| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date |
2026-Sep-22 03:56:32
|
| TLS Callbacks |
1 callback(s) detected.
|
|
Suspicious
|
The PE is possibly packed. |
Section .data is both writable and executable.
Section .text is both writable and executable.
The PE only has 6 import(s).
|
|
Suspicious
|
The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
- LoadLibraryA
- GetProcAddress
Leverages the raw socket API to access the Internet:
|
|
Suspicious
|
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
| MD5 |
37e2ecc03ae7f3a5e7a5e4b130efbf1f
🔍
|
| SHA1 |
ef9b8aa707e19913d45192fd76b0d5f58eacdbc8
🔍
|
| SHA256 |
ef0d53d3755523e57ca2729e246aa38e15379fe30bc8ca4f075538ecbcdbb93c
🔍
|
| SHA3 |
289a34f66688e4e23315251994d5ef0c0441f03dd5433340a813d8cc5b7e23d5
🔍
|
| SSDeep |
768:261NqSUUV7YkAMSwknIXiYmNF2cWaH4/u83HxxJFbURvRUYGjllpBl19V2tSHt/:26Pq5kckzrkIbmucWD//3Hxxfby2ZpD
🔍
|
| Imports Hash |
b920d0991f4648fe46f38cb48270d268
🔍
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x80
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections |
3
|
| TimeDateStamp |
2026-Sep-22 03:56:32
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xf0
|
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic |
PE32+
|
| LinkerVersion |
2.0
|
| SizeOfCode |
0xc000
|
| SizeOfInitializedData |
0x1000
|
| SizeOfUninitializedData |
0x15000
|
| AddressOfEntryPoint |
0x0000000000021520 (Section: .text)
|
| BaseOfCode |
0x16000
|
| ImageBase |
0x140000000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
0.0
|
| SubsystemVersion |
5.2
|
| Win32VersionValue |
0
|
| SizeOfImage |
0x23000
|
| SizeOfHeaders |
0x200
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve |
0x200000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
🔍
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
🔍
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
🔍
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
🔍
|
| VirtualSize |
0x15000
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 |
937ade331d6ba594a23a102b415b6a87
🔍
|
| SHA1 |
ee0738cafb029413dbb5cc9e13355e7283a3954a
🔍
|
| SHA256 |
1aab1adf7d4e120a1a64df3351145fe08d07bc17c92d6f8c006049b498e153d0
🔍
|
| SHA3 |
3aabb36a1883475658df4bc2d4a1bf30dc80ca0af8df0be965977722014fb07c
🔍
|
| VirtualSize |
0xc000
|
| VirtualAddress |
0x16000
|
| SizeOfRawData |
0xb800
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
7.86554
|
| MD5 |
43610d3f8397b12ce27876c73174087d
🔍
|
| SHA1 |
82c70584cf03d51f8366a1f5b8c031d99a9cd8a9
🔍
|
| SHA256 |
473e8a50bb87866e242704992aeac844e0a67d32096e3441ebe89033d72181c0
🔍
|
| SHA3 |
04d1783b4223f30e766ee73a07a13845262fe7a03443f6f6194ef99c7f8b0324
🔍
|
| VirtualSize |
0x1000
|
| VirtualAddress |
0x22000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0xba00
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
2.26116
|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
|
| msvcrt.dll |
exit
|
| WS2_32.dll |
bind
|
| StartAddressOfRawData |
0x1400217e8
|
| EndAddressOfRawData |
0x1400217f0
|
| AddressOfIndex |
0x14001c08c
|
| AddressOfCallbacks |
0x1400217f0
|
| SizeOfZeroFill |
0
|
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks |
0x0000000140021794
|
[*] Warning: Section .data has a size of 0!