| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2022-Apr-18 19:35:57 |
| Debug artifacts |
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb
|
| CompanyName | SampleScanner |
| FileDescription | SampleScanner |
| FileVersion | 1.0.0.0 |
| InternalName | SampleScanner.dll |
| LegalCopyright | |
| OriginalFilename | SampleScanner.dll |
| ProductName | SampleScanner |
| ProductVersion | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/72 (Scanned on 2025-10-28 14:01:08) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2022-Apr-18 19:35:57 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x17e00 |
| SizeOfInitializedData | 0x12800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000014670 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x180000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
FindClose
FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary RtlUnwindEx RaiseException OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW RtlPcToFileHeader InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer GetStringTypeW |
|---|---|
| USER32.dll |
MessageBoxW
|
| SHELL32.dll |
ShellExecuteW
|
| ADVAPI32.dll |
RegOpenKeyExW
RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW |
| api-ms-win-crt-runtime-l1-1-0.dll |
_initialize_wide_environment
_set_app_type _invalid_parameter_noinfo_noreturn _seh_filter_exe _cexit _crt_atexit _register_onexit_function terminate _configure_wide_argv exit _exit __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback abort _get_initial_wide_environment _errno _initterm _initialize_onexit_table _initterm_e |
| api-ms-win-crt-heap-l1-1-0.dll |
malloc
calloc free _callnewh _set_new_mode |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
frexp |
| api-ms-win-crt-stdio-l1-1-0.dll |
_wfopen
__stdio_common_vswprintf fclose fread fseek fwrite __acrt_iob_func _set_fmode fputwc fputws __stdio_common_vfwprintf fflush __p__commode __stdio_common_vsprintf_s |
| api-ms-win-crt-string-l1-1-0.dll |
_wcsicmp
_wcsdup _wcsnicmp wcsncmp strcspn wcsnlen memset strcpy_s |
| api-ms-win-crt-locale-l1-1-0.dll |
_unlock_locales
__pctype_func ___lc_locale_name_func ___mb_cur_max_func setlocale _configthreadlocale _lock_locales localeconv ___lc_codepage_func |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_wremove
_wrename |
| api-ms-win-crt-convert-l1-1-0.dll |
_wtoi
wcstoul |
| api-ms-win-crt-time-l1-1-0.dll |
wcsftime
_gmtime64 _time64 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | SampleScanner |
| FileDescription | SampleScanner |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | SampleScanner.dll |
| LegalCopyright | |
| OriginalFilename | SampleScanner.dll |
| ProductName | SampleScanner |
| ProductVersion (#2) | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Apr-18 19:35:57 |
| Version | 0.0 |
| SizeofData | 110 |
| AddressOfRawData | 0x23aa4 |
| PointerToRawData | 0x22ca4 |
| Referenced File | D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Apr-18 19:35:57 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x23b14 |
| PointerToRawData | 0x22d14 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Apr-18 19:35:57 |
| Version | 0.0 |
| SizeofData | 884 |
| AddressOfRawData | 0x23b28 |
| PointerToRawData | 0x22d28 |
| StartAddressOfRawData | 0x140023ec0 |
|---|---|
| EndAddressOfRawData | 0x140023ed0 |
| AddressOfIndex | 0x14002a2b8 |
| AddressOfCallbacks | 0x140019520 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x100 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140029568 |
| GuardCFCheckFunctionPointer | 5368812648 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
| XOR Key | 0x4070d489 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (VS 2015/2017 runtime 26706) | 8 |
| C++ objects (VS 2015/2017 runtime 26706) | 63 |
| C objects (VS 2015/2017 runtime 26706) | 28 |
| Imports (VS2008 SP1 build 30729) | 18 |
| Imports (VS2015/2017 runtime 25711) | 9 |
| Total imports | 169 |
| C++ objects (27045) | 13 |
| Linker (27045) | 1 |
No comments yet.