| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-May-28 16:22:15 |
| TLS Callbacks | 2 callback(s) detected. |
| Debug artifacts |
Embedded COFF debugging symbols
|
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: /4
Unusual section name found: /14 Unusual section name found: /29 Unusual section name found: /41 Unusual section name found: /55 Unusual section name found: /67 Unusual section name found: /80 Unusual section name found: /91 Unusual section name found: /102 |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. | 1500871 bytes of data starting at offset 0x203e00. |
| Suspicious | VirusTotal score: 1/71 (Scanned on 2026-10-16 01:57:50) | APEX: Malicious |
| MD5 | 83d7cde939efb7999f84eb8ef8c26e0e 🔍 |
|---|---|
| SHA1 | 5542515846cd9509ebe11986da94a097b768f971 🔍 |
| SHA256 | ee605ef363067e07221e03e15f40c7bff6e1877b10fa552040b5d8c86ce77801 🔍 |
| SHA3 | 243b50ca5d9fa3d7c76a3fb69186294bc85751177064c6021c25f8eb69d74f9d 🔍 |
| SSDeep | 98304:i7zRrKVeqvxToWh3EaNSBPqWpYcjDMf33zk5w:i7zRGVeqd 🔍 |
| Imports Hash | 1fa0dcc2bcb6a5ea13bf9a24cd3cebfe 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 17 |
| TimeDateStamp | 2026-May-28 16:22:15 |
| PointerToSymbolTable | 0x203e00 |
| NumberOfSymbols | 29870 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xfd000 |
| SizeOfInitializedData | 0x178800 |
| SizeOfUninitializedData | 0xe00 |
| AddressOfEntryPoint | 0x000014C0 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xfe000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x20b000 |
| SizeOfHeaders | 0x600 |
| Checksum | 0x37f8a3 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 82dd607d4f1ded804456def06997c73a 🔍 |
|---|---|
| SHA1 | bc416566b7231cbe03041e54984ed11ba7b1ad00 🔍 |
| SHA256 | c4c8049c6cc1d762ce3e208ec4d923ae9b3a64b28e5ecb0ef61a65217b5e5474 🔍 |
| SHA3 | 82e23cc1bbe2404835c1651f30dc65c8ae155348256197bd48f8adda13d23eb9 🔍 |
| VirtualSize | 0xfce98 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0xfd000 |
| PointerToRawData | 0x600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.25704 |
| MD5 | a86c1aa123ab3878d5b9db8bdfc04910 🔍 |
|---|---|
| SHA1 | 3a1807ecc0737e16f05f9b2c3291ed9c6eeb5d0a 🔍 |
| SHA256 | 97b69f12d95d30e1cd15d661f396103ce01af9fa35d4fd6e09eefaa43489dc18 🔍 |
| SHA3 | b2986ee0131af6834f0cf6c0ec7429dad356249a51a3b146cc76feac0ec0feb1 🔍 |
| VirtualSize | 0x22c4 |
| VirtualAddress | 0xfe000 |
| SizeOfRawData | 0x2400 |
| PointerToRawData | 0xfd600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 1.63307 |
| MD5 | 242294a562084e79836ca3d3ffc07002 🔍 |
|---|---|
| SHA1 | d066321ab170de0be05afc4bbba07ab0474b4b2f 🔍 |
| SHA256 | 1881e596daae26aa9c8df93d68e6e60e400bcf3ff07ebd440bcc799499057ca4 🔍 |
| SHA3 | 6290dcf2172c6f8f3096ecfe8f5dc62bba61a0f15243c5a61a93176185255896 🔍 |
| VirtualSize | 0x13880 |
| VirtualAddress | 0x101000 |
| SizeOfRawData | 0x13a00 |
| PointerToRawData | 0xffa00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.95008 |
| MD5 | 7f8cee298bbb6f7e4f22ff3c32bb490f 🔍 |
|---|---|
| SHA1 | 04110be897b3029b96c9641707be3110b767be97 🔍 |
| SHA256 | 188ddba448e2e2658dc3f001c19107b142d2c1efcc2cad22f284e8d490940925 🔍 |
| SHA3 | b3235054371381a9e09b6001caf6a7b911004b79cc8d1d8ff80c5ced36974ae3 🔍 |
| VirtualSize | 0x5bab4 |
| VirtualAddress | 0x115000 |
| SizeOfRawData | 0x5bc00 |
| PointerToRawData | 0x113400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.76093 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xc20 |
| VirtualAddress | 0x171000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 | f13727bf4953b0c15450614c2e8790e2 🔍 |
|---|---|
| SHA1 | 3f6aaa47c3f28d2b4d44f7991997d5961c4d5b80 🔍 |
| SHA256 | a5e9f6c9809d9aa4b863812695a9146ea051d48df1e9964f61c5699d4de687a4 🔍 |
| SHA3 | f60ee51f1550fe2bc4066b884bc116aec505b0cb063859728403fb4e54c00fdd 🔍 |
| VirtualSize | 0xafc |
| VirtualAddress | 0x172000 |
| SizeOfRawData | 0xc00 |
| PointerToRawData | 0x16f000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 4.93948 |
| MD5 | f2bdd47f0501d5483a58d4aca0e9e50b 🔍 |
|---|---|
| SHA1 | c767d8d927853a64833d14dcdcce21f8566128e4 🔍 |
| SHA256 | 9386b0daf4ee8b23db36a91ab61ebff3e5a4c5a86e458b92628353d28fc2ae92 🔍 |
| SHA3 | 717000576c29127fa4226cb113243f8aa74b14c06f4cdafefcc6e91c4bc8cc7a 🔍 |
| VirtualSize | 0x34 |
| VirtualAddress | 0x173000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x16fc00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.278927 |
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x8 |
| VirtualAddress | 0x174000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x16fe00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
| MD5 | 0091b25af70316b56cd38f2535efbd6d 🔍 |
|---|---|
| SHA1 | 09bb636de71f39a5afcd20118a6cfe77e38ced90 🔍 |
| SHA256 | dad0a622e2f9f518e45cbaee727e5c33271e157ec42d512a0e9c667679cf9004 🔍 |
| SHA3 | 409f6c7cbf63c55d32dc69f9b8e592679b08e4ca4db30e4c7aba3d68c5fbabfa 🔍 |
| VirtualSize | 0x8dcc |
| VirtualAddress | 0x175000 |
| SizeOfRawData | 0x8e00 |
| PointerToRawData | 0x170000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.50397 |
| MD5 | 8e44527fe6882d33d22ec32626fd7dd5 🔍 |
|---|---|
| SHA1 | 3161f8993b2085fecf401c3a00feb6a4b23b0b2a 🔍 |
| SHA256 | faf4f9a4ff1a5d839c11a4f0caf414b966d1663075ef38f30fabb5d015dc7994 🔍 |
| SHA3 | 79ec36eb228cadea516117fbae4649206d765a867e4f4b7cd3933104dcd4a7e6 🔍 |
| VirtualSize | 0x6f0 |
| VirtualAddress | 0x17e000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x178e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 2.37496 |
| MD5 | 79c25183163e0d837abdb1bd03cf2d6e 🔍 |
|---|---|
| SHA1 | 9870fa4a72b875da6ccf5ac63c65343d7065eb53 🔍 |
| SHA256 | 5a2c6778b835715405c6f053839fb3db21d21e1186d2122a5743993220e02f31 🔍 |
| SHA3 | 260c1d0364621715c9e59c3d779b7424d091c22596bb269d6c2db4895df442cb 🔍 |
| VirtualSize | 0x5f365 |
| VirtualAddress | 0x17f000 |
| SizeOfRawData | 0x5f400 |
| PointerToRawData | 0x179600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.08535 |
| MD5 | a3fae6179b004550a6c96e615b2d159e 🔍 |
|---|---|
| SHA1 | a3e73ec4d2d2d791a46d8a886c24a368b82e4ed5 🔍 |
| SHA256 | 78f9f2acf5b381aca3fd3a78d341e9028a8150cd885c4602f914aa68acda3a62 🔍 |
| SHA3 | 5cee0eda17c91043bf446e5c6f3a5e8b67d173b6face7052884f4008af3834da 🔍 |
| VirtualSize | 0x5d99 |
| VirtualAddress | 0x1df000 |
| SizeOfRawData | 0x5e00 |
| PointerToRawData | 0x1d8a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.71139 |
| MD5 | 0c65daa84080f19436946681c42e951c 🔍 |
|---|---|
| SHA1 | 35c5c68b3694b1f4640d5d265ea0f4bb7542c6ce 🔍 |
| SHA256 | 62c2cc94e5af8cad1fcec3762e1b60eb5dde2a5440b459be5f59ea783534da1e 🔍 |
| SHA3 | 9132708dcf7158e4825a6fc3771bcf6086f83690eeb27d963c073a34f60b968b 🔍 |
| VirtualSize | 0xdf4d |
| VirtualAddress | 0x1e5000 |
| SizeOfRawData | 0xe000 |
| PointerToRawData | 0x1de800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.36853 |
| MD5 | b91928e252760b8a0f39750ddd049014 🔍 |
|---|---|
| SHA1 | 1986258bcc4a730ec53596814260b1b8bb954361 🔍 |
| SHA256 | 23baee87dd2a8df994634bb2cea2c70ddbbcca66ec7677490474c4170f38e9b4 🔍 |
| SHA3 | 844821f3abbd2d6e1b345c3f7cb00dc6482e75ba62c67ac41b04937da954ced2 🔍 |
| VirtualSize | 0x1f44 |
| VirtualAddress | 0x1f3000 |
| SizeOfRawData | 0x2000 |
| PointerToRawData | 0x1ec800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.87929 |
| MD5 | a34d54ffe806ee1fdacc3ce7bc0b4c0a 🔍 |
|---|---|
| SHA1 | b1502e269410851a6cb6aa6851e86a13cb332429 🔍 |
| SHA256 | 96a92f237e1e038f39506f3ca2e9c90a961ae3311bb06a5e9ee55e5df6d3a12c 🔍 |
| SHA3 | 3f0234c557ef38b6b2ba18a0d486c8020a83cdde2ff22a7ea1abe52c02352c28 🔍 |
| VirtualSize | 0xa3d |
| VirtualAddress | 0x1f5000 |
| SizeOfRawData | 0xc00 |
| PointerToRawData | 0x1ee800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.42881 |
| MD5 | 1f220e3d1cdc0b07806f8b0e83c563f4 🔍 |
|---|---|
| SHA1 | 4c5d116794554852bd998342f4bb5f0ef38a651a 🔍 |
| SHA256 | 66fbfaeb5b943af4ea848ee0a1563904fb7ef40788ecf2d29360931aca26765c 🔍 |
| SHA3 | 08585edfb372eaa0b697be97c87b77dd2ed9f2ae1236d05dc1f0865e492ed234 🔍 |
| VirtualSize | 0x13aa7 |
| VirtualAddress | 0x1f6000 |
| SizeOfRawData | 0x13c00 |
| PointerToRawData | 0x1ef400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.07783 |
| MD5 | c45e2aafe694005428ffefd9f6073c81 🔍 |
|---|---|
| SHA1 | 94e499723840f017b310d190a7f735e8d35c3e7f 🔍 |
| SHA256 | aea9fbf6e0d299a4f2cfb33ff76072d2bc94b5317d0c402c7bd707439efe661c 🔍 |
| SHA3 | 4faef06a35e295c0d0569cc8aa7ff0f018fb5f15288ce29730dac1ef8d6a5d6c 🔍 |
| VirtualSize | 0xc98 |
| VirtualAddress | 0x20a000 |
| SizeOfRawData | 0xe00 |
| PointerToRawData | 0x203000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 2.97598 |
| KERNEL32.dll |
CloseHandle
CreateSemaphoreW DeleteCriticalSection EnterCriticalSection FreeLibrary GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar ReleaseSemaphore SetLastError SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte |
|---|---|
| msvcrt.dll |
__getmainargs
__initenv __lconv_init __mb_cur_max __p__acmdln __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _cexit _errno _filelengthi64 _fileno _fstat64 _initterm _iob _lock _lseeki64 _onexit _unlock _wfopen abort atoi calloc exit fclose fflush fgetc fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getwc isspace iswctype localeconv malloc memchr memcmp memcpy memmove memset putc putwc realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strrchr strtol strxfrm towlower towupper ungetc ungetwc vfprintf _strnicmp wcscoll wcsftime wcslen wcsxfrm _write _read _fileno _fdopen _close |
| StartAddressOfRawData | 0x574000 |
|---|---|
| EndAddressOfRawData | 0x574004 |
| AddressOfIndex | 0x5710bc |
| AddressOfCallbacks | 0x573020 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x00439310
0x004392C0 |
No comments yet.