d729ca1e148048aa9d42574d0cbd3486407e2746eab45583167336105637bc53

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Nov-01 21:07:23
TLS Callbacks 1 callback(s) detected.
Debug artifacts crosnutex.pdb

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 8354f8785379bba3b353ae24ed68910f 🔍
SHA1 7104caa81e764821defc113bf62630f794394e42 🔍
SHA256 d729ca1e148048aa9d42574d0cbd3486407e2746eab45583167336105637bc53 🔍
SHA3 685314379d8c72a762815fdb444b19703e7ecebeb8631cd2a3881059f83e7004 🔍
SSDeep 24576:GsqaSBiJbkyd9lskkhC0yatEgBYH2QmnuIg1:vma3ef80wKuIg1 🔍
Imports Hash d467950312572a4887917c64c7b0e40d 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Nov-01 21:07:23
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x18e00
SizeOfInitializedData 0xc9000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000BB00 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xe6000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4c04fe9e8030e75dd3ebdefe891eed43 🔍
SHA1 1b0b9376d0e402da21e6200018e5a7f2453a647c 🔍
SHA256 fa55d2979bdf167706a934542fa305ecea7eb46948a89557ca1e041298b09c09 🔍
SHA3 f81bdc9a009b012f623040f9e1398410add5e5ad2db2e03bbf0d1bbcf359203a 🔍
VirtualSize 0x18cd1
VirtualAddress 0x1000
SizeOfRawData 0x18e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.57536

.rdata

MD5 545c99f34fc2a08c0d1bdaa3f1c72a54 🔍
SHA1 cfcb00eccebbca986b508444514b9bf6c6f5a975 🔍
SHA256 b066ba9c93e4b016c807d673d5598428fe62523f09c807933dc235a52bda76a0 🔍
SHA3 2c431a54cb7ba02235cb5aa515c1c953a31ac90398f802ec612a0496c730fddd 🔍
VirtualSize 0x6ec64
VirtualAddress 0x1a000
SizeOfRawData 0x6ee00
PointerToRawData 0x19200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.40923

.data

MD5 3218ecc49d6b9cc21ef38b7b7e5e6964 🔍
SHA1 ed46c4226f0a8b1ef2a03277f603c7543a38341f 🔍
SHA256 b950ac8cf643366c231b3613334464c656281693711f79602b29f23aaddba69e 🔍
SHA3 23fc85dd99d7dce0cbf5521b6dd21fe17d15310f066af6596b815211d446ef2d 🔍
VirtualSize 0x58cac
VirtualAddress 0x89000
SizeOfRawData 0x58200
PointerToRawData 0x88000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.19283

.pdata

MD5 85118776798c4c96eec9b2f555af6edc 🔍
SHA1 b381385a32d886b244220b90402f05d2964460df 🔍
SHA256 f1823d3d8e9ee40107d19110298033d238d576a1c8fa04e5511258e8ac399058 🔍
SHA3 2575cd00fb6cce02aafb400fa960524058cbc9964d7e22b6e060d7f9dec77fcf 🔍
VirtualSize 0x1218
VirtualAddress 0xe2000
SizeOfRawData 0x1400
PointerToRawData 0xe0200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.88986

.tls

MD5 e409532b8683168c3c145c348035656f 🔍
SHA1 88f3d0b043271bf13ed06ad0b6ce38b41caac36e 🔍
SHA256 2295c5c7b74eabe7801a1a845e2b9e3dfb2a7c9ad70ff4865ef23c740f216184 🔍
SHA3 efb05c651f66eae0a8d3efb71185c37b50cbb1e733ebaf11f26f32797ccdc901 🔍
VirtualSize 0xd1
VirtualAddress 0xe4000
SizeOfRawData 0x200
PointerToRawData 0xe1600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.53552

.reloc

MD5 ca5b357b79f41d853d151f3733a17d2d 🔍
SHA1 efe38e9990fab731168e58d7a693979f5ba3726a 🔍
SHA256 80659702f1ac7854ce0c45eb1fa746e3e86b5758f9b4658719bde29ff4300662 🔍
SHA3 d763ab496bf1e97ab92080b1fb8bcaa91e00d6d068a648c548e412039e85c561 🔍
VirtualSize 0x804
VirtualAddress 0xe5000
SizeOfRawData 0xa00
PointerToRawData 0xe1800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.88761

Imports

user32.dll GetActiveWindow
GetClassNameW
GetCursorPos
GetFocus
GetForegroundWindow
GetKeyboardType
GetSystemMetrics
GetWindowLongPtrW
ScreenToClient
kernel32.dll CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleTitleW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLCID
GetSystemTime
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
WideCharToMultiByte
WriteConsoleW
WriteFile
api-ms-win-core-synch-l1-2-0.dll WaitOnAddress
WakeByAddressAll

Delayed Imports

JLI_CmdToArgs

Ordinal 1
Address 0x1a61

JLI_GetStdArgc

Ordinal 2
Address 0x1925

JLI_GetStdArgs

Ordinal 3
Address 0xb368

JLI_InitArgProcessing

Ordinal 4
Address 0xb791

JLI_Launch

Ordinal 5
Address 0xa1f9

JLI_MemAlloc

Ordinal 6
Address 0x1b9d

JLI_MemFree

Ordinal 7
Address 0x3469

Ordinal 8
Address 0xa1f9

(#2)

Ordinal 9
Address 0x1b9d

(#3)

Ordinal 10
Address 0x1a61

(#4)

Ordinal 11
Address 0x1925

(#5)

Ordinal 12
Address 0xb368

(#6)

Ordinal 13
Address 0x3469

(#7)

Ordinal 14
Address 0xb791

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Nov-01 21:07:23
Version 0.0
SizeofData 38
AddressOfRawData 0x865cc
PointerToRawData 0x857cc
Referenced File crosnutex.pdb

TLS Callbacks

StartAddressOfRawData 0x1800e4000
EndAddressOfRawData 0x1800e40d0
AddressOfIndex 0x1800e11d4
AddressOfCallbacks 0x180086670
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x0000000180001B80

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1800e0700

RICH Header

Errors

Leave a comment

No comments yet.