db2975f2c59311d182cd8641faf55df9be6194fad2a89690c9ef09ab8923466f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-04 18:33:05

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: _RANDOMX
Unusual section name found: .\-Y
Unusual section name found: .(uw
Unusual section name found: .[dA
Suspicious The PE contains functions most legitimate programs don't use. Functions which can be used for anti-debugging purposes:
  • NtQueryInformationProcess
 Leverages the raw socket API to access the Internet:
  • ws2_32.dll
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 a53e9da9d33bfbea9a37238b2f57571d 🔍
SHA1 d6f25fc14efb3177b21ee8ef2187dae45ca97f5c 🔍
SHA256 db2975f2c59311d182cd8641faf55df9be6194fad2a89690c9ef09ab8923466f 🔍
SHA3 173a52977212c67292c37d085c01da5e33428328f4313ec8a84824ae0eb0810e 🔍
SSDeep 393216:/nWAF8RMkVwgKa06H4tLjbMDUlrh3JJJls+oxyTH:fRF87HpQtXbMDUl1ZJ/ 🔍
Imports Hash 575dc1cb1538708dce98b82e2a6099ce 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 9
TimeDateStamp 2026-Sep-04 18:33:05
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xd2c00
SizeOfInitializedData 0x7de00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000009F9397 (Section: .[dA)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x17a9000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xd2b96
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x707e6
VirtualAddress 0xd4000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x42b0
VirtualAddress 0x145000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x7230
VirtualAddress 0x14a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RANDOMX

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x556
VirtualAddress 0x152000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.\-Y

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x81cc91
VirtualAddress 0x153000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.(uw

MD5 7f69b803652bec094bf0253472c5780d 🔍
SHA1 bbd2c1428cac36c01d42b7fe0eb4571fc84cded0 🔍
SHA256 e5f47f32b591afec81c71b24dcdf39b7601cd2530e034636b1861d0f5fb896eb 🔍
SHA3 0e2557bc01611e57aa1ac5da446c544d1bf6c334f692c296b4cada1271d7e124 🔍
VirtualSize 0x2b0
VirtualAddress 0x970000
SizeOfRawData 0x400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.83507

.[dA

MD5 1e4ac45b153d6c35fc2b397393c69800 🔍
SHA1 35a5a6262a72a6ac3f77b09a1cd941b67005a192 🔍
SHA256 f79d1fbb2d3cf2f0386ea6ef4b7a3ab4f407a0f7efff3d1cb5cd0416ed62af16 🔍
SHA3 f6e3098d41419c5ce09eaab9d14fcccc568ad65dc8e3f16219524d0ac4cd53da 🔍
VirtualSize 0xe367f8
VirtualAddress 0x971000
SizeOfRawData 0xe36800
PointerToRawData 0x800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_NOT_PAGED
IMAGE_SCN_MEM_READ
Entropy 7.8197

.reloc

MD5 07585a8273a710973138db9d4f4fc7ae 🔍
SHA1 571e0a4fbef0cb336c9b3dacf6236b7ace09b496 🔍
SHA256 55b6866536cb5973d237879a2cfd1e07e1486301e4f6bfc9cbb2805891f485fc 🔍
SHA3 86f5a8d98277d80ce64dd67819e5c58823bb58f8a8713e9d2864de6116a4136e 🔍
VirtualSize 0x11c
VirtualAddress 0x17a8000
SizeOfRawData 0x200
PointerToRawData 0xe37000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.69004

Imports

KERNEL32.dll GetLastError
SHELL32.dll SHQueryUserNotificationState
ws2_32.dll WSAGetLastError
advapi32.dll GetTokenInformation
secur32.dll QueryContextAttributesW
api-ms-win-core-synch-l1-2-0.dll WakeByAddressSingle
ntdll.dll NtQueryInformationProcess
psapi.dll GetProcessMemoryInfo
oleaut32.dll GetErrorInfo
powrprof.dll CallNtPowerInformation
pdh.dll PdhCloseQuery
crypt32.dll CertFreeCertificateContext
bcrypt.dll BCryptGenRandom
bcryptprimitives.dll ProcessPrng
advapi32.dll (#2) GetTokenInformation
user32.dll GetLastInputInfo
KERNEL32.dll (#2) GetLastError
api-ms-win-crt-math-l1-1-0.dll roundf
api-ms-win-crt-string-l1-1-0.dll wcslen
api-ms-win-crt-heap-l1-1-0.dll _aligned_free
api-ms-win-crt-utility-l1-1-0.dll _rotr64
api-ms-win-crt-runtime-l1-1-0.dll _initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140145a40

RICH Header

Errors

[!] Error: Could not reach the TLS callback table. [*] Warning: Section .text has a size of 0! [*] Warning: Section .rdata has a size of 0! [*] Warning: Section .data has a size of 0! [*] Warning: Section .pdata has a size of 0! [*] Warning: Section _RANDOMX has a size of 0! [*] Warning: Section .\-Y has a size of 0!
Leave a comment

No comments yet.