db3db02cf5503a48ed56ce6e6dac0810

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2022-Jul-27 03:33:56
Detected languages English - United States
Debug artifacts C:\Users\Elk\source\repos\3Dmigoto\x64\Release\3DMigoto Loader.pdb

Plugin Output

Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
Possibly launches other programs:
  • ShellExecuteW
Functions related to the privilege level:
  • OpenProcessToken
Manipulates other processes:
  • Process32NextW
  • Process32FirstW
Suspicious VirusTotal score: 2/71 (Scanned on 2024-01-27 08:17:50) Cynet: Malicious (score: 100)
MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 db3db02cf5503a48ed56ce6e6dac0810
SHA1 b05a3ac53b0078a6785872fac0bb7606c51c189c
SHA256 8a4bff8f7192934d4b994fe800e7a1f9880c86ae9a5c8d53f888a7d9cd306de2
SHA3 07c7f0b8c8502415e9c2dc1846eb6b31b0364c55b13d8bb616441a59b67a7a9b
SSDeep 768:clKqliaYi6MrMZRQ/Dub7qbi1t1pLmcoz:dDaYi+Zi/y7q+1t1p+
Imports Hash cfb588a360ec2fdbb0f51aadf2d221bc

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2022-Jul-27 03:33:56
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x3400
SizeOfInitializedData 0x3c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000000383C (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xc000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bd4cb58dfcf6e8f2583de6224c808a80
SHA1 a2b7047b51b6e252f64e30ea9de4008906b94a01
SHA256 1b1d7220c6c7c613a4994c7d14238613a1f186d26f924410fe34cbc1220a841d
SHA3 4e8c82fdfd5df0c786d3071237f1fdc4ac052c1356fa53b1a953c57403d710e1
VirtualSize 0x3397
VirtualAddress 0x1000
SizeOfRawData 0x3400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.09174

.rdata

MD5 12b46f5e4fa369b89894c1a2358d9a47
SHA1 7b9cedd4a99d3b4357074e6d8e98e8ece29a8c4d
SHA256 453ea37095dfd019770948c641d366e4cac968092f4a5b208642f4286c49b8b5
SHA3 c170293f64f4ba3509a0efbe86e304a4c24572ad04ac311587f3c0d2883c3e48
VirtualSize 0x2a1c
VirtualAddress 0x5000
SizeOfRawData 0x2c00
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.50078

.data

MD5 49a9b278669fec5aa2315243e003b88b
SHA1 245581abe7cd6b822c5ce79b4d8a51c6fd4798fa
SHA256 acd7f7441137a880173d922fcc048cdcb5675f796c57426a2f30ceaea7464f15
SHA3 dd92d8d579fa730a6733792e98839759bbce13bbbe514aa8a74d871302e0bc6b
VirtualSize 0x750
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x6400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.01027

.pdata

MD5 bf889461f58b767f16342f6e499b4469
SHA1 ee5143db871b4a5c511e159073c317c3463b9598
SHA256 18459140abcea5861db26c6afb189e1950ee6b6032796bc4546506776be1edd1
SHA3 6d7efffb4249e07e902e1ea0e35c83963531076f26bdfd3666bad6f3d0405749
VirtualSize 0x3d8
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x6600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.04974

.rsrc

MD5 101f04294dcfeea9dfe10d3c920461d9
SHA1 bb2f3029cd26628c904eca1d14683f2af6ba57e9
SHA256 35e337ded3af0e1d8140f055f2ec4d9bfb3f23d1408c22c82b29becd027b8afb
SHA3 a2e9ad9e1911f2e478d453f9eae35c8b8c4dcf7200fe01d0b666a2584f1ca49c
VirtualSize 0x1e0
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x6a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7015

.reloc

MD5 ee09b1702d98828a4034c2a6ef5a80cb
SHA1 a129fc6b246fc2fe09735cfe36c779e5235ad027
SHA256 e1ff28433e55d887f24437f1f07b5974ba722c043d98808eb6c8659b5db853a0
SHA3 4950c4ccd8f13fccd1d8717bafb0cab32c468c68997071a585983dcedd265b14
VirtualSize 0x58
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.10472

Imports

VERSION.dll VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
KERNEL32.dll GetSystemTimeAsFileTime
ReadFile
GetFullPathNameW
GetCurrentProcess
GetModuleFileNameW
CreateMutexA
CreateFileW
GetFileAttributesW
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
InitializeCriticalSectionAndSpinCount
Process32NextW
LoadLibraryA
Process32FirstW
CloseHandle
Module32FirstW
GetProcAddress
GetFileSize
Module32NextW
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
LeaveCriticalSection
GetLastError
InitializeSListHead
CreateEventW
GetModuleHandleW
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
EnterCriticalSection
USER32.dll SetWindowsHookExW
UnhookWindowsHookEx
ADVAPI32.dll GetTokenInformation
OpenProcessToken
SHELL32.dll ShellExecuteW
ole32.dll CoInitializeEx
MSVCP140.dll ?_Xlength_error@std@@YAXPEBD@Z
VCRUNTIME140.dll memset
__std_terminate
__std_exception_destroy
__std_exception_copy
wcsrchr
_CxxThrowException
__CxxFrameHandler3
__C_specific_handler
api-ms-win-crt-string-l1-1-0.dll strncmp
wcscpy_s
_stricmp
tolower
_wcsicmp
api-ms-win-crt-convert-l1-1-0.dll atoi
api-ms-win-crt-runtime-l1-1-0.dll __p___argv
_initterm
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
__p___argc
_initterm_e
_set_app_type
_seh_filter_exe
terminate
exit
_cexit
_crt_atexit
_exit
_c_exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0.dll getchar
_set_fmode
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
puts
__p__commode
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0.dll free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2022-Jul-27 03:33:56
Version 0.0
SizeofData 91
AddressOfRawData 0x63ec
PointerToRawData 0x4bec
Referenced File C:\Users\Elk\source\repos\3Dmigoto\x64\Release\3DMigoto Loader.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2022-Jul-27 03:33:56
Version 0.0
SizeofData 20
AddressOfRawData 0x6448
PointerToRawData 0x4c48

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2022-Jul-27 03:33:56
Version 0.0
SizeofData 828
AddressOfRawData 0x645c
PointerToRawData 0x4c5c

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2022-Jul-27 03:33:56
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1400067b8
EndAddressOfRawData 0x1400067c0
AddressOfIndex 0x1400086e4
AddressOfCallbacks 0x1400053d0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140008010

RICH Header

XOR Key 0xe618ad36
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 14
Imports (VS 2015/2017 runtime 26706) 4
C++ objects (VS 2015/2017 runtime 26706) 28
C objects (VS 2015/2017 runtime 26706) 10
ASM objects (VS 2015/2017 runtime 26706) 2
Imports (27412) 13
Total imports 102
C++ objects (LTCG) (27048) 3
Resource objects (27048) 1
Linker (27048) 1

Errors

<-- -->