| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2022-Jul-27 03:33:56 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\Users\Elk\source\repos\3Dmigoto\x64\Release\3DMigoto Loader.pdb
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | VirusTotal score: 2/71 (Scanned on 2024-01-27 08:17:50) |
Cynet:
Malicious (score: 100)
MaxSecure: Trojan.Malware.300983.susgen |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 6 |
| TimeDateStamp | 2022-Jul-27 03:33:56 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x3400 |
| SizeOfInitializedData | 0x3c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000000383C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xc000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| VERSION.dll |
VerQueryValueA
GetFileVersionInfoA GetFileVersionInfoSizeA |
|---|---|
| KERNEL32.dll |
GetSystemTimeAsFileTime
ReadFile GetFullPathNameW GetCurrentProcess GetModuleFileNameW CreateMutexA CreateFileW GetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep InitializeCriticalSectionAndSpinCount Process32NextW LoadLibraryA Process32FirstW CloseHandle Module32FirstW GetProcAddress GetFileSize Module32NextW DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx LeaveCriticalSection GetLastError InitializeSListHead CreateEventW GetModuleHandleW GetCurrentThreadId GetCurrentProcessId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter EnterCriticalSection |
| USER32.dll |
SetWindowsHookExW
UnhookWindowsHookEx |
| ADVAPI32.dll |
GetTokenInformation
OpenProcessToken |
| SHELL32.dll |
ShellExecuteW
|
| ole32.dll |
CoInitializeEx
|
| MSVCP140.dll |
?_Xlength_error@std@@YAXPEBD@Z
|
| VCRUNTIME140.dll |
memset
__std_terminate __std_exception_destroy __std_exception_copy wcsrchr _CxxThrowException __CxxFrameHandler3 __C_specific_handler |
| api-ms-win-crt-string-l1-1-0.dll |
strncmp
wcscpy_s _stricmp tolower _wcsicmp |
| api-ms-win-crt-convert-l1-1-0.dll |
atoi
|
| api-ms-win-crt-runtime-l1-1-0.dll |
__p___argv
_initterm _register_thread_local_exe_atexit_callback _get_initial_narrow_environment __p___argc _initterm_e _set_app_type _seh_filter_exe terminate exit _cexit _crt_atexit _exit _c_exit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv |
| api-ms-win-crt-stdio-l1-1-0.dll |
getchar
_set_fmode __stdio_common_vsnprintf_s __stdio_common_vfprintf puts __p__commode __acrt_iob_func |
| api-ms-win-crt-heap-l1-1-0.dll |
free
malloc _set_new_mode _callnewh |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Jul-27 03:33:56 |
| Version | 0.0 |
| SizeofData | 91 |
| AddressOfRawData | 0x63ec |
| PointerToRawData | 0x4bec |
| Referenced File | C:\Users\Elk\source\repos\3Dmigoto\x64\Release\3DMigoto Loader.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Jul-27 03:33:56 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x6448 |
| PointerToRawData | 0x4c48 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Jul-27 03:33:56 |
| Version | 0.0 |
| SizeofData | 828 |
| AddressOfRawData | 0x645c |
| PointerToRawData | 0x4c5c |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Jul-27 03:33:56 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x1400067b8 |
|---|---|
| EndAddressOfRawData | 0x1400067c0 |
| AddressOfIndex | 0x1400086e4 |
| AddressOfCallbacks | 0x1400053d0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x100 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140008010 |
| XOR Key | 0xe618ad36 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 14 |
| Imports (VS 2015/2017 runtime 26706) | 4 |
| C++ objects (VS 2015/2017 runtime 26706) | 28 |
| C objects (VS 2015/2017 runtime 26706) | 10 |
| ASM objects (VS 2015/2017 runtime 26706) | 2 |
| Imports (27412) | 13 |
| Total imports | 102 |
| C++ objects (LTCG) (27048) | 3 |
| Resource objects (27048) | 1 |
| Linker (27048) | 1 |