e9b5f3cdd56ac6c407be70520bc11de381b568ec6f323c12f023c46fb3f6d9e5

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-22 09:17:02

Plugin Output

Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 8aaa133e0976c252fdc7e5aecd90ebe1 🔍
SHA1 59721cac369cb84663486fb1ea5d36df6eeda889 🔍
SHA256 e9b5f3cdd56ac6c407be70520bc11de381b568ec6f323c12f023c46fb3f6d9e5 🔍
SHA3 3cba51a2cc24d01f5af7e642caae1915d6d0925e0d18090061f9c330abef1f4b 🔍
SSDeep 24576:kQzikZ6shXG87/1gaQDeNRl6wgf8fCCz59:riehXZ7/GaQ//UqCt 🔍
Imports Hash e81d90b230abc81b286482b9dba12e35 🔍

DOS Header

e_magic MZ
e_cblp 0x78
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x78

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Aug-22 09:17:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x3400
SizeOfInitializedData 0xd4400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001000 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xde000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ab214be407d9633d5d2b3105fe891a93 🔍
SHA1 4e1190956ab9ef3adbf945789fdc4935f54e6a43 🔍
SHA256 37f42986ad32a38b1da381d1bd4545ab34190fa0c06930b26d6af4ef521e1665 🔍
SHA3 87893fc1a756986522ef2ed7ae23fbd952b9e3484be32509bfafb6502cab7116 🔍
VirtualSize 0x3356
VirtualAddress 0x1000
SizeOfRawData 0x3400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.27614

.rdata

MD5 486d79e84e8b1ea4fc5cdfc4350d2896 🔍
SHA1 647dfe487621554150128ab2335e217f3c248421 🔍
SHA256 9709f21756eef2c4a57db7a4ea017342156fc7f556a1999a3883719b5ce42b33 🔍
SHA3 78732480da20aafc8b3388917977915e702092ed3736de66c7f7802ed4437d46 🔍
VirtualSize 0xd38d0
VirtualAddress 0x5000
SizeOfRawData 0xd3a00
PointerToRawData 0x3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99794

.data

MD5 1d7d80e8b5ce8c86e7c833467964b6ae 🔍
SHA1 88aa1601feff36c623fb15fca9cf29af496ec9b2 🔍
SHA256 eac0bc584b30b30f3172f645fd2103caa322244e85a3ec4fb1c345f0c4314c94 🔍
SHA3 a8483a22d7281a11677adbc110fa0c305d06a1ff41bfda4e197443b8b6a3b8e5 🔍
VirtualSize 0x4
VirtualAddress 0xd9000
SizeOfRawData 0x200
PointerToRawData 0xd7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0659144

.pdata

MD5 17851951fcb48da3c3e024811c774a01 🔍
SHA1 deba83b20bfbbe43a57c40ea05a710497cd6fb4d 🔍
SHA256 6e47e8f1ed7effcf2dfe2afad6c4a3665b4cae357408e6a0d694270b4c1d56f7 🔍
SHA3 a7d02b778cdeaa94c61033398437096c7547d69f9d5660ce0ecdb4555b042717 🔍
VirtualSize 0xf0
VirtualAddress 0xda000
SizeOfRawData 0x200
PointerToRawData 0xd7400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.22409

.CRT

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0xdb000
SizeOfRawData 0x200
PointerToRawData 0xd7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x2
VirtualAddress 0xdc000
SizeOfRawData 0x200
PointerToRawData 0xd7800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 91b833b739e6f667aee3135abc7bc013 🔍
SHA1 0e19d4d54489481adc8cdeb6041ee8df8a1c511b 🔍
SHA256 e6cf03e4a1a73094c1b05719a81f00463ed1c778035b8a86a1ce03d7aacea1c6 🔍
SHA3 8880e75abaafd1ea1013df59079cebc9462c40be416e235d9baae26a28f984f0 🔍
VirtualSize 0x20
VirtualAddress 0xdd000
SizeOfRawData 0x200
PointerToRawData 0xd7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.404389

Imports

ntdll.dll RtlExitUserProcess
KERNEL32.dll CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessW
GetLastError
GetTempPathW
GetTickCount
VirtualAlloc
VirtualFree
WriteFile

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x4dc000
EndAddressOfRawData 0x4dc001
AddressOfIndex 0x4d9000
AddressOfCallbacks 0x4db000
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_1BYTES
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.