| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 1970-Jan-01 00:00:00 |
| Suspicious | The PE is possibly packed. | The PE only has 7 import(s). |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| MD5 | 403993e94b1d8b67d0853b933ffac776 🔍 |
|---|---|
| SHA1 | a3cc497c70d0f05096f111d0ed8936580b955f6b 🔍 |
| SHA256 | dc33f14f060c63a9dd9e79ae22706d4974f333148bb5a826930c4d4b30e81af1 🔍 |
| SHA3 | fce7a963ff4e7465d232681bc7e5560495d149cb4512c7350ce88691b192a8f2 🔍 |
| SSDeep | 12:etGSGQCfKtGzDhx5/6G/i94ZsshmysET/phessznxl5xNxZlxlj2Ci3ZprJGW0:etGSbG5pK94SquNxHr3Z29JrGW0 🔍 |
| Imports Hash | 8be3c8663f520b4d5133be6f11f06212 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 3 |
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x200 |
| SizeOfInitializedData | 0x400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001020 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x4000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0xa0e4 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 2c3ddb11aee20e8e801433e2053c2bda 🔍 |
|---|---|
| SHA1 | cba54d09370e5211826839cf26e3f845df8944fe 🔍 |
| SHA256 | cf7d9324d72415a3fe0210ec610d2748a4c5ca8d8c6577a6d4e9d50f3167ff41 🔍 |
| SHA3 | de3004dcb8647c2b49ab5fc329f5566a0c8b3ce7ab519adf8ba028a968ed24c4 🔍 |
| VirtualSize | 0x198 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.08483 |
| MD5 | 809fe65f0115ec1d260ab88dc395d98c 🔍 |
|---|---|
| SHA1 | 9d44fc9429551ed29d0fc51f30954e1c6c12d6ef 🔍 |
| SHA256 | 1a304a6632188f0939c687a6266aa6ce23a0a7c87addd506b73789dc47b7618d 🔍 |
| SHA3 | 2c0fb9e681cd362115a174467195b2c286a81ef2e359776c9eede122c6693131 🔍 |
| VirtualSize | 0x10c |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.64939 |
| MD5 | a7d5a0ca3b70feb224b2005f90422656 🔍 |
|---|---|
| SHA1 | fb45dcdbe28176b2376d9a391c091da9178c176d 🔍 |
| SHA256 | ed265f43bd872afaf001f4a6c14c9f053babf5b78ca2c5da5400222687c6b637 🔍 |
| SHA3 | ef8200bf2289de2a70ad355b8607592157588af0718d5a4177c424322fb77bd2 🔍 |
| VirtualSize | 0x24 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.315443 |
| msvcrt.dll |
__set_app_type
_controlfp __argc __argv _environ __getmainargs exit |
|---|