| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Apr-18 17:17:33 |
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 4 |
| TimeDateStamp | 2026-Apr-18 17:17:33 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x57a00 |
| SizeOfInitializedData | 0x5200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000056180 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x5f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| USER32.dll |
SetWindowPos
MonitorFromWindow PostMessageA GetSystemMetrics ShowWindow EndPaint SetTimer TrackMouseEvent SetWindowTextA GetMonitorInfoA DefWindowProcA CreateWindowExA GetWindowRect TranslateMessage SendMessageA SetCursor SystemParametersInfoA GetClientRect PostQuitMessage RegisterClassExA UpdateWindow ReleaseCapture InvalidateRect ReleaseDC BeginPaint LoadCursorA DispatchMessageA GetMessageA AdjustWindowRectEx SetLayeredWindowAttributes |
|---|---|
| GDI32.dll |
GetDeviceCaps
DeleteDC SelectObject CreateCompatibleBitmap DeleteObject |
| gdiplus.dll |
GdipDeletePen
GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdipCloneBrush GdipSetTextRenderingHint GdipCreateFromHDC GdipCreatePen1 GdipDrawPath GdipFree GdipClosePathFigure GdipGraphicsClear GdipFillPath GdipCreateSolidFill GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipDeletePath GdipAlloc GdipDeleteBrush GdipCreateFontFamilyFromName GdipSetStringFormatAlign GdipAddPathArcI GdipDrawRectangleI GdipSetStringFormatFlags GdipDeleteFontFamily GdipDrawString GdiplusShutdown GdiplusStartup GdipCreateStringFormat |
| MSVCP140.dll |
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z |
| KERNEL32.dll |
CreateThread
GetProcAddress GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetTickCount64 IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess LoadLibraryA MultiByteToWideChar GetModuleHandleA GetCurrentThreadId OutputDebugStringA GetStartupInfoW |
| VCRUNTIME140.dll |
__std_exception_destroy
memmove __current_exception_context __current_exception _CxxThrowException __C_specific_handler memcmp memcpy memset __std_exception_copy |
| api-ms-win-crt-stdio-l1-1-0.dll |
__stdio_common_vsprintf_s
__stdio_common_vsscanf __stdio_common_vfprintf fseek fclose __acrt_iob_func fopen fread __p__commode _set_fmode __stdio_common_vsprintf ftell |
| api-ms-win-crt-math-l1-1-0.dll |
floor
cos tan _dtest nan __setusermatherr pow round fmod log sin fabs trunc sqrt ceil |
| api-ms-win-crt-runtime-l1-1-0.dll |
_register_thread_local_exe_atexit_callback
_c_exit _errno _exit exit abort _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _invoke_watson _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e terminate |
| api-ms-win-crt-string-l1-1-0.dll |
isspace
isalnum isxdigit isalpha isdigit toupper tolower wcslen |
| api-ms-win-crt-convert-l1-1-0.dll |
strtoul
strtod strtol |
| api-ms-win-crt-utility-l1-1-0.dll |
rand
|
| api-ms-win-crt-heap-l1-1-0.dll |
free
_callnewh malloc _set_new_mode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Apr-18 17:17:33 |
| Version | 0.0 |
| SizeofData | 740 |
| AddressOfRawData | 0xb3c4 |
| PointerToRawData | 0xa7c4 |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140059040 |
| XOR Key | 0xc6387974 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| ASM objects (35207) | 4 |
| C objects (35207) | 10 |
| C++ objects (35207) | 26 |
| Imports (35207) | 6 |
| Imports (33145) | 9 |
| Total imports | 174 |
| C++ objects (LTCG) (35225) | 1 |
| Linker (35225) | 1 |
No comments yet.