ee3f60f439c56d62953f3a3c5b4bef9df4f59d3c391b232064fbb54ca47e2a16

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jun-07 05:38:08
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 8.0
MASM/TASM - sig1(h)
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Leverages the raw socket API to access the Internet:
  • WSASetLastError
Suspicious VirusTotal score: 2/70 (Scanned on 2026-08-05 17:27:25) CrowdStrike: win/malicious_confidence_60% (D)
Cynet: Malicious (score: 100)

Hashes

MD5 6a781d0df5212f09ae9c6a4def626e41
SHA1 ce7f9b392d23c7f1a063eb9b375aeee4e1039e60
SHA256 ee3f60f439c56d62953f3a3c5b4bef9df4f59d3c391b232064fbb54ca47e2a16
SHA3 61a20efb02269c0f29702f1b55b81cbcc8a2b8715a89a35ebd004b0ae42ddaf8
SSDeep 384:HvV3SZYgDvhCoZApR2sbxZjbIPWgGc0j8ETT3fmT70NNdAQeyFo6BtZVmyPUH5o:HtrwJ9sbfVdzZTT3fq76jnBrUHqJ
Imports Hash 1668f78c7ac9ee6e76ec2093b0c11ff4

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jun-07 05:38:08
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x5000
SizeOfInitializedData 0x3400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000005360 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xd000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 72cdf463c76b79458471c43655f3c435
SHA1 7f0540f8853b9daf988f14b07270f1a96b00369b
SHA256 e9478e1655d7c498cae72f55b5b5dc833a4ca7d9469cd3194c96d4527ef7e03a
SHA3 16071cb957e72ccc7baac1b2391d1c0fc5867c16fb5915f87d1b467225462404
VirtualSize 0x4e08
VirtualAddress 0x1000
SizeOfRawData 0x5000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.19141

.rdata

MD5 33cd90891380b5c1aad3ef7ecbb8a140
SHA1 5061b9f1bbd7ad63b9a84368194427f69f2e983d
SHA256 9ffed3057583004f32a9d4bed77ff3d8e3e6e3dda29dd3d25266df560c1d2955
SHA3 dc9857f3dc8e78286a873944431b3d9d21b8a132a31327533fc9b58a1d79786b
VirtualSize 0x22ae
VirtualAddress 0x6000
SizeOfRawData 0x2400
PointerToRawData 0x5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.30508

.data

MD5 cb14eeb5aa605232b5265ae0671c156f
SHA1 d769d105907a82b414b34f2c36a78ddd77d82b4e
SHA256 1157a86c23fc2eae402b42f2b684bbbedc41efb47d9e0c6edcf04262bcbad2eb
SHA3 db00efc2ef4ab8d154327e2b6ff719db5136c3c1e8c0c88e7833df994430c650
VirtualSize 0x560
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x7800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.17789

.pdata

MD5 b8fc9aa89cacbb10f6a1bb767000950a
SHA1 11997654841bc13048c460e0db59906de6c7c84d
SHA256 5bc1fb2c49a1b8869b7360e59fd774fe46e20af20f7512f721abdd24e6caf177
SHA3 5e4ebe4d105ef34c38b8b7cd4826865bb5db12369e47ef0bdcf5d87a9c218f2e
VirtualSize 0x5e8
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x7c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.24205

.rsrc

MD5 a1eee83f98ab04186d485fb5c3ed5648
SHA1 c9de17b946456656a3154ee85f824fb3b254e25b
SHA256 f2db3afa887f9725b8be2006be6ecec8503e2b2a2d13d6995bb55ffb2a37dcdf
SHA3 bdb758142744e8cfd6b850e0503105d00737468b87c5aa5dfe63104639f95982
VirtualSize 0x1e0
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0x8200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.70855

.reloc

MD5 d6d14af5f5314f71f58d1d129b933fad
SHA1 7d21329879d75627c0c5bab9365e375acd355a02
SHA256 2bd86b926c129904c8325a11ea7fba5983992965e1b72e3ea7c18884e3bf5cdd
SHA3 3da1fcd11a88243680f36de5cf316864e604116797ba52f7bf7a4f0a834e2d9a
VirtualSize 0x4c
VirtualAddress 0xc000
SizeOfRawData 0x200
PointerToRawData 0x8400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.05156

Imports

WS2_32.dll WSASetLastError
SHELL32.dll SHCreateDirectoryExW
SHGetFolderPathW
KERNEL32.dll VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
CopyFileW
FileTimeToLocalFileTime
GetFileSize
SetLastError
GetTickCount64
GetProcAddress
LoadLibraryW
FileTimeToSystemTime
SystemTimeToFileTime
CloseHandle
GetLastError
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
MSVCP140.dll ?_Xlength_error@std@@YAXPEBD@Z
VCRUNTIME140.dll _CxxThrowException
memcpy
memmove
memset
__std_exception_destroy
__C_specific_handler
__std_type_info_destroy_list
wcsrchr
__std_exception_copy
VCRUNTIME140_1.dll __CxxFrameHandler4
api-ms-win-crt-string-l1-1-0.dll wcscat_s
wcslen
api-ms-win-crt-heap-l1-1-0.dll malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0.dll _initialize_narrow_environment
_initialize_onexit_table
_seh_filter_dll
_cexit
_initterm_e
_configure_narrow_argv
_execute_onexit_table
_initterm

Delayed Imports

ExitDll

Ordinal 1
Address 0x3070

GetPluginFactory

Ordinal 2
Address 0x30b0

InitDll

Ordinal 3
Address 0x30f0

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jun-07 05:38:08
Version 0.0
SizeofData 676
AddressOfRawData 0x6ed0
PointerToRawData 0x62d0

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180009240

RICH Header

XOR Key 0xd8b1c0b9
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 6
ASM objects (35721) 3
C objects (35721) 8
C++ objects (35721) 17
Imports (35721) 6
Total imports 77
Imports (33145) 7
C objects (36246) 4
C++ objects (36246) 4
Exports (36246) 1
Resource objects (36246) 1
Linker (36246) 1

Errors

Leave a comment

No comments yet.