Architecture |
IMAGE_FILE_MACHINE_AMD64
|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
Compilation Date |
2024-May-01 11:21:16
|
Detected languages |
English - United States
|
Info |
Matching compiler(s): |
MASM/TASM - sig1(h)
|
Suspicious |
The PE is possibly packed. |
Section .textbss is both writable and executable.
Unusual section name found: .msvcjmc
|
Suspicious |
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
MD5 |
e865fb19dff6845beb70d515cc37c1bc
|
SHA1 |
a5df49d4ffc25fbd65388a000e680be7528440b7
|
SHA256 |
8cef95054417606cd53e3019f9a5f3254c7a1655cdd802a1cf5834aa5212df1f
|
SHA3 |
b23cbd0d64ed62cd14011982b8f288c2f9350fa518d01c55370ff22791184258
|
SSDeep |
384:CWkpZ4eT0eky/avrJIEAIVUzsnH1yYZP2E5lkzWQfBX2YdP89Z7LP:CWkpSZySmex0G+EvkzvBDdP89
|
Imports Hash |
cb53f14f870cb8e22b40d358293ae8ad
|
e_magic |
MZ
|
e_cblp |
0x90
|
e_cp |
0x3
|
e_crlc |
0
|
e_cparhdr |
0x4
|
e_minalloc |
0
|
e_maxalloc |
0xffff
|
e_ss |
0
|
e_sp |
0xb8
|
e_csum |
0
|
e_ip |
0
|
e_cs |
0
|
e_ovno |
0
|
e_oemid |
0
|
e_oeminfo |
0
|
e_lfanew |
0xf0
|
Signature |
PE
|
Machine |
IMAGE_FILE_MACHINE_AMD64
|
NumberofSections |
10
|
TimeDateStamp |
2024-May-01 11:21:16
|
PointerToSymbolTable |
0
|
NumberOfSymbols |
0
|
SizeOfOptionalHeader |
0xf0
|
Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Magic |
PE32+
|
LinkerVersion |
14.0
|
SizeOfCode |
0x7c00
|
SizeOfInitializedData |
0x7800
|
SizeOfUninitializedData |
0
|
AddressOfEntryPoint |
0x0000000000011262 (Section: .text)
|
BaseOfCode |
0x1000
|
ImageBase |
0x7ff70d260000
|
SectionAlignment |
0x1000
|
FileAlignment |
0x200
|
OperatingSystemVersion |
6.0
|
ImageVersion |
0.0
|
SubsystemVersion |
6.0
|
Win32VersionValue |
0
|
SizeOfImage |
0x25000
|
SizeOfHeaders |
0x400
|
Checksum |
0
|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve |
0x100000
|
SizeofStackCommit |
0x1000
|
SizeofHeapReserve |
0x100000
|
SizeofHeapCommit |
0x1000
|
LoaderFlags |
0
|
NumberOfRvaAndSizes |
16
|
MD5 |
fcd6bcb56c1689fcef28b57c22475bad
|
SHA1 |
1adc95bebe9eea8c112d40cd04ab7a8d75c4f961
|
SHA256 |
de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
|
SHA3 |
b843518c43581f4dc3563115943a72ec61580cdb7c6160568ae2ffa7f1a769c4
|
VirtualSize |
0x10000
|
VirtualAddress |
0x1000
|
SizeOfRawData |
0x10000
|
PointerToRawData |
0x1000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
Entropy |
0
|
MD5 |
7f250c2ffa2b50bd75287cee041419a0
|
SHA1 |
57895987b6e36228d71301167100322fa4423f26
|
SHA256 |
fe8216c9b3d4a4d7aff781471e37e69885906bcc1fb0566919054117eb2a8f3e
|
SHA3 |
3d4b7ae27245c3564a17cf01b444d3832c365fc09c83e96fd202c0aa71ccdc68
|
VirtualSize |
0x8000
|
VirtualAddress |
0x11000
|
SizeOfRawData |
0x8000
|
PointerToRawData |
0x11000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
Entropy |
3.49457
|
MD5 |
4b8634ff0acf99f8253441e604b28500
|
SHA1 |
97a6d9081aafb83aea412a2ff5255af6e9996710
|
SHA256 |
8b6ce9f857ffdb71aa44b99f23cc0763fa7a6584d1a092189676d7b440962549
|
SHA3 |
d3271b2abfaa4b395fa6bc6bc412195199292aca23a119c20f356cb16eba9380
|
VirtualSize |
0x3000
|
VirtualAddress |
0x19000
|
SizeOfRawData |
0x3000
|
PointerToRawData |
0x19000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
Entropy |
2.02846
|
MD5 |
caba47c6d2603f937933c0587c13113c
|
SHA1 |
77fd59a2676d38985658cb33642eb8ac97e230ea
|
SHA256 |
9124d50766a7979ee0c980b1468d8d1b71d96d84072ea0545e0cd2261fa2257f
|
SHA3 |
53cc3a796e83b3d556d14d3d2eb1eec135cc1c76a288936853711af9e566f1b9
|
VirtualSize |
0x1000
|
VirtualAddress |
0x1c000
|
SizeOfRawData |
0x1000
|
PointerToRawData |
0x1c000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
Entropy |
0.215922
|
MD5 |
7f5d0d8734c8aea6ad89e17ad123110c
|
SHA1 |
71e1b44299a3fd7ee7d33f407fb2bd521869edb7
|
SHA256 |
5fecfd7d8a9d9826c262e02364dc65024893866324a725608a6eb1f1f7de7511
|
SHA3 |
aad9e04e49e9bb6e9a48c03219480a2ae5a61164c0ae6ae33e4fbd7d43b51700
|
VirtualSize |
0x3000
|
VirtualAddress |
0x1d000
|
SizeOfRawData |
0x3000
|
PointerToRawData |
0x1d000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
Entropy |
0.756162
|
MD5 |
1df281e01e9079080c7e7b7bb1358dc0
|
SHA1 |
39a4d866249ff6798df6f8201a49e213c832d915
|
SHA256 |
3662814fd17fae5aa39c907d06aee790827e1353b3e683ae147903c5769e19f5
|
SHA3 |
b09126d5466a035b7bfdcd2e5aa8e079a14ee42b31184ea023dd0f36c012f82a
|
VirtualSize |
0x1000
|
VirtualAddress |
0x20000
|
SizeOfRawData |
0x1000
|
PointerToRawData |
0x20000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
Entropy |
3.85946
|
MD5 |
a2fa459444d1b64680387a0ca9ffc7cc
|
SHA1 |
077adc4f2d3aa8ae866f35082b4d4a950fa673cd
|
SHA256 |
35c5e0552b919b98813306e9bbffc823f55f35d83ff39524bf4c066abf746dba
|
SHA3 |
85e1f1415787cee88e2f45adbf16de2821ef4c7941d44d8499b2c7645b3556e3
|
VirtualSize |
0x1000
|
VirtualAddress |
0x21000
|
SizeOfRawData |
0x1000
|
PointerToRawData |
0x21000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
Entropy |
0.241351
|
MD5 |
24ebadd4dc315b54a6f9547470919b20
|
SHA1 |
34f3f3a96a71cbb75193492f2af4fc8e23cfdc42
|
SHA256 |
4b33578f112ca8383bd201cd0f979166b56e53b1a8fec92bbc65eed381c78084
|
SHA3 |
173ecbe38ad2d7b1db7afeba18e6549b1f8c65d604dd8c9a924fffee1eff49a7
|
VirtualSize |
0x1000
|
VirtualAddress |
0x22000
|
SizeOfRawData |
0x1000
|
PointerToRawData |
0x22000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
Entropy |
0.0991356
|
MD5 |
1b393510c50a375de9ef36d0cd5e7a43
|
SHA1 |
246c6b627edfc126d88f3178845d9e4cccd0f953
|
SHA256 |
77c91e41a0db9de54138bfa3ba72fb705952124c3abb2fdec9c74a2ae1401130
|
SHA3 |
5b7f1287222167b8bcb0ae71a9fc0bfecfb36aca165fe5709a6fa1fed94c75c8
|
VirtualSize |
0x1000
|
VirtualAddress |
0x23000
|
SizeOfRawData |
0x1000
|
PointerToRawData |
0x23000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
Entropy |
0.953248
|
MD5 |
bcbdefcb17efde0a4e9a36858d6582a2
|
SHA1 |
1f90749cb7fe908e7a7b530f818138774644358c
|
SHA256 |
655b6db1e4e0ba8154a3145a63fb6a2386c2c79c223352f26317cffa0f951c45
|
SHA3 |
5c321c423b8d8cce0f628d195fcaaa09b1f00f6c35044994ab5401d4f623d568
|
VirtualSize |
0x1000
|
VirtualAddress |
0x24000
|
SizeOfRawData |
0x1000
|
PointerToRawData |
0x24000
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
Entropy |
0.218357
|
KERNEL32.dll |
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
GetProcAddress
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
WideCharToMultiByte
MultiByteToWideChar
RaiseException
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
GetCurrentThreadId
|
VCRUNTIME140D.dll |
__C_specific_handler_noexcept
__vcrt_GetModuleHandleW
__current_exception
__std_type_info_destroy_list
__C_specific_handler
__current_exception_context
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
memcpy
|
ucrtbased.dll |
terminate
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_wmakepath_s
_wsplitpath_s
wcscpy_s
_crt_at_quick_exit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
__p__commode
_set_new_mode
_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_set_fmode
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__setusermatherr
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
_crt_atexit
|
Type |
RT_MANIFEST
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x17d
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
4.91161
|
MD5 |
1e4a89b11eae0fcf8bb5fdd5ec3b6f61
|
SHA1 |
4260284ce14278c397aaf6f389c1609b0ab0ce51
|
SHA256 |
4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
|
SHA3 |
4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353
|
Size |
0x140
|
TimeDateStamp |
1970-Jan-01 00:00:00
|
Version |
0.0
|
GlobalFlagsClear |
(EMPTY)
|
GlobalFlagsSet |
(EMPTY)
|
CriticalSectionDefaultTimeout |
0
|
DeCommitFreeBlockThreshold |
0
|
DeCommitTotalFreeThreshold |
0
|
LockPrefixTable |
0
|
MaximumAllocationSize |
0
|
VirtualMemoryThreshold |
0
|
ProcessAffinityMask |
0
|
ProcessHeapFlags |
(EMPTY)
|
CSDVersion |
0
|
Reserved1 |
0
|
EditList |
0
|
SecurityCookie |
0x7ff70d27c040
|
XOR Key |
0xbffbf713
|
Unmarked objects |
0
|
Imports (33218) |
2
|
C++ objects (33218) |
23
|
C objects (33218) |
11
|
ASM objects (33218) |
3
|
Imports (30795) |
5
|
Total imports |
70
|
C objects (33523) |
1
|
Resource objects (33523) |
1
|
Linker (33523) |
1
|
[!] Error: Could not read PDB file information of invalid magic number.