bd70b2605560de62d5945d803133a9246d37ce8d544b5cecd122c200719ed519

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jul-09 14:40:20
Debug artifacts hello_static.pdb

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .fptable
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 cd7175fa76d6b0f007ad074de3e27967
SHA1 9a4b9e445075e57f9250dedac4c7d126b66bae04
SHA256 bd70b2605560de62d5945d803133a9246d37ce8d544b5cecd122c200719ed519
SHA3 4bb593277c063874de17bee31b19099df7effb7c6e44d1cb94a8511b1fa1f0c1
SSDeep 3072:0UGZPAcMZUKMdNdOVzRXzfAHQfHO/RKSVbgKqEGcipkqSoa8Wwoh:0RAcMiKRX7iQKKOX9omw8
Imports Hash a74e0b93106f04cf09fbf8252c39ebb8

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jul-09 14:40:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x20400
SizeOfInitializedData 0x13000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000012890 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x38000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f846d7d8d8fbfd3e7839cdfa6be06223
SHA1 ffd3d8a27a2e07f124a7bf2c9fcbe1ee201ef2d1
SHA256 2cc94aa89c1f04e2fdae56769d40edbbb2696cea3254dea10a93f98d6818b0fb
SHA3 4a7389b6d99e7388398dfe6b475e38bb1bec1ad187c2616fae0f0a0f3185ce08
VirtualSize 0x20320
VirtualAddress 0x1000
SizeOfRawData 0x20400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46196

.rdata

MD5 d8ec94226f13e11b68b25f0bb83ca845
SHA1 a5f50ad407204279fd5370ca0180cb23e1cea59b
SHA256 e9ccafea237261d0209ec2a08511c06eb18dd3c802988a977d161911e0d3d73c
SHA3 37087e091824ef8d7b463fc64c5d4b894a67366b0c9ba1b95e2ef27ab1ddca9e
VirtualSize 0xf0e2
VirtualAddress 0x22000
SizeOfRawData 0xf200
PointerToRawData 0x20800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.14749

.data

MD5 c64c09d0467975038ad478f834adf3d4
SHA1 8653481213ad40abf75aa095d837ca32b7904e62
SHA256 dbac35f09abade3861ee74605ee6b2cbb4b4dbfb51575ffbf6ca2a29ba37cddc
SHA3 4260723777cd51d8296469c05abcbf05258e65b83bb96fb4814d0ae1a3801ca1
VirtualSize 0x1730
VirtualAddress 0x32000
SizeOfRawData 0xc00
PointerToRawData 0x2fa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.02949

.pdata

MD5 1abcb60df0f31baf73d3d94aa0ab4987
SHA1 46290c181ea40fe7425050eb105c4fb62240f787
SHA256 b956119dddf7b31061236bb1ac7c502cbdc48475fb776cd50143869f2bccb087
SHA3 02a127d44651a685bfa7457b0a5be055f1a5aac46a23111d55c37f6bc31989e5
VirtualSize 0x1b9c
VirtualAddress 0x34000
SizeOfRawData 0x1c00
PointerToRawData 0x30600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.34626

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x100
VirtualAddress 0x36000
SizeOfRawData 0x200
PointerToRawData 0x32200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 3e0a7c24123f2835580d754e3e38c9bc
SHA1 b4f7c10109690f5724ab0dff00136c25a87b038d
SHA256 faf69d7d165bf8d6264da7d51a5605b60121a4d0f85814b2730d5c5cb3624f2d
SHA3 4acbbb4726886ec844cfd880c65b0d655f7afc313216dda62b7619b00c684f4e
VirtualSize 0x7f4
VirtualAddress 0x37000
SizeOfRawData 0x800
PointerToRawData 0x32400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.40941

Imports

api-ms-win-core-synch-l1-2-0.dll WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
KERNEL32.dll FlsGetValue
CreateFileW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetProcessHeap
HeapFree
HeapReAlloc
GetCurrentThreadId
GetLastError
SetLastError
GetEnvironmentVariableW
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetProcAddress
GetCurrentProcess
lstrlenW
GetCurrentProcessId
CreateMutexA
CloseHandle
ReleaseMutex
WideCharToMultiByte
RtlVirtualUnwind
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
HeapAlloc
GetModuleHandleW
FormatMessageW
GetModuleHandleA
SetFilePointerEx
FlushFileBuffers
HeapSize
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FlsAlloc
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WriteFile
GetModuleFileNameW
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
ntdll.dll NtWriteFile
RtlNtStatusToDosError

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jul-09 14:40:20
Version 0.0
SizeofData 41
AddressOfRawData 0x2d660
PointerToRawData 0x2be60
Referenced File hello_static.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jul-09 14:40:20
Version 0.0
SizeofData 20
AddressOfRawData 0x2d68c
PointerToRawData 0x2be8c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jul-09 14:40:20
Version 0.0
SizeofData 952
AddressOfRawData 0x2d6a0
PointerToRawData 0x2bea0

TLS Callbacks

StartAddressOfRawData 0x14002daa0
EndAddressOfRawData 0x14002dac0
AddressOfIndex 0x140032c40
AddressOfCallbacks 0x140022370
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140032100

RICH Header

XOR Key 0x7cd728e6
Unmarked objects 0
C++ objects (33145) 141
C objects (33145) 12
ASM objects (33145) 6
ASM objects (35721) 9
C objects (35721) 16
C++ objects (35721) 40
Imports (33145) 5
Total imports 104
Unmarked objects (#2) 4
Linker (36247) 1

Errors

Leave a comment

No comments yet.