cd3dfd2588ca0c132fe102194a999da90cc42243d86e93d0de5b75fc7ba7dbb8

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Nov-12 19:32:33
Detected languages English - United States

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • 2010-aia.verisign.com
  • 2010-crl.verisign.com
  • acutedotcomb.cn
  • aia.verisign.com
  • aia.ws.symantec.com
  • breveacutecomb.cn
  • brevegravecomb.cn
  • brevetildecomb.cn
  • circumflexacutecomb.cn
  • circumflexgravecomb.cn
  • circumflexhookcomb.cn
  • circumflextildecomb.cn
  • commaaccentright.cn
  • commaaccentrotate.cn
  • crl.microsoft.com
  • crl.thawte.com
  • crl.verisign.com
  • crl.ws.symantec.com
  • csc3-2010-aia.verisign.com
  • csc3-2010-crl.verisign.com
  • github.com
  • http://crl.microsoft.com
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
  • http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
  • http://crl.thawte.com
  • http://crl.thawte.com/ThawteTimestampingCA.crl0
  • http://crl.verisign.com
  • http://crl.verisign.com/pca3-g5.crl04
  • http://csc3-2010-aia.verisign.com
  • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
  • http://csc3-2010-crl.verisign.com
  • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
  • http://logo.verisign.com
  • http://logo.verisign.com/vslogo.gif04
  • http://ocsp.thawte.com0
  • http://ocsp.verisign.com0
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/SMI/2005/WindowsSettings
  • http://schemas.microsoft.com/SMI/2016/WindowsSettings
  • http://ts-aia.ws.symantec.com
  • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
  • http://ts-crl.ws.symantec.com
  • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
  • http://ts-ocsp.ws.symantec.com07
  • http://www.microsoft.com
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
  • http://www.microsoft.com/pkiops/Docs/Repository.htm0
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0
  • http://www.w3.org
  • http://www.w3.org/2000/svg'
  • https://fonts.floriankarsten.comThis
  • https://github.com
  • https://openfontlicense.orgOptical
  • https://openfontlicense.orghttps
  • https://rsms.me
  • https://scripts.sil.org
  • https://scripts.sil.org/OFLSpace
  • https://scripts.sil.org/OFLhttps
  • https://www.microsoft.com
  • https://www.verisign.com
  • https://www.verisign.com/cps0
  • https://www.verisign.com/rpa
  • https://www.verisign.com/rpa0
  • koronisaccentleft.cn
  • logo.verisign.com
  • macrondieresiscomb.cn
  • microsoft.com
  • schemas.microsoft.com
  • scripts.sil.org
  • symantec.com
  • thawte.com
  • tildecross.cn
  • tildemacroncomb.cn
  • tonos.top
  • ts-aia.ws.symantec.com
  • ts-crl.ws.symantec.com
  • uni02E5.cn
  • uni02E6.cn
  • uni02E7.cn
  • uni02E8.cn
  • uni02E9.cn
  • uni1DC4.cn
  • uni1DC6.cn
  • verisign.com
  • ws.symantec.com
  • www.microsoft.com
  • www.verisign.com
  • www.w3.org
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to RC5 or RC6
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Can access the registry:
  • RegGetValueW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileA
  • CreateFileW
  • GetTempPathW
 Manipulates other processes:
  • Process32FirstW
  • Process32NextW
Malicious The PE is possibly a dropper. Resource 101 detected as a PE Executable.
Resource 102 detected as a PE Executable.
Resource 103 detected as a PE Executable.
Resource 104 detected as a PE Executable.
Resources amount for 92.5041% of the executable.
Malicious VirusTotal score: 12/71 (Scanned on 2026-11-13 03:26:41) Bkav: W32.Malware.82E029F7
CrowdStrike: win/malicious_confidence_70% (D)
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
DrWeb: Tool.VulnDriver.22
Elastic: malicious (high confidence)
Kaspersky: UDS:Trojan.Win32.Arkmblk
McAfeeD: ti!CD3DFD2588CA
Microsoft: Trojan:Win64/Dacic.RPX!MTB
SentinelOne: Static AI - Suspicious PE
Symantec: ML.Attribute.HighConfidence
huorong: Exploit/Vulndriver.c!crit

Hashes

MD5 2dfa363dfdc7bcec45f3cf2b2ff6f89e 🔍
SHA1 073f3d1a6051860adb014c582c73e0ecc0a4783c 🔍
SHA256 cd3dfd2588ca0c132fe102194a999da90cc42243d86e93d0de5b75fc7ba7dbb8 🔍
SHA3 4da40a781b8a41dbd147f4aae63dad4590a9ba71fe9cf0413b0cbca58b1e5bb8 🔍
SSDeep 49152:HLFexBrWsKO65NRel/3khC/IRel/3khC/ZEsiYv8cB2iKeRpz6iar9FCqNX:IxRWFYl/3Rl/3MY0w2itptaZFnX 🔍
Imports Hash 0a99b2d5bd3c39b2ebd1566d208960e7 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Nov-12 19:32:33
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x24800
SizeOfInitializedData 0x2bbc00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000062B0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x2e5000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 66bc34f1f70828c270367639743dbbc0 🔍
SHA1 409369025a7d804019aa87e69e48c5934d57b1f3 🔍
SHA256 696a1173328be40c720b7b4753f7f8ff74bfacac1af6dc161f08e900b2985d6a 🔍
SHA3 7679bc6067da258df12685acd5692076d8a0c02df5ff235215f79715eed582f5 🔍
VirtualSize 0x24630
VirtualAddress 0x1000
SizeOfRawData 0x24800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.48764

.rdata

MD5 8cf5cfa140eb50e3c61a9c1e3a5ac401 🔍
SHA1 4573c804ea663ea1f1b6e7ae36d2a90f9aafa322 🔍
SHA256 ab70b6f617263916de438dbe2c0584d0b2cc68628c34aa07e051eaad126e2483 🔍
SHA3 799a55fbe78421bf9272a2b096c92dd152ce943312458a8d833f6c43fbf4b9c3 🔍
VirtualSize 0xf1d2
VirtualAddress 0x26000
SizeOfRawData 0xf200
PointerToRawData 0x24c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.86083

.data

MD5 8e1e61f2f39029a6a9f64a916a705a4d 🔍
SHA1 c6de74813f7ad5c29756419d691bf4a80d821bc9 🔍
SHA256 63504cf40625e4ade81e5a7d0b8bc411e2d4242e52ed8451cbc85d58dd5602fc 🔍
SHA3 5d9ce87afadf0b411c1208f09e0d8c83bef07c5febc24175c6c85a49c8f62160 🔍
VirtualSize 0x2ca8
VirtualAddress 0x36000
SizeOfRawData 0xc00
PointerToRawData 0x33e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.07344

.pdata

MD5 72267a470b5fbe7d185887842e7b4ffb 🔍
SHA1 0137c304469d60b853723f392d72a45e6a978dc8 🔍
SHA256 e98119d82fb627faec219218fd5c8284bfd13b10a8d6a29179b3382fcfa9f1dd 🔍
SHA3 684308c848f0d0d6d047105656c163a7af82bcb5626e26f272bc0e98ca81472a 🔍
VirtualSize 0x19c8
VirtualAddress 0x39000
SizeOfRawData 0x1a00
PointerToRawData 0x34a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.39219

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x3b000
SizeOfRawData 0x200
PointerToRawData 0x36400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 17c8ceaca1a0d426613d863569ea5448 🔍
SHA1 a9d886f6ba9664152f3765bc0515e273f83dc0e7 🔍
SHA256 0fd4317bcd544797b9d3d0cd37dc8d7faf1915e669d59c4f248d36dc8e2fb45d 🔍
SHA3 57d01f3a8e96dfcce7b31ace6d35bfcf6f1ce00ec4ddfaf44537d35fb921f5b8 🔍
VirtualSize 0x2a7670
VirtualAddress 0x3c000
SizeOfRawData 0x2a7800
PointerToRawData 0x36600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.28722

.reloc

MD5 fb72821189d933c6986d45ffb9ddde56 🔍
SHA1 2b9aae030c65d5c544092907dd10a11858825b04 🔍
SHA256 45ec1cfcf46cc54955df8e508f688335d770f021f1065586ed5ff0a95e0994e7 🔍
SHA3 bcd86fde4dd89450b40dabbc1fb3828517c4e587e828d9dd7d1795135c2cb2fe 🔍
VirtualSize 0x69c
VirtualAddress 0x2e4000
SizeOfRawData 0x800
PointerToRawData 0x2dde00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.97261

Imports

USER32.dll DispatchMessageW
PeekMessageW
SendMessageW
DefWindowProcW
RegisterClassW
LoadIconW
LoadCursorW
GetWindow
GetWindowThreadProcessId
EnumWindows
MessageBoxW
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
EndPaint
BeginPaint
UpdateWindow
GetSystemMetrics
IsIconic
IsWindowVisible
MoveWindow
ShowWindow
CreateWindowExW
TranslateMessage
GDI32.dll Polygon
TextOutW
MoveToEx
SetTextColor
SetTextCharacterExtra
SetBkMode
SetBkColor
SelectObject
RoundRect
LineTo
AddFontMemResourceEx
GetTextExtentPoint32W
GetStockObject
DeleteObject
CreateSolidBrush
CreatePen
CreateFontW
ADVAPI32.dll RegGetValueW
bcrypt.dll BCryptHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
MSIMG32.dll GradientFill
KERNEL32.dll SetStdHandle
GetStringTypeW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
VirtualProtect
LoadLibraryExW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
FreeEnvironmentStringsW
LoadResource
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetEnvironmentVariableW
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
ReadFile
WriteFile
GetTempPathW
CloseHandle
GetLastError
QueryPerformanceCounter
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
CreateMutexW
Sleep
GetCurrentProcessId
ExitProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetTickCount
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LockResource
SizeofResource
FindResourceW
CopyFileW
MoveFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
FindNextFileW
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
GetCurrentProcess
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExW

Delayed Imports

101

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x36600
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.50137
Detected Filetype PE Executable
MD5 6c7bc8b20b2ba48e3578455beb2c6a47 🔍
SHA1 e70865047e6566695f7a6ebe1e0aefaf9b5a8805 🔍
SHA256 d82a3863449dd99813cab06b1a4d9a54cf4d25a44c8ac297432495a5c7317e83 🔍
SHA3 9639a1d34aa9fef46ea9ad2e9d1546c5492fdf4deaeadc1214215f8d93cd28f4 🔍

102

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x4a00
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.73677
Detected Filetype PE Executable
MD5 23f9f715e39e56bb2c3e16c94e9eb2ff 🔍
SHA1 2beb6271f9419607eaa0a09bd0ec7452ce993286 🔍
SHA256 5bbe7abb3e60e176195db2989704d863791df300219c3f13938117335319b2d1 🔍
SHA3 df404feb2604ae183b44224e329861ed4a1b3727db37823248c79407dd836ef9 🔍

103

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x243a00
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.22176
Detected Filetype PE Executable
MD5 1902e7ff62115d454936c297af262818 🔍
SHA1 1aafe6e3d9820f422b70003a4e789e2eddf962e3 🔍
SHA256 63c96b909ad48bbf3338e48c9b21f3a9fb20c2571a93243149e06c661870af7a 🔍
SHA3 8ff6c2ee350ed9b102fce98a01d7bb6c90970dbb4ecc3b50d683a8ec24da86b2 🔍

104

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x28640
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.24044
Detected Filetype PE Executable
MD5 61f430f292f85b18b57f06ea6d3d8b82 🔍
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0 🔍
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e 🔍
SHA3 cb7ff651e464efa386de49f6407b5db46dfa1005c2a19d57be17c0cd1923633a 🔍

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x4fb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.08348
MD5 88688a8cc3791a442eebaf1704fc3be4 🔍
SHA1 0c229082601bdada7f31b20f79f72a84cf885d82 🔍
SHA256 76d734dc2717e07e402c4c1e257a8894f0816c7981f6c2ab0077b67b698c3b68 🔍
SHA3 bd354e298f52560b3a491870f6f9370bc9bbe814fec7573e7b5d6e6a7840d575 🔍

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Nov-12 19:32:33
Version 0.0
SizeofData 840
AddressOfRawData 0x32340
PointerToRawData 0x30f40

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140036080

RICH Header

XOR Key 0x1b80076
Unmarked objects 0
C++ objects (33145) 160
C objects (33145) 12
ASM objects (33145) 6
ASM objects (35721) 9
C objects (35721) 18
C++ objects (35721) 39
Imports (33145) 13
Total imports 156
C objects (36260) 1
Resource objects (36260) 1
151 1
Linker (36260) 1

Errors

Leave a comment

No comments yet.