Architecture |
IMAGE_FILE_MACHINE_AMD64
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
Compilation Date | 2024-Feb-18 15:39:17 |
Detected languages |
English - United States
|
Info | Matching compiler(s): | MASM/TASM - sig1(h) |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Suspicious | VirusTotal score: 1/63 (Scanned on 2024-07-08 05:01:50) | Symantec: ML.Attribute.HighConfidence |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0xf0 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_AMD64
|
NumberofSections | 6 |
TimeDateStamp | 2024-Feb-18 15:39:17 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xf0 |
Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Magic | PE32+ |
---|---|
LinkerVersion | 14.0 |
SizeOfCode | 0x2800 |
SizeOfInitializedData | 0x2e00 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x0000000000002C18 (Section: .text) |
BaseOfCode | 0x1000 |
ImageBase | 0x140000000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 6.0 |
ImageVersion | 0.0 |
SubsystemVersion | 6.0 |
Win32VersionValue | 0 |
SizeOfImage | 0xb000 |
SizeOfHeaders | 0x400 |
Checksum | 0x772b |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
KERNEL32.dll |
ReadFile
CloseHandle GetLastError WaitForSingleObject CreateRemoteThread GetExitCodeThread OpenProcess VirtualAlloc VirtualFree VirtualAllocEx WriteProcessMemory GetFileSize GetProcAddress LoadLibraryA Sleep GetCurrentProcess GetNativeSystemInfo IsWow64Process LocalFree FormatMessageA CreateToolhelp32Snapshot Process32First Process32Next GetFileAttributesA CreateFileA VirtualFreeEx GetFullPathNameA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW |
---|---|
ADVAPI32.dll |
AdjustTokenPrivileges
OpenProcessToken LookupPrivilegeValueA |
MSVCP140.dll |
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z |
VCRUNTIME140.dll |
memset
__C_specific_handler __current_exception_context __current_exception __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memmove |
VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
api-ms-win-crt-runtime-l1-1-0.dll |
_c_exit
_cexit _get_initial_narrow_environment __p___argv __p___argc _register_onexit_function _crt_atexit terminate _seh_filter_exe _errno _invalid_parameter_noinfo_noreturn _exit exit _register_thread_local_exe_atexit_callback _initterm_e _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _set_app_type _initterm |
api-ms-win-crt-string-l1-1-0.dll |
_stricmp
isdigit |
api-ms-win-crt-stdio-l1-1-0.dll |
__acrt_iob_func
_set_fmode puts __stdio_common_vfprintf __p__commode |
api-ms-win-crt-convert-l1-1-0.dll |
strtoul
|
api-ms-win-crt-heap-l1-1-0.dll |
free
_set_new_mode malloc _callnewh |
api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
Characteristics |
0
|
---|---|
TimeDateStamp | 2024-Feb-18 15:39:17 |
Version | 0.0 |
SizeofData | 680 |
AddressOfRawData | 0x4e58 |
PointerToRawData | 0x3a58 |
Size | 0x140 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x140007008 |
XOR Key | 0xb30ceb8 |
---|---|
Unmarked objects | 0 |
Imports (VS2008 SP1 build 30729) | 14 |
C++ objects (32420) | 27 |
C objects (32420) | 10 |
ASM objects (32420) | 3 |
Imports (32420) | 6 |
Imports (30795) | 5 |
Total imports | 96 |
C++ objects (VS2022 Update 6 (17.6.4) compiler 32537) | 3 |
Linker (VS2022 Update 6 (17.6.4) compiler 32537) | 1 |