be423241067c33cb0c467ce00b407fbf73ed8feb12a2f60648a74c7694ca76f4

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 1970-Jan-01 00:00:00
TLS Callbacks 2 callback(s) detected.

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentVersion\Run
Malicious VirusTotal score: 3/71 (Scanned on 2026-11-02 13:41:15) CrowdStrike: win/malicious_confidence_70% (W)
DeepInstinct: MALICIOUS
Kaspersky: VHO:HackTool.Win64.Knotweed.gen

Hashes

MD5 0df87771b6ab16b491657006f198579d 🔍
SHA1 f86004f3648c9524accfc4634d8e822d1254f406 🔍
SHA256 be423241067c33cb0c467ce00b407fbf73ed8feb12a2f60648a74c7694ca76f4 🔍
SHA3 ac0735b0e8edcf514f156be6f672a9b836fc654c05b56e22ddbc20889113b16e 🔍
SSDeep 768:3G+kyrrDUvKK/u02WPeblsvrLL+M4Z+GrW/PxoQy:3G+kQpK7POsvr3+Mab 🔍
Imports Hash 625ac3d63729524b2a2eacf29fa8be53 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x6e00
SizeOfInitializedData 0x2c00
SizeOfUninitializedData 0xc00
AddressOfEntryPoint 0x00000000000013F0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x11000
SizeOfHeaders 0x400
Checksum 0xa2b9
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 01bc22df9384a21589c43dc456245e92 🔍
SHA1 33a9b9ebcfebc9a7be5b01327a86a469bbb39625 🔍
SHA256 6535c3188b7dac8267ea9b4d9739e3d8b8d945675afaff873a4c18f446335ca7 🔍
SHA3 9251c8f94f9d8557e732df9f8b2dca57f4ecded58cbd110ab0cfe9afc0a0d32e 🔍
VirtualSize 0x6d10
VirtualAddress 0x1000
SizeOfRawData 0x6e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.26708

.data

MD5 812838ecf46d04e2d44a3948a60153f9 🔍
SHA1 988bc83d175f159236daf54bc214d127e0f7f87d 🔍
SHA256 ca153e918e94efe45251bbeb2fac65bbd19894a0e3c071fd749ef80f684fe811 🔍
SHA3 594ba02faefce2c3ad8f4b5c2df153a4625a646c362c9ddffba848fe312615a1 🔍
VirtualSize 0xc0
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.883692

.rdata

MD5 eccf89617781b9a05615fbd070121bc9 🔍
SHA1 987ac1b698f5cc33bd7ba714712a6d01101c967a 🔍
SHA256 0950a8d94c2be684315054cd44f955cab620be452d8d0df2c3c2f4754edcf45c 🔍
SHA3 3808ee13c8937e8d2449d8377f1f15c7a375314956cbd76aac6f15450132b0fd 🔍
VirtualSize 0x10a8
VirtualAddress 0x9000
SizeOfRawData 0x1200
PointerToRawData 0x7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.73015

.pdata

MD5 13740064ed31adda5530927db45c56b6 🔍
SHA1 ac9040798dc5d53c892fbcfbef846b8d4220a893 🔍
SHA256 14ca78603188fea984505aa83dbf333bb7fb4b4e27671bf19d341df4ee7a4412 🔍
SHA3 e9daa092661890b5c734180dd9a7b7df6aa81ac54a93478bec37406266f546b6 🔍
VirtualSize 0x468
VirtualAddress 0xb000
SizeOfRawData 0x600
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.31115

.xdata

MD5 ef633da9ffcba38e998b5fe3c39adb45 🔍
SHA1 38cde32c82b71cac7fd58eee72db7ef7715ad9d7 🔍
SHA256 13d9200921288b86b0abc9fa71b680697e4b3410b43da9405fb9e7713b5da8de 🔍
SHA3 6d531d3ebf7a42d7f56598dfdc06d5f42b55fded0f736bf36d86c1fe9fdf7749 🔍
VirtualSize 0x42c
VirtualAddress 0xc000
SizeOfRawData 0x600
PointerToRawData 0x8c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.43874

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xba0
VirtualAddress 0xd000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 12fb4c300c021d4475eb39bdc69ec2a1 🔍
SHA1 89a91e71d4310d776114147d78453665a403ba10 🔍
SHA256 995ff8e68a50ff993225cf4f11acceb2459054ab2a14d66d994fb0496b6ed62e 🔍
SHA3 2862e26248fa772ea2313be95d126cbf4b11d08ad52ac402dba84f64d56fe5d7 🔍
VirtualSize 0x6ec
VirtualAddress 0xe000
SizeOfRawData 0x800
PointerToRawData 0x9200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.54351

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0xf000
SizeOfRawData 0x200
PointerToRawData 0x9a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 2f6fed52cc852b84b84b915c5ae82900 🔍
SHA1 71d8a9d6cf60c5290a3af0a52513eec2088e5fd6 🔍
SHA256 02e6408d5af76e2b5e13a9fd916c2bdd9e9406e19bedbd6867d12cf0d16bbbe7 🔍
SHA3 84c930f7e8086530bfe6cc521530fd9bc370ca0effe5fe6e58ceb1cce5d9aa29 🔍
VirtualSize 0x7c
VirtualAddress 0x10000
SizeOfRawData 0x200
PointerToRawData 0x9c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.47624

Imports

KERNEL32.dll DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt.dll __C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcslen

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x14000f000
EndAddressOfRawData 0x14000f008
AddressOfIndex 0x14000d08c
AddressOfCallbacks 0x14000a080
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks 0x0000000140001690
0x0000000140001660

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.