| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date |
2026-Sep-22 03:57:06
|
| TLS Callbacks |
1 callback(s) detected.
|
|
Suspicious
|
The PE is possibly packed. |
Section .data is both writable and executable.
Section .text is both writable and executable.
The PE only has 6 import(s).
|
|
Suspicious
|
The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
- LoadLibraryA
- GetProcAddress
Leverages the raw socket API to access the Internet:
|
|
Suspicious
|
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
| MD5 |
ff076763ba4f1c3c289b1081eb1b6e1f
🔍
|
| SHA1 |
d01c0176be3f2f49d89594fc3fd1f655e93f7798
🔍
|
| SHA256 |
eac5ef47d0a451fb77a9f8f4c7358ac726eb9caa6d88466ebf4211b4c4d53b49
🔍
|
| SHA3 |
138d8ea9824e5170c668f3abef91bc5a164239fff90fa08fe040f58c3dc84535
🔍
|
| SSDeep |
1536:78aJwnEmLnAtLRpb0+GlUgoGZ7aCZX/Dx2IsstQ9w:VyEmjUPGkynp/DcIftQ
🔍
|
| Imports Hash |
b920d0991f4648fe46f38cb48270d268
🔍
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x80
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections |
3
|
| TimeDateStamp |
2026-Sep-22 03:57:06
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xf0
|
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic |
PE32+
|
| LinkerVersion |
2.0
|
| SizeOfCode |
0xc000
|
| SizeOfInitializedData |
0x1000
|
| SizeOfUninitializedData |
0x20000
|
| AddressOfEntryPoint |
0x000000000002CB90 (Section: .text)
|
| BaseOfCode |
0x21000
|
| ImageBase |
0x140000000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
0.0
|
| SubsystemVersion |
5.2
|
| Win32VersionValue |
0
|
| SizeOfImage |
0x2e000
|
| SizeOfHeaders |
0x200
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve |
0x200000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
🔍
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
🔍
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
🔍
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
🔍
|
| VirtualSize |
0x20000
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 |
25b9e44ace29fbae8c9a6922581636b0
🔍
|
| SHA1 |
378657ca2e284528fac18b8f096dafb51b9ff693
🔍
|
| SHA256 |
07f6ab3679cd0163aaa45666b18defc0a8172a039ef911acdbfc89f8e5c089ce
🔍
|
| SHA3 |
6559091b7bb84fc53b5ec2f08d96c8704c12c877f0048138ff196469a9fb8c1c
🔍
|
| VirtualSize |
0xc000
|
| VirtualAddress |
0x21000
|
| SizeOfRawData |
0xc000
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
7.84502
|
| MD5 |
607b1b6ad907efd91e7b298531f70441
🔍
|
| SHA1 |
ce1fa4a409a50f0f67fb855ee1463f11771fc300
🔍
|
| SHA256 |
6add7e81bb4c386cb31ff598210354041e41d5a53d1191a9ce8811a48e34899c
🔍
|
| SHA3 |
7392db7915fd2cafc1e87bb182504b16b23254192878ff825cd98b2639af2eac
🔍
|
| VirtualSize |
0x1000
|
| VirtualAddress |
0x2d000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0xc200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
2.26116
|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
|
| msvcrt.dll |
exit
|
| WS2_32.dll |
bind
|
| StartAddressOfRawData |
0x14002ce58
|
| EndAddressOfRawData |
0x14002ce60
|
| AddressOfIndex |
0x14002708c
|
| AddressOfCallbacks |
0x14002ce60
|
| SizeOfZeroFill |
0
|
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x000000014002CE04
|
[*] Warning: Section .data has a size of 0!