e8e0eb7a259a8ff8163ddbaaa639d888fdc3a6da70d7172d180f6e1ae6b18c9d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Jan-04 03:05:25
Detected languages English - United States
TLS Callbacks 2 callback(s) detected.

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .buildid
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
Suspicious The PE is possibly a dropper. Resources amount for 93.3471% of the executable.
Safe VirusTotal score: 0/70 (Scanned on 2026-07-29 16:58:23) All the AVs think this file is safe.

Hashes

MD5 7e1581042d392a2a89e79fc7c3953d71
SHA1 683e0d2cd22e1d476dbcbf399424288b566f2d58
SHA256 e8e0eb7a259a8ff8163ddbaaa639d888fdc3a6da70d7172d180f6e1ae6b18c9d
SHA3 d0df09b45572e75164b741a8e5fa8ae4668a78b97d54036dd7b6e1c9d46bcf90
SSDeep 3072:lQ48+ofSZMyOnNt1X45UmYdpm1QPHxs/zUhVuJ/QAXifAt:ofSyyONoWBjmifyLUY/QAXis
Imports Hash 8d88ee3d02e50123906bab082925025d

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Jan-04 03:05:25
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1a00
SizeOfInitializedData 0x17a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001160 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x3e000
SizeOfHeaders 0x400
Checksum 0x45dea
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x800000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e350e5d12b865f27b329760233d88fdc
SHA1 0a5636c2cc88eff9cd8516bcf375a5823c8a5ec2
SHA256 c5bbb5f255c2e70e1e75e98e5f03f22cffe4db8f53be123cf345856fc17e7eb5
SHA3 9b2d28a3e3a3cd27bfd31b324eff44ee6fd855feba5fe37c9d5837e76c5f7498
VirtualSize 0x1976
VirtualAddress 0x1000
SizeOfRawData 0x1a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.88586

.rdata

MD5 a2acda28d16f9ba7c49956324cbc9fb3
SHA1 09e4d71d975500abb731a9f4f714065ab77508d3
SHA256 6e15ad3714bbd7f821479206a0c92f7e35bb261f02965352411784636f85853f
SHA3 0419ac4dc84d2c6e37b2235a53fd8eb620788d5212687716b4610b2a5f790264
VirtualSize 0x10e0
VirtualAddress 0x3000
SizeOfRawData 0x1200
PointerToRawData 0x1e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.15833

.buildid

MD5 eef5cbed7d4b83104516ddabe5c50fee
SHA1 70bcc31a7fc025bef13b5c7454de542ddde1fc5e
SHA256 f676b70caf240c4e7a482d324c5c41f8ebcf8cdf169f2db252660dacef3b1603
SHA3 ce729f25f7b0247d1b71fa99ad30a3bad08e6706b2126335ffd22a27a4cf62e7
VirtualSize 0x35
VirtualAddress 0x5000
SizeOfRawData 0x200
PointerToRawData 0x3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.604661

.data

MD5 a55b2b5b5992ee63766a195ad0506662
SHA1 bd06875afb641b095f71d71abba1c1a729a897ed
SHA256 8d92b355f9b7066015a80bb6ef849a380911026a1b98b8e070e3eaca0b049b1e
SHA3 9c1e93f6640bc2d0c3a2963e73c66ade186fd29d4527a6d43d0198c7d87b4ea4
VirtualSize 0x120
VirtualAddress 0x6000
SizeOfRawData 0x200
PointerToRawData 0x3200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.644065

.pdata

MD5 f6366b4e43edde63802c654974735b2a
SHA1 bc0e7f1b3ae59748ebf7cff39be19f426e08a9c0
SHA256 5f891542771b1b0413f66178c558ab67c52f0a22ab54d5c8591e2e70f2b7cd63
SHA3 83266372045ce97e826b31c98958926de0d42d571b0ae4cdfc972550336f3653
VirtualSize 0x138
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.52704

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59
VirtualSize 0x10
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 80e4dbc2a9bb33f2a9a8e6b86529218e
SHA1 716b71f6bdf406465841f75c800c9c90964f7353
SHA256 ff1f86a06a861a9ef5f41a849ade465e4d5dc62df27ea180cdd2299442f55d5a
SHA3 9b075613eef31a672b4aea62b2b434f93954b7353eb4ff175c3cc30f3f9d2b98
VirtualSize 0x34132
VirtualAddress 0x9000
SizeOfRawData 0x34200
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.61801

Imports

api-ms-win-crt-private-l1-1-0.dll __C_specific_handler
memcpy
api-ms-win-crt-stdio-l1-1-0.dll __acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vswprintf
fwrite
api-ms-win-crt-runtime-l1-1-0.dll __p___argc
__p___wargv
_cexit
_configure_wide_argv
_crt_atexit
_exit
_initialize_wide_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
calloc
free
malloc
api-ms-win-crt-string-l1-1-0.dll _wcsdup
memset
strlen
strncmp
wcslen
USER32.dll MessageBoxW
KERNEL32.dll DeleteCriticalSection
EnterCriticalSection
GetLastError
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
SetDllDirectoryW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-environment-l1-1-0.dll __p__wenviron

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.37862
MD5 c89bbb32db69fce295bebb27873225af
SHA1 3a65018de07c6c586ced91ddede3c4688292540e
SHA256 6585d1102e702079e28e42a2ad5c4815d196537325f099627d018f467cb95270
SHA3 b5f0a2815dddd5b99ef1ee5bc3be196908c656ffb52528b9cb2b4f9d00726035

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.05592
MD5 09f6cedc7b9da7b5d3f5d1a2f903fe3e
SHA1 5502eae26852d9d4e5baadd0aa96434bdac64c25
SHA256 f2dea65c0aaf90b6b1bf4d5aca226a8c4a8ad8efd1b6433ad04f8f3118cd6634
SHA3 47cc962651d7d76871a8e21965cecc086893794dd6db82529cfa78ca0205b4a1

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.68308
MD5 f624f1b8f2a5caceda0153572cadc01a
SHA1 599ea7b7f101874fe2cc159f983455051d076742
SHA256 1663bad9783442caeb4ffa04afc1d6e8344904c84480c4f4f221ccfc7efccc6f
SHA3 6e526e77e569f5ef99d3c32819741b394888e106b0bd1b35d73d861f1fc1c49b

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.08511
MD5 e6347834fcac4a91ef666f466a6c08ca
SHA1 d91bffe510f6860c452941bf2dae81c6179938b4
SHA256 82825d6b73dd6fc406cbd1a76393ae0905aa9c17159c46f7fb62a22c695ba86b
SHA3 92e0ca7d8bbcc9263ad8674c32757f2eedb794b9ff1ffdd5200c6fc9115dbbc4

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.7189
MD5 a3044efbbb0a80232a3f4a0bc3e301a5
SHA1 50271642400c6a51d4b389d66dcb605ae9b1eb5c
SHA256 a8c9a42c1a3aa31310a9296859d9a31e8853f8b2b5f9d93bffc79597de00a7fa
SHA3 6f8ab6b048f6942a4fd2226731ef71b7e022390ef97871827ee65a936090757f

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.57863
MD5 6d084dc71ef00c7681cbd15e6a5f5008
SHA1 bf9d944235a074b316fe5c997dc0044266d69ffd
SHA256 757936b476188cec68f98cb656920ee715e90591c43a51a7f77f249fa2337f9d
SHA3 92bd1e63a403bbaaa53023809097bb97b4afa382eefee76bf30add2fba96fa3e

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.3537
MD5 22c14b7849d7ea3c9e89afe2d2951ab5
SHA1 a41ec44761ee9d34ae87368af80e6fe50c1e8f5f
SHA256 01dd3053c152dd3eb9a689742e609f0a73a288ad464cb93b911e58b0c33c889e
SHA3 76e6fd3561032eea4938240da4f2b5edcc952712f44f6dbbf2bc47f09b6850ec

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.15074
MD5 b45d8f43c9d3ed5f5894758f5657a665
SHA1 455d492abd41f0ca7d07a508d02b1226bddc585f
SHA256 3c2eb93dea641646007c39400beda65cd45b220b30646bbf88bb7422d8bb7851
SHA3 2507542a8c485e95e4e8f9ad18519fcdbde7054cda4f49185c102932283f03f9

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xc3ca
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96701
Detected Filetype PNG graphic file
MD5 61d653003c324a0c1ac959d1d2c3640d
SHA1 d6a19e0f514a5409f468df9de40254ac906e7f5c
SHA256 0eb95f3fa2028b1c4f19faad9399ebec9b7fd8b02998aba51b53d051d6ce3b20
SHA3 cba4eb2d7faecaba893230f59a55da44a762d370ec6d64512cf71df7c1e4a86c

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03466
Detected Filetype Icon file
MD5 e077f5e050dac25b20cdd045a962ad40
SHA1 62a8067d69b7f49b0c17ed718610e748eea8ae4a
SHA256 d1afe6cf76c12e9d1683b984b2095042bff9aae666be8f52104483fe435a4036
SHA3 7a9340404d82079202b7e9488b1c8591a3c3944432699903c73f37daf5b61d58

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x2bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.82693
MD5 67d470b193d92eaedadc0bb58838f5f1
SHA1 f3d3d4f28c3635167a46e075d490c33bdbb01496
SHA256 7a7ce637fc4e50b945d45254545c848c8350184f51ee13abca9188621c9bad25
SHA3 87048578496162e372472f4afe5412b15ce526e1ab77d805f4e73f0a59a0c7f1

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jan-04 03:05:25
Version 0.0
SizeofData 25
AddressOfRawData 0x501c
PointerToRawData 0x301c

TLS Callbacks

StartAddressOfRawData 0x140008000
EndAddressOfRawData 0x140008008
AddressOfIndex 0x140006078
AddressOfCallbacks 0x1400036b8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks 0x0000000140001580
0x0000000140001600

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0

RICH Header

Errors

Leave a comment

No comments yet.