| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Feb-25 21:35:15 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\Users\Leon\source\repos\dbd1 - Copy - obfuscate\x64\stickynote.pdb
|
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA1 Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. | Unusual section name found: .1337 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. |
Resource 101 detected as a PE Executable.
Resource 102 detected as a PE Executable. |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x130 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2026-Feb-25 21:35:15 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2a1400 |
| SizeOfInitializedData | 0x15d400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000023B044 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x404000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
|---|---|
| KERNEL32.dll |
ReleaseMutex
GetSystemDirectoryW OpenProcess Sleep GetConsoleMode GetTickCount64 SetEvent GetSystemDirectoryA LockResource DeleteFileW CloseHandle LoadResource FindResourceW GetCurrentProcessId GetModuleHandleW GetConsoleWindow WinExec CreateProcessA CreateEventA AllocConsole GetExitCodeProcess VirtualFree LoadLibraryExA WriteConsoleW VerifyVersionInfoW AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetTickCount GetLastError GetFileAttributesW K32GetModuleInformation MoveFileExW WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe CreateFileW WaitForSingleObject CreateMutexA TerminateProcess VirtualAlloc SetConsoleMode SizeofResource WriteFile GetCurrentProcess CreateFileA DeviceIoControl WaitForMultipleObjects QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA WideCharToMultiByte GlobalFree OutputDebugStringA GlobalUnlock SetConsoleCursorPosition CreateDirectoryA FormatMessageW GetFileSizeEx LocalFree SleepConditionVariableSRW GetCurrentThreadId SetConsoleTitleA SetConsoleTextAttribute SetConsoleCtrlHandler SetLastError ExitProcess GlobalLock FlushConsoleInputBuffer FillConsoleOutputAttribute GlobalAlloc GetStdHandle GetConsoleScreenBufferInfo FillConsoleOutputCharacterA MultiByteToWideChar ReleaseSRWLockExclusive GetFullPathNameW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WakeAllConditionVariable |
| USER32.dll |
GetCursorPos
GetAsyncKeyState OpenClipboard CloseClipboard EmptyClipboard GetWindowThreadProcessId GetSystemMenu DispatchMessageA MessageBoxA DestroyWindow SetWindowPos EnumChildWindows PostMessageA SetWindowTextW SetClipboardData SetCursorPos GetClientRect SetCursor GetForegroundWindow GetKeyboardLayout ClientToScreen ScreenToClient LoadCursorA GetClipboardData GetWindowRect GetKeyState UpdateWindow FindWindowA GetDesktopWindow PostQuitMessage PeekMessageA DrawMenuBar FindWindowW TranslateMessage SetLayeredWindowAttributes EnumWindows SetWindowTextA GetWindowLongA GetWindowTextA FindWindowExA SetWindowLongA IsWindow GetClassNameA ShowWindow |
| ADVAPI32.dll |
CryptDestroyKey
CryptImportKey CryptEncrypt CryptGetHashParam CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext |
| SHELL32.dll |
SHGetFolderPathA
ShellExecuteW ShellExecuteA |
| ole32.dll |
CoSetProxyBlanket
CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx |
| OLEAUT32.dll |
VariantClear
SysAllocString VariantInit SysFreeString |
| ntdll.dll |
RtlCaptureContext
RtlLookupFunctionEntry wcschr RtlVirtualUnwind strpbrk wcsncmp wcsncpy_s wcslen __chkstk memcmp memmove strcmp memchr strcspn strrchr strlen memset memcpy NtLoadDriver NtCreateFile _stricmp RtlAdjustPrivilege NtClose NtDeviceIoControlFile RtlGetFullPathName_UEx wcscat_s wcscpy_s RtlInitUnicodeString RtlCreateRegistryKey NtUnloadDriver NtQuerySystemInformation _vsnwprintf RtlWriteRegistryValue strcat_s strtol _wcsicmp strchr strncmp strstr strncpy sin sqrt tan qsort strspn |
| MSVCP140.dll |
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A _Thrd_id _Thrd_join ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z |
| WS2_32.dll |
recv
getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons setsockopt closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSASetLastError WSAIoctl __WSAFDIsSet select htonl listen getaddrinfo gethostname freeaddrinfo recvfrom sendto ioctlsocket WSAGetLastError |
| CRYPT32.dll |
CertOpenStore
CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCreateCertificateChainEngine |
| Secur32.dll |
InitSecurityInterfaceW
|
| IPHLPAPI.DLL |
if_nametoindex
|
| IMM32.dll |
ImmReleaseContext
ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow |
| D3DCOMPILER_43.dll |
D3DCompile
|
| dwmapi.dll |
DwmExtendFrameIntoClientArea
|
| bcrypt.dll |
BCryptGenRandom
|
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
__intrinsic_setjmp
longjmp _CxxThrowException __C_specific_handler __current_exception __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context |
| api-ms-win-crt-heap-l1-1-0.dll |
_callnewh
realloc _set_new_mode calloc free malloc |
| api-ms-win-crt-runtime-l1-1-0.dll |
_beginthreadex
_invoke_watson exit terminate _errno _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table strerror_s _initialize_narrow_environment _configure_narrow_argv |
| api-ms-win-crt-stdio-l1-1-0.dll |
_get_stream_buffer_pointers
freopen ftell _lseeki64 _write _read fseek fgets __stdio_common_vfprintf _wfsopen fread _wsopen_s _wfopen fputc feof _set_fmode __acrt_iob_func fputs fsetpos ungetc __p__commode fflush setvbuf _close fgetpos fopen __stdio_common_vsprintf _fseeki64 fclose __stdio_common_vsscanf fwrite __stdio_common_vsprintf_s fgetc freopen_s |
| api-ms-win-crt-convert-l1-1-0.dll |
wcstombs_s
strtoull strtod strtoll |
| api-ms-win-crt-filesystem-l1-1-0.dll |
_fullpath
_wstat64 _fstat64 _unlock_file _lock_file _unlink |
| api-ms-win-crt-locale-l1-1-0.dll |
localeconv
_configthreadlocale |
| api-ms-win-crt-time-l1-1-0.dll |
_gmtime64_s
strftime _time64 |
| api-ms-win-crt-utility-l1-1-0.dll |
rand
|
| api-ms-win-crt-string-l1-1-0.dll |
_strdup
|
| api-ms-win-crt-math-l1-1-0.dll |
_fdopen
fmodf __setusermatherr expf sqrtf cosf _dclass tanf ceilf acosf sinf |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Feb-25 21:35:15 |
| Version | 0.0 |
| SizeofData | 94 |
| AddressOfRawData | 0x2e809c |
| PointerToRawData | 0x2e689c |
| Referenced File | C:\Users\Leon\source\repos\dbd1 - Copy - obfuscate\x64\stickynote.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Feb-25 21:35:15 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x2e80fc |
| PointerToRawData | 0x2e68fc |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Feb-25 21:35:15 |
| Version | 0.0 |
| SizeofData | 928 |
| AddressOfRawData | 0x2e8110 |
| PointerToRawData | 0x2e6910 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Feb-25 21:35:15 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x1402e84d0 |
|---|---|
| EndAddressOfRawData | 0x1402e84d8 |
| AddressOfIndex | 0x1403db8bc |
| AddressOfCallbacks | 0x1402a4058 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140305840 |
| XOR Key | 0xcd78a4e2 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 22 |
| C objects (VS2022 Update 6 (17.6.4) compiler 32537) | 24 |
| C objects (33145) | 1 |
| 253 (35207) | 4 |
| ASM objects (35207) | 3 |
| C objects (35207) | 10 |
| C++ objects (35207) | 42 |
| Imports (35207) | 6 |
| Imports (VS2017 v15.2 compiler 25019) | 2 |
| C objects (35222) | 142 |
| Imports (33145) | 28 |
| Imports (21202) | 5 |
| Total imports | 559 |
| C++ objects (LTCG) (35222) | 26 |
| Resource objects (35222) | 1 |
| 151 | 1 |
| Linker (35222) | 1 |
No comments yet.