Manalyze report for c98ed1fbecd64d2d6661aca0865cb150f816483c627c5557af6c3b535edbc0a1

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	1970-Jan-01 00:00:00
Debug artifacts	Embedded COFF debugging symbols

Plugin Output

Suspicious	PEiD Signature:	`XWD graphics format` `HQR data file`
Info	Interesting strings found in the binary:	`Contains domain names: -github.com .eq.github.com .eq.golang.org .github.com .golang.org .hash.golang.org .hash.net cases.info eq.github.com eq.golang.org github.com golang.org hash.golang.org itab.github.com itab.golang.org`
Suspicious	The PE is possibly packed.	`Unusual section name found: .xdata` `Unusual section name found: /4` `Unusual section name found: /19` `Unusual section name found: /32` `Unusual section name found: /46` `Unusual section name found: /65` `Unusual section name found: /78` `Unusual section name found: /95` `Unusual section name found: /112` `Unusual section name found: .symtab`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Functions which can be used for anti-debugging purposes: SwitchToThread`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`1a1fad1a7babe5c468d5567a74eb01a3`
SHA1	`fb2056b4975db7ae8dfb70c722a5aac5a7eae36b`
SHA256	`c98ed1fbecd64d2d6661aca0865cb150f816483c627c5557af6c3b535edbc0a1`
SHA3	`bcfc76396a5f49a66d5944586a89e7b7b64eb1e25bdaf34d7e28ea7cda33536f`
SSDeep	`49152:r9A/hrxxpx/32vfMZ35kjqEdfigMSKVO+GDXVRYFqlDDLvNbwwklRzNYiQK0He8:r9AZl/U76+XBLFcfC+sm0YoLu64UP`
Imports Hash	`9b763104e1c7e7b7334a1e9ed4235cd3`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0x8b`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`16`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0x4cc200`
NumberOfSymbols	`5306`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`3.0`
SizeOfCode	`0x170600`
SizeOfInitializedData	`0x55e00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000083EC0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.1`
ImageVersion	`1.0`
SubsystemVersion	`6.1`
Win32VersionValue	`0`
SizeOfImage	`0x562000`
SizeOfHeaders	`0x600`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`1eee65fbf3720e589969701fbbf06d13`
SHA1	`1c3f832f856101c3a27c1fb5601619b3b65f7c56`
SHA256	`9a6bbc75a91973cb8b868bf0c06f31286ccc5352c1c002d8dd9ef27ee661dab8`
SHA3	`12b6f2f87e2f56e2ea60bdc28fd38bc7abbaf857c162c0fed954031542c5db5c`
VirtualSize	`0x170471`
VirtualAddress	`0x1000`
SizeOfRawData	`0x170600`
PointerToRawData	`0x600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.23607`

.rdata

MD5	`cb02e4dcc8cb1b73a102e41eee3c7166`
SHA1	`124821f90fbcd58cd624c47e053d5d616f6a0096`
SHA256	`b9d862d784fe0daa57894820bd8abcf7b26bccb066d1f9a06e3ba73a894cefb3`
SHA3	`2ea89b81e2705de49626a7a0d09528c98a63dc75f266b46e5c420933dc3cbead`
VirtualSize	`0x19f8b0`
VirtualAddress	`0x172000`
SizeOfRawData	`0x19fa00`
PointerToRawData	`0x170c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.62977`

.data

MD5	`a14ed22ae33fc9be714d4a4eb39e297f`
SHA1	`ba012203f6d6a0e6c1a6d099afb180e87a194968`
SHA256	`3455e959eb3ee7f7d18a6ad2732222b4cc169badbbeeb06ce9185ffad835b9c1`
SHA3	`4b68f583949031a3ef4d07888d37771f84e990d088ee8bc1c52be5f992dad3a4`
VirtualSize	`0xa0ec8`
VirtualAddress	`0x312000`
SizeOfRawData	`0x55e00`
PointerToRawData	`0x310600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.84707`

.pdata

MD5	`8708dc3bea32c5b91197c15608e8426c`
SHA1	`1b5d7ab05be6c374247a8ae777bcf7253ffe22f0`
SHA256	`44a37cf7dd87ef261534f6e732674cf6b255a9356bec22bf195417e4168d7b52`
SHA3	`c742ca3e26a18be191f409dbf47ca8dae48961c479362db4254375504130a320`
VirtualSize	`0x8df0`
VirtualAddress	`0x3b3000`
SizeOfRawData	`0x8e00`
PointerToRawData	`0x366400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.28843`

.xdata

MD5	`044b699de7aec44b7ddfedadd2f54e61`
SHA1	`ea990e33a59bd02ca641800a2b56d92246c2ce1b`
SHA256	`8abc72908a19df8e0424d53a7670622170ca3554b59c9a77423ef5429decbdfc`
SHA3	`ad479b2fc213a71878021a8b483a10af49b65c33507007c5e856bd56744c68c7`
VirtualSize	`0xa8`
VirtualAddress	`0x3bc000`
SizeOfRawData	`0x200`
PointerToRawData	`0x36f200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.69653`

/4

MD5	`bcddef00414a946919302442928e542e`
SHA1	`b0fbeae40093e8241edcbdeae94ba06880dedf04`
SHA256	`fb7bf682d27ba8920146a9b134a183cd2109b202916488b9b3a4f7d623f0b484`
SHA3	`7d5b252590738bde977b6dfab9c3034c2ad82b952980a3585c1dc88e1f06f005`
VirtualSize	`0x154`
VirtualAddress	`0x3bd000`
SizeOfRawData	`0x200`
PointerToRawData	`0x36f400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.67257`

/19

MD5	`32eebf424c05c6d8ea050e463dabf636`
SHA1	`98426eb3db30b379fab868b565479a348bb2ab56`
SHA256	`7b7096c61e15807ef12fa47631972de925b8d273087b7210a86235745917b48f`
SHA3	`26ca936efff8427d6456aae38a6a2ae055fbe8144a6ec2ea4a4f527c1a17483d`
VirtualSize	`0x490a5`
VirtualAddress	`0x3be000`
SizeOfRawData	`0x49200`
PointerToRawData	`0x36f600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99645`

/32

MD5	`f45feba436424d0574db9e5aa310079c`
SHA1	`5f96908412ead356b7f45e7137c4a08976fdaa6d`
SHA256	`ff931755fe53dd9578bcf7e57f73641d862932146e0ae59db394b137c1545d3c`
SHA3	`0e18ea880647e115df70ca5e5b72e43647f0f3302a3c18bf9718afad96c60716`
VirtualSize	`0xe61d`
VirtualAddress	`0x408000`
SizeOfRawData	`0xe800`
PointerToRawData	`0x3b8800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.92772`

/46

MD5	`40cca7c46fc713b4f088e5d440ca7931`
SHA1	`3aaa1650bfaf5325fa9cb3a1a284aebcc92aebf4`
SHA256	`3e3c5f5d419b70e588da0ef0e3d9ce1a5863a5624febc16cd0c007cd14e89015`
SHA3	`a0e18fe9f6ac46417d52cdc99cf9ae56edb5a53f788995a085b10f88f348a0e4`
VirtualSize	`0x30`
VirtualAddress	`0x417000`
SizeOfRawData	`0x200`
PointerToRawData	`0x3c7000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.855685`

/65

MD5	`2a5afcc03eba58f2b0b1059f13bd7b19`
SHA1	`06c655113935737b19c006960a5263e9475a9296`
SHA256	`20fec570a341970e6bf99ec3d27187be7b982d2ce5c4d174c11e3aff0178b57a`
SHA3	`9454010277e212273d7817366f2e77d43a737ed9d927790825f3c96ef722530c`
VirtualSize	`0x9dd51`
VirtualAddress	`0x418000`
SizeOfRawData	`0x9de00`
PointerToRawData	`0x3c7200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99804`

/78

MD5	`807b8d0816894418974907ae0d2e73a8`
SHA1	`dcf5b05d9b89d96a81a04e54bd4f64d3aee3ad9d`
SHA256	`f5951b79d05591d7931949db23ce6262d25f2a1cb07129da92ac83dd4ee2fd4a`
SHA3	`6386a1cecd284e2da4fcbd504df6c3e9f8925e629ffd80eada9cb6affe1b46af`
VirtualSize	`0x3e876`
VirtualAddress	`0x4b6000`
SizeOfRawData	`0x3ea00`
PointerToRawData	`0x465000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.9965`

/95

MD5	`8dc418164616764de2deda7d02e7cf3b`
SHA1	`7c816c0668ad5c5ee5e194dbed567c5deb4d397e`
SHA256	`8ce6b3aa812f5c43a0251401229e460f528a80e7c2c107bd99a9f075c73bbe2d`
SHA3	`334529aeb0fa17a998fd9a9905b5a380a8cae7b21bef7be2768162a1c0cdeea3`
VirtualSize	`0x1e00e`
VirtualAddress	`0x4f5000`
SizeOfRawData	`0x1e200`
PointerToRawData	`0x4a3a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.99379`

/112

MD5	`0c75b43f22ece90299774a5f15782b2b`
SHA1	`2baacc2310ccc0cbadb6dcd2424fbd765a90c358`
SHA256	`a4b9120a776a227ee0c971c0087dc6c4c03a58a62dd13def1a17187b078f295b`
SHA3	`ca0d26486b5446e7733904675ff67c792d1401f3d3d5c7acfaf4f090b9d50427`
VirtualSize	`0x1cb8`
VirtualAddress	`0x514000`
SizeOfRawData	`0x1e00`
PointerToRawData	`0x4c1c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`7.68762`

.idata

MD5	`d5f38cc4cfefb03112458f877a9cbccd`
SHA1	`a1b9fb06ebe1b0fe39225810c09ba92a60299ab3`
SHA256	`6b31299dd457270c997b17ec439abbfe83263cc71777f3546635c3a82c662ee7`
SHA3	`397ab3966e3041ab4cafaaf42a2149c696b3272a74ab0f5f4e572da78b92c7a7`
VirtualSize	`0x55a`
VirtualAddress	`0x516000`
SizeOfRawData	`0x600`
PointerToRawData	`0x4c3a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.01375`

.reloc

MD5	`e9e559555aa1d2236d4977597acd882a`
SHA1	`e6e8d4808581a33956609c8348f89cfc0258d12c`
SHA256	`ba23d5a646346d7f224dab1176cea3304464e22f6dcabc541fc00974a535cd1b`
SHA3	`ca8113cef62d732f30c2bbe318f43834a0304eafe4b3828fdc19c893863a9f41`
VirtualSize	`0x81c0`
VirtualAddress	`0x517000`
SizeOfRawData	`0x8200`
PointerToRawData	`0x4c4000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.42494`

.symtab

MD5	`269d4fb4a2194abf8ea1d2d838de067c`
SHA1	`3c1c570b7334dbfdb4288154f09b80d8a19e9c98`
SHA256	`9fec1cf02d866a28d52f64f6ce48facb2353ce006829a5809bc3496e31bedba3`
SHA3	`32366f8053c6c5a2550ae11ceada3e257101f674a9a6818b93fb7a38fd64465f`
VirtualSize	`0x41337`
VirtualAddress	`0x520000`
SizeOfRawData	`0x41400`
PointerToRawData	`0x4cc200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.24572`

Imports

kernel32.dll	`GetProcAddress` `LoadLibraryExW` `WriteFile` `WriteConsoleW` `WerSetFlags` `WerGetFlags` `WaitForMultipleObjects` `WaitForSingleObject` `VirtualQuery` `VirtualFree` `VirtualAlloc` `TlsAlloc` `SwitchToThread` `SuspendThread` `SetWaitableTimer` `SetProcessPriorityBoost` `SetEvent` `SetErrorMode` `SetConsoleCtrlHandler` `RtlVirtualUnwind` `RtlLookupFunctionEntry` `ResumeThread` `RaiseFailFastException` `PostQueuedCompletionStatus` `LoadLibraryExW` `SetThreadContext` `GetThreadContext` `GetSystemInfo` `GetSystemDirectoryA` `GetStdHandle` `GetQueuedCompletionStatusEx` `GetProcessAffinityMask` `GetProcAddress` `GetErrorMode` `GetEnvironmentStringsW` `GetCurrentThreadId` `GetConsoleMode` `FreeEnvironmentStringsW` `ExitProcess` `DuplicateHandle` `CreateWaitableTimerExW` `CreateThread` `CreateIoCompletionPort` `CreateEventA` `CloseHandle` `AddVectoredExceptionHandler` `AddVectoredContinueHandler`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Tried to read outside the COFF string table to get the name of section /4!
[*] Warning: Tried to read outside the COFF string table to get the name of section /19!
[*] Warning: Tried to read outside the COFF string table to get the name of section /32!
[*] Warning: Tried to read outside the COFF string table to get the name of section /46!
[*] Warning: Tried to read outside the COFF string table to get the name of section /65!
[*] Warning: Tried to read outside the COFF string table to get the name of section /78!
[*] Warning: Tried to read outside the COFF string table to get the name of section /95!
[*] Warning: Tried to read outside the COFF string table to get the name of section /112!

Leave a comment

No comments yet.