualAddress 0xa0000
SizeOfRawData 0x200
PointerToRawData 0x9ac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 cc8b7ff6b00ecb2e6aab81a675d0f4b5 🔍
SHA1 91b0d90b77a32779447a5a488bbee21f42ac4c7d 🔍
SHA256 722d3d08d84dccddf1b061e9fae423eea9ee2e25ca00d227d4a1bffc91740370 🔍
SHA3 18f975718e84d3b90993891844ff23454f639f3387391b860f662a8cb1729f47 🔍
VirtualSize 0x34c6
VirtualAddress 0xa1000
SizeOfRawData 0x3600
PointerToRawData 0x9ae00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.01582

Imports

VMProtectSDK32.dll VMProtectIsDebuggerPresent
VMProtectEnd
VMProtectBeginUltra
VMProtectBeginMutation
KERNEL32.dll ResumeThread
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
GetCurrentProcess
ExitProcess
GetCurrentThread
GetThreadContext
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
CloseHandle
GetLastError
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
GetLogicalProcessorInformationEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
SleepConditionVariableSRW
GetTickCount64
WakeConditionVariable
WakeAllConditionVariable
FormatMessageA
LocalFree
GetLocaleInfoEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
ReadConsoleW
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateThread
ExitThread
DecodePointer
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleExW
TerminateProcess
GetProcAddress
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
IsDebuggerPresent
UnhandledExceptionFilter
GetTempPathW
IsThreadAFiber
VirtualProtect
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetFileSizeEx
SetFilePointerEx
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
OutputDebugStringW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jul-04 16:30:28
Version 0.0
SizeofData 80
AddressOfRawData 0x96a30
PointerToRawData 0x95c30
Referenced File C:\Users\vhuse\.gemini\antigravity\scratch\main_v10.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jul-04 16:30:28
Version 0.0
SizeofData 20
AddressOfRawData 0x96a80
PointerToRawData 0x95c80

TLS Callbacks

StartAddressOfRawData 0x49d000
EndAddressOfRawData 0x49d221
AddressOfIndex 0x49a59c
AddressOfCallbacks 0x489938
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x0040C300

Load Configuration

Size 0xc0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x499080
SEHandlerTable 0x4967a0
SEHandlerCount 83

RICH Header

XOR Key 0x672a195d
Unmarked objects 0
ASM objects (33145) 17
C++ objects (33145) 149
C objects (33145) 20
Imports (33145) 2
ASM objects (35403) 23
C objects (35403) 17
C++ objects (35403) 56
Imports (VS2015 UPD3.1 build 24215) 3
Total imports 112
C++ objects (35730) 1
Linker (35730) 1

Errors

Leave a comment

No comments yet.