Manalyze report for c19e0d9ba39e1a32e8d773096d65562b718dbec585747177978350202dfb9931

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2018-Mar-11 00:09:46
Debug artifacts	D:\Documents\GitHub\HitmanBloodMoney_UnlimitedSaves\MinimalExcess\PatchSaveLimit.pdb

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig1(h)`
Malicious	The PE contains functions mostly used by malware.	`Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Code injection capabilities: CreateRemoteThreadEx OpenProcess VirtualAllocEx WriteProcessMemory` `Memory manipulation functions often used by packers: VirtualAllocEx VirtualProtectEx` `Functions related to the privilege level: AdjustTokenPrivileges` `Manipulates other processes: OpenProcess WriteProcessMemory ReadProcessMemory Process32First Process32Next`
Suspicious	VirusTotal score: 2/70 (Scanned on 2026-07-14 02:58:16)	`Trapmine: malicious.moderate.ml.score` `VBA32: BScope.TrojanRansom.Wanna`

Hashes

MD5	`1c2a9c5a99acdf5a837d8b81bcf61271`
SHA1	`901fe54be5d84c52647eb8baa452ec4cdae4eb9f`
SHA256	`c19e0d9ba39e1a32e8d773096d65562b718dbec585747177978350202dfb9931`
SHA3	`66291735369d0b1f64d6b9e0be9c2af36b5461af883465ca36e6f39f36f0dc35`
SSDeep	`384:7pm40XrzLfaq6kCpTYakOwlaigLcTAqR8P76:7pp0bzuq6kCSakY0eP76`
Imports Hash	`375af05c024854ffbaa122c5e566bc85`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`4`
TimeDateStamp	2018-Mar-11 00:09:46
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x2a00`
SizeOfInitializedData	`0x2000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000286F (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`db88b55663d82efb02d6d3ce8705a307`
SHA1	`33563905f9f1c175ba88ee152573317db5db02eb`
SHA256	`f48ef1180fc6b9be99b78006afe5fd103ceb432d999affb78c9cb97392dc4351`
SHA3	`25070735d576c8a50b67291864e6988935896ce5f60f4e0db06418a17dc7fbc3`
VirtualSize	`0x28c9`
VirtualAddress	`0x1000`
SizeOfRawData	`0x2a00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.98136`

.rdata

MD5	`2d35a8ceb156abd3a04e7c34769575a1`
SHA1	`e4a8e3e247b1ad6bec8103a5d3948ff6586f11fe`
SHA256	`aea45feb7042929a918f05c926ba715474444b3e4a95727c3ab820e3202ee878`
SHA3	`7c13c885eababee7826d1a97b9bbd5aec9f5b3557d8adb1680396ae14d68f66a`
VirtualSize	`0x165c`
VirtualAddress	`0x4000`
SizeOfRawData	`0x1800`
PointerToRawData	`0x2e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.7791`

.data

MD5	`269310ca6c4263f5b1c183b77f7f687d`
SHA1	`b05e589316cf3e1e36076b476dacf4bfa066b31c`
SHA256	`817cee4d837d9bdb5acfff0f53468352a58ef12299658614dc687db0829818a7`
SHA3	`cac1114ea8cf515ac31900b8e8600c40e3c17bcd523f8a68212c9d60747739fb`
VirtualSize	`0x40c`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.77599`

.gfids

MD5	`a832dbe210822b082134db087afb231b`
SHA1	`edbb795004d4b60b0b37f8814e9f35d98d66f74a`
SHA256	`465988986c36937078dc0a4795b15964abd45de7b75f5e232ead96be1da6e39a`
SHA3	`eb2f20fc9d6a66831b6f9a38299b47f817f108c892ffb63bd155ff091a1fff59`
VirtualSize	`0x54`
VirtualAddress	`0x7000`
SizeOfRawData	`0x200`
PointerToRawData	`0x4800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.408509`

Imports

KERNEL32.dll	`CreateRemoteThreadEx` `OpenProcess` `VirtualAllocEx` `VirtualFreeEx` `WriteProcessMemory` `Sleep` `VirtualProtectEx` `GetExitCodeThread` `ReadProcessMemory` `CreateToolhelp32Snapshot` `Process32First` `Process32Next` `Module32First` `Module32Next` `GetCurrentThread` `WaitForSingleObject` `GetLastError` `VirtualQueryEx` `CloseHandle` `GetCurrentProcess` `GetModuleHandleW` `IsProcessorFeaturePresent` `GetStartupInfoW` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `IsDebuggerPresent` `InitializeSListHead` `GetSystemTimeAsFileTime` `GetCurrentThreadId` `GetCurrentProcessId` `QueryPerformanceCounter` `TerminateProcess`
ADVAPI32.dll	`ImpersonateSelf` `AdjustTokenPrivileges` `OpenThreadToken` `LookupPrivilegeValueA`
VCRUNTIME140.dll	`__std_exception_copy` `_CxxThrowException` `_except_handler4_common` `__std_type_info_destroy_list` `memcmp` `__std_exception_destroy` `__CxxFrameHandler3` `memset`
api-ms-win-crt-stdio-l1-1-0.dll	`__p__commode` `_set_fmode` `__stdio_common_vfprintf` `__acrt_iob_func`
api-ms-win-crt-multibyte-l1-1-0.dll	`_mbscmp`
api-ms-win-crt-runtime-l1-1-0.dll	`_initterm_e` `_seh_filter_dll` `_initialize_onexit_table` `_register_onexit_function` `_register_thread_local_exe_atexit_callback` `_crt_atexit` `_crt_at_quick_exit` `_controlfp_s` `terminate` `_seh_filter_exe` `_c_exit` `_cexit` `__p___argv` `__p___argc` `exit` `_get_initial_narrow_environment` `_initialize_narrow_environment` `_configure_narrow_argv` `_execute_onexit_table` `_exit` `_set_app_type` `_initterm`
api-ms-win-crt-math-l1-1-0.dll	`__setusermatherr`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`
api-ms-win-crt-heap-l1-1-0.dll	`malloc` `_set_new_mode` `_callnewh` `free`

Delayed Imports

_ourRemoteThread@4

Ordinal	`1`
Address	`0x1000`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2018-Mar-11 00:09:46
Version	`0.0`
SizeofData	`109`
AddressOfRawData	`0x48cc`
PointerToRawData	`0x36cc`
Referenced File	D:\Documents\GitHub\HitmanBloodMoney_UnlimitedSaves\MinimalExcess\PatchSaveLimit.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2018-Mar-11 00:09:46
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x493c`
PointerToRawData	`0x373c`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2018-Mar-11 00:09:46
Version	`0.0`
SizeofData	`644`
AddressOfRawData	`0x4950`
PointerToRawData	`0x3750`

TLS Callbacks

Load Configuration

Size	`0x5c`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x406018`
SEHandlerTable	`0x4048c0`
SEHandlerCount	`3`

RICH Header

XOR Key	`0xb471136`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`12`
Imports (VS2015 UPD3 build 24123)	`2`
ASM objects (VS2015 UPD3 build 24123)	`2`
C++ objects (VS2015 UPD3 build 24123)	`25`
C objects (VS2015 UPD3 build 24123)	`13`
Imports (65501)	`5`
Total imports	`77`
C++ objects (VS2015 UPD3.1 build 24215)	`2`
Exports (VS2015 UPD3.1 build 24215)	`1`
Linker (VS2015 UPD3.1 build 24215)	`1`

Errors

Leave a comment

No comments yet.