c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jan-05 23:54:24
TLS Callbacks 2 callback(s) detected.
Debug artifacts Embedded COFF debugging symbols

Plugin Output

Suspicious PEiD Signature: HQR data file
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • schtask
 May have dropper capabilities:
  • CurrentVersion\Run
  • Programs\Startup
 Accesses the WMI:
  • root\subscription
 Miscellaneous malware strings:
  • VIRUS
  • cmd.exe
 Contains domain names:
  • -0930.avif.html.info
  • .eq.github.com
  • .eq.golang.org
  • .hash.net
  • 0930.avif.html.info
  • Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.net.org
  • Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.net.org
  • api.deepseek.com
  • avif.html.info
  • bat.cmd.com.css.exe.gif.htm.jpg.mjs.net.org
  • cdn.discordapp.com
  • cmd.com.css.exe.gif.htm.jpg.mjs.net.org
  • com.css.exe.gif.htm.jpg.mjs.net.org
  • css.exe.gif.htm.jpg.mjs.net.org
  • deepseek.com
  • discord.com
  • discordapp.com
  • eq.github.com
  • eq.golang.org
  • exe.gif.htm.jpg.mjs.net.org
  • generativelanguage.googleapis.com
  • gif.htm.jpg.mjs.net.org
  • github.com
  • go.itab.github.com
  • go.itab.net
  • golang.org
  • googleapis.com
  • htm.jpg.mjs.net.org
  • https://api.deepseek.com
  • https://api.deepseek.com/v1/chat/completionsinsufficient
  • https://api.mistral.ai
  • https://api.mistral.ai/v1/chat/completionsinsufficient
  • https://cdn.discordapp.com
  • https://cdn.discordapp.com/insufficient
  • https://discord.com
  • https://generativelanguage.googleapis.com
  • https://generativelanguage.googleapis.com/v1beta/models/gemini-pro
  • https://openrouter.ai
  • https://status.discord.com
  • https://status.discord.com/api/v2/illegal
  • itab.github.com
  • jpg.mjs.net.org
  • mjs.net.org
  • runtime.net
  • runtime.us
  • status.discord.com
  • textproto.nl
  • type..eq.github.com
  • type..eq.golang.org
  • type..eq.net
  • type..hash.net
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: /4
Unusual section name found: /19
Unusual section name found: /31
Unusual section name found: /45
Unusual section name found: /57
Unusual section name found: /70
Unusual section name found: /81
Unusual section name found: /92
Unusual section name found: /106
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Suspicious The file contains overlay data. 531782 bytes of data starting at offset 0xd53800.
Malicious VirusTotal score: 41/71 (Scanned on 2026-09-27 13:15:54) APEX: Malicious
AVG: Win64:MalwareX-gen [Misc]
AhnLab-V3: Trojan/Win.Evo-gen.C5284445
Antiy-AVL: Trojan/Win64.Loader
Arcabit: Trojan.ClosedQuorum.8
Avast: Win64:MalwareX-gen [Misc]
Avira: TR/W64.Agent
BitDefender: Trojan.ClosedQuorum.8
Bkav: W32.Malware.7841D9A2
CTX: exe.trojan.loader
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
DrWeb: Trojan.Packed2.51996
ESET-NOD32: WinGo/Quorum.C trojan
Emsisoft: Trojan.ClosedQuorum.8 (B)
F-Secure: Trojan.TR/W64.Agent
GData: Trojan.ClosedQuorum.8
Google: Detected
K7AntiVirus: Riskware ( 00584baa1 )
K7GW: Riskware ( 00584baa1 )
Kaspersky: UDS:Trojan.Win64.Loader
Kingsoft: Win32.Troj.Unknown.a
Lionic: Trojan.Win32.ClosedQuorum.4!c
McAfeeD: ti!C4DC171F2513
MicroWorld-eScan: Trojan.ClosedQuorum.8
Microsoft: Trojan:Win64/CLOSEDQUORUM.DA!MTB
Paloalto: generic.ml
Panda: Trj/PhxBzA.A
Rising: Trojan.Loader!8.15A8 (CLOUD)
Sangfor: Trojan.Win64.Agent.V40i
SentinelOne: Static AI - Suspicious PE
Sophos: Mal/Generic-S
Symantec: Trojan.Malgent!ATN
Tencent: Win32.Trojan.Agent.Hdhl
TrellixENS: Artemis!39CEEB8FD9A1
TrendMicro: Trojan.Win32.LOADER.USBLIM26
TrendMicro-HouseCall: Trojan.Win32.LOADER.USBLIM26
VIPRE: Trojan.ClosedQuorum.8
Varist: W64/ABTrojan.PQZM-1014
VirIT: Trojan.Win64.Agent.KGH
alibabacloud: Trojan:Multi/Quorum.C

Hashes

MD5 39ceeb8fd9a17098092434f43edaed18 🔍
SHA1 b8644f66e695101b1a3ff5a57be09c073db7922f 🔍
SHA256 c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7 🔍
SHA3 afd3070369860e736326d7a8930b12a6d494a467b9a810f771ac2ee1c8446142 🔍
SSDeep 98304:qHnAVvm2J9smEFEadl7NYfDUZhY3gI7Vs2qtaBp8CXps1hwc:qgV7wFRVYDUZqu1hb 🔍
Imports Hash 4b303c2e687e492297b7c38ed6028e45 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 20
TimeDateStamp 2026-Jan-05 23:54:24
PointerToSymbolTable 0xd53800
NumberOfSymbols 12060
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0x2a7400
SizeOfInitializedData 0x591e00
SizeOfUninitializedData 0x62000
AddressOfEntryPoint 0x00000000000014F0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.1
ImageVersion 0.0
SubsystemVersion 6.1
Win32VersionValue 0
SizeOfImage 0xdc1000
SizeOfHeaders 0x600
Checksum 0xde4d38
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a1c7bde6ba453f2221aba240276d1f04 🔍
SHA1 c6c8392becc604f852d8b78795301df4f5c43833 🔍
SHA256 9e4bd748cbbe03f3a7c787a4a5f5be3e179f4ac47623e1f26084aa877e61c2e1 🔍
SHA3 4c1a03af48d891718e06e9afe32bf68abd6516219c2fc43ec75e202daa5abf27 🔍
VirtualSize 0x2a7390
VirtualAddress 0x1000
SizeOfRawData 0x2a7400
PointerToRawData 0x600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.16416

.data

MD5 92cd3a9d78b624d544f688bcee0e739a 🔍
SHA1 504c88ed7f58267f98c911ed4eda670b85e38965 🔍
SHA256 e61d25fd321749419bb3ab697202d2c980b228279405054de33349c24aa9be14 🔍
SHA3 23758b7121bb540fb4eb19cc3e570a2f946e62682e3a2b272ecf7874ad5f37c6 🔍
VirtualSize 0x3d800
VirtualAddress 0x2a9000
SizeOfRawData 0x3d800
PointerToRawData 0x2a7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.36054

.rdata

MD5 3c881cddf7b9f4865be4351fc2f79c88 🔍
SHA1 a3ed6fac479542d7b9d52d6d756e8db87ebd27f2 🔍
SHA256 91cb7750eaad9ff567598d07b72cba56666b2b25bcd3e66053e221a0af9f66cd 🔍
SHA3 a644a8a55c4e76e5219e26832964bef8f2dcbf21a607442e3127f6299a9a8a56 🔍
VirtualSize 0x29e500
VirtualAddress 0x2e7000
SizeOfRawData 0x29e600
PointerToRawData 0x2e5200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.66836

.pdata

MD5 f2d45531a8d47188ee7c05e6178c2de0 🔍
SHA1 6afdc3ac618a0474e68bd0aeacf12da2869c7eef 🔍
SHA256 8dad0068512bdcf3db9dbd4b6f5eb41382296922e700f66a46e8b746e237c5f2 🔍
SHA3 32a595b2afb5084f53c095c2574012837e5656521a5fa49206f80124bcf83250 🔍
VirtualSize 0x5e8
VirtualAddress 0x586000
SizeOfRawData 0x600
PointerToRawData 0x583800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.90366

.xdata

MD5 9d3e2b24d0c213635b9b94aa68b2a0d1 🔍
SHA1 a47012dc82c8503db0ba1916364d37a2644f96fe 🔍
SHA256 0f6ff62e994fa3c169cacc5c60a12186ba9b02b9c4d19f1721f3f433d55ec16b 🔍
SHA3 6f4a7b60e12475d610e4e3f21f3125ca1a4d03139325f65905f2ee80ebc27dec 🔍
VirtualSize 0x53c
VirtualAddress 0x587000
SizeOfRawData 0x600
PointerToRawData 0x583e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.98843

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x61f10
VirtualAddress 0x588000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata

MD5 5f0b6752200bb9a29005640a7eee3821 🔍
SHA1 414af9cf3c9f8e4f0a190f92f1fb20f5121ba738 🔍
SHA256 79116d10b6106aee504ef790f3e1bf0fb67851b3d49b5604fe8d67df1a051449 🔍
SHA3 d3634509d284c9666017217219311e5028332232714dc4585c378c61e67f11c4 🔍
VirtualSize 0x4e
VirtualAddress 0x5ea000
SizeOfRawData 0x200
PointerToRawData 0x584400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.91923

.idata

MD5 a758fcbd8c2d6dc56bf5b9c785255455 🔍
SHA1 234a3acafa3958531912d26ebb3306a14fb271cc 🔍
SHA256 05d2755efc890b01b6935d67d0fe8b48d405c53126c5eda30a3dca4b1ab96865 🔍
SHA3 a2863ba21dde1d44735d8276d31be84939fa1e74d1bc598967178ea43f58da77 🔍
VirtualSize 0xd1c
VirtualAddress 0x5eb000
SizeOfRawData 0xe00
PointerToRawData 0x584600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.31215

.CRT

MD5 4abae69101e0f3922bdce0115f88502d 🔍
SHA1 e0ef468a262e7bdb8a8b376de83ff6cae03b5bd5 🔍
SHA256 2fc45fbcec4edcfa3aaf4e7f1fff6e68c72ab10cb27afbd42cc971bde22eec57 🔍
SHA3 ca9c1cca18ed1e988c7d933b1178a560fff08f4485e39b27d13cb75b556b8163 🔍
VirtualSize 0x68
VirtualAddress 0x5ec000
SizeOfRawData 0x200
PointerToRawData 0x585400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.386799

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x5ed000
SizeOfRawData 0x200
PointerToRawData 0x585600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 5994fe144725e7a0616204448c122d48 🔍
SHA1 8f58c653c8c8b9c19c4754f3faf0b4c6957b6a0e 🔍
SHA256 2e4ee044a49e218ad24d3d0b5e3f29efd9e53a5b47cdc97ad075a86d3be65e04 🔍
SHA3 9bb2d714c3374ed2c6262c2d05f1b837967b30e0c76264c75819417c52da0af6 🔍
VirtualSize 0xca64
VirtualAddress 0x5ee000
SizeOfRawData 0xcc00
PointerToRawData 0x585800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.42273

/4

MD5 ecf72634734f9696a26c7e684888861c 🔍
SHA1 0e1eb548c80dd9b4f0bae93d6cab67ae896b7fef 🔍
SHA256 439bf742e76b276d7904773474c27d70757741b9a5f3299f128e4865351a352f 🔍
SHA3 b4b34829b3c0e42d06e090c608e17893ee4acbe48dc381f08b5d53e283385ba1 🔍
VirtualSize 0x810
VirtualAddress 0x5fb000
SizeOfRawData 0xa00
PointerToRawData 0x592400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.75016

/19

MD5 3cfe43f39bfa0fe6d7f1befc10b34c27 🔍
SHA1 0e3f1bb7a08c4e5b8905d207f54da6c66bca24ed 🔍
SHA256 de4740e15536e0536597a84cc69a70980b518648a368a0434c2316bf1b926fb3 🔍
SHA3 5b053349e540ea84df67b6e15d152703a534225a5e06f3264f934cf6bb2fb08e 🔍
VirtualSize 0x2ed64e
VirtualAddress 0x5fc000
SizeOfRawData 0x2ed800
PointerToRawData 0x592e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.31872

/31

MD5 776538e259ea0c147d5b3952465166e7 🔍
SHA1 6d8d2f455f1ac9ea962ef20e43df432c9d34ff3d 🔍
SHA256 4d5d05315bfe57e1d990b6cf65bca6ab0125f3fad712c67de2f0d5d2c64d0935 🔍
SHA3 ee76d65fb83fd004739f631abda63e5543b0022db2052c0bcb4f01cda4033a33 🔍
VirtualSize 0x469f
VirtualAddress 0x8ea000
SizeOfRawData 0x4800
PointerToRawData 0x880600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.70608

/45

MD5 15d84013705f2f844305057db1cf0ac5 🔍
SHA1 0b25f7b3197cfdf61430e2d676a04af72cb14b3d 🔍
SHA256 c820f822d3dd20ca080dc745912e5f1633b95be6ffcc8d0fba4958bc26d120c1 🔍
SHA3 54eb6882c7f81a5a6c457d67413bb2b76f8916d4a0b22119f83c23134f88552e 🔍
VirtualSize 0xd8068
VirtualAddress 0x8ef000
SizeOfRawData 0xd8200
PointerToRawData 0x884e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.95608

/57

MD5 38550125d5ff8219495f24a8e2206aba 🔍
SHA1 9bc3383ec371938542274b599820f7af74e2e93f 🔍
SHA256 fc96b893c6a5bbbb97eb2607c2231f31fd647a17ce5cc9b02c62452118b9c724 🔍
SHA3 4fd6a3efa5907572c892503923bcaaafc885c8158be6f79a29aa2b0cd0c5d7ca 🔍
VirtualSize 0x41bd0
VirtualAddress 0x9c8000
SizeOfRawData 0x41c00
PointerToRawData 0x95d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.21815

/70

MD5 63ae1cc087ab21d36f601b6692f90547 🔍
SHA1 4d193371d62ae30d9a2fa2ac4144d605bf158980 🔍
SHA256 8fcd1fd74e0e34e5b363c6654c48e99cc99dd4861eaf1e21fc83ca84975a93ed 🔍
SHA3 4f4a2cce1471d5558e03d2b3224179d91514059efd92f95dcea4e4ad05b03935 🔍
VirtualSize 0xb55
VirtualAddress 0xa0a000
SizeOfRawData 0xc00
PointerToRawData 0x99ec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.69001

/81

MD5 d20bd4542f3d28b28cfa019f79af9c29 🔍
SHA1 616692e4be2ecd23528d06ad190a37272200ffc6 🔍
SHA256 6bd6ff83fd8771689a336a312b6ac9007841adbe6b13008f5d3b42bb167787bc 🔍
SHA3 f49256a6fa3c8223445bead5303e90dd5bed91e7c10ca254d2bb31064588c118 🔍
VirtualSize 0x2f5371
VirtualAddress 0xa0b000
SizeOfRawData 0x2f5400
PointerToRawData 0x99f800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.97615

/92

MD5 4d36b37578ca792e6cd1ead6e4ae318b 🔍
SHA1 596065d6ac529bcfd5a9fcd852d5eda21f058fcd 🔍
SHA256 7c66d5e3e41ab6630674cd47e72e2f78027fb4f3af998d24be19062d361c87a8 🔍
SHA3 eb281ac273014309dba90e28be5cd19ab3e53add8a5400d696d542fa6d08be7b 🔍
VirtualSize 0xbe900
VirtualAddress 0xd01000
SizeOfRawData 0xbea00
PointerToRawData 0xc94c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.38597

/106

MD5 14fe0ceeb16d7d238538affa274adb4f 🔍
SHA1 934906baf855e3ce7c34a16f38653577ad39232a 🔍
SHA256 576e51c49b16f8c1ef30ab84d618b773b0be389e04507ad5d26ebf0a4a66b45a 🔍
SHA3 3732759dc156c4f608606ae05b94cd8f73875b0848128b39bae2210230a01351 🔍
VirtualSize 0x2d
VirtualAddress 0xdc0000
SizeOfRawData 0x200
PointerToRawData 0xd53600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.788378

Imports

KERNEL32.dll AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetEnvironmentStringsW
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt.dll ___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
signal
strerror
strlen
strncmp
vfprintf
wcslen

Delayed Imports

_cgo_dummy_export

Ordinal 1
Address 0x5e9380

Version Info

TLS Callbacks

StartAddressOfRawData 0x1405ed000
EndAddressOfRawData 0x1405ed008
AddressOfIndex 0x1405e9dcc
AddressOfCallbacks 0x1405ec040
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks 0x00000001402A6A60
0x00000001402A6A30

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4! [*] Warning: Tried to read outside the COFF string table to get the name of section /19! [*] Warning: Tried to read outside the COFF string table to get the name of section /31! [*] Warning: Tried to read outside the COFF string table to get the name of section /45! [*] Warning: Tried to read outside the COFF string table to get the name of section /57! [*] Warning: Tried to read outside the COFF string table to get the name of section /70! [*] Warning: Tried to read outside the COFF string table to get the name of section /81! [*] Warning: Tried to read outside the COFF string table to get the name of section /92! [*] Warning: Tried to read outside the COFF string table to get the name of section /106! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF symbol's section number is bigger than the number of sections! [*] Warning: COFF String Table's reported size is bigger than the remaining bytes! [*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.