Manalyze report for ef84ee1ee15d563422508448afecad891d5606955d13296ea4716eb588f7219f

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Jun-28 10:07:31
Detected languages	English - United States
Debug artifacts	C:\Users\0x5\Downloads\inferno.rocks\examples\example_win32_directx11\Release\example_win32_directx11.pdb

Plugin Output

Info	Matching compiler(s):	`MASM/TASM - sig1(h)`
Info	Interesting strings found in the binary:	Contains domain names: 2010-aia.verisign.com 2010-crl.verisign.com adobe.com aia.verisign.com crl.verisign.com csc3-2010-aia.verisign.com csc3-2010-crl.verisign.com github.com http://crl.verisign.com http://crl.verisign.com/ThawteTimestampingCA.crl0 http://crl.verisign.com/pca3-g5.crl04 http://crl.verisign.com/tss-ca.crl0 http://csc3-2010-aia.verisign.com http://csc3-2010-aia.verisign.com/CSC3-2010.cer0 http://csc3-2010-crl.verisign.com http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D http://logo.verisign.com http://logo.verisign.com/vslogo.gif0 http://logo.verisign.com/vslogo.gif04 http://ocsp.verisign.com0 http://scripts.sil.org http://scripts.sil.org/OFL http://www.adobe.com http://www.adobe.com/ http://www.adobe.com/type/legal.htmlStraight http://www.adobe.com/typeCopyright https://github.com https://www.verisign.com https://www.verisign.com/cps0 https://www.verisign.com/rpa https://www.verisign.com/rpa0 logo.verisign.com scripts.sil.org verisign.com www.adobe.com www.verisign.com
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to SHA1`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryA GetProcAddress` `Possibly launches other programs: ShellExecuteW` `Uses functions commonly found in keyloggers: GetAsyncKeyState GetForegroundWindow` `Reads the contents of the clipboard: GetClipboardData`
Malicious	VirusTotal score: 9/68 (Scanned on 2026-07-25 09:24:00)	`APEX: Malicious` `Bkav: W32.Malware.D2AA6343` `CrowdStrike: win/malicious_confidence_60% (W)` `Elastic: malicious (high confidence)` `Google: Detected` `MaxSecure: Trojan.Malware.300983.susgen` `Microsoft: Trojan:Win32/Wacatac.B!ml` `Symantec: ML.Attribute.HighConfidence` `TrendMicro-HouseCall: Trojan.Win64.Gen.TL0101GM26ZM`

Hashes

MD5	`9ade66ba1f277e37e48829cae1c14124`
SHA1	`2f613100f30c08ec2fe2abab17aa4cc513dfb628`
SHA256	`ef84ee1ee15d563422508448afecad891d5606955d13296ea4716eb588f7219f`
SHA3	`82028532fcdbb383890bda660925e968ce5e0d284040f1b946773cd03d38b94f`
SSDeep	`24576:USHeVeS8wTvnOuNF8wcG98Kz01EdUcWUm7HeqIzWTxIawKc7o9awDZDiunCdsC9:7HeVeS8wTvnOuNF8w39IehWUmiXwwfo`
Imports Hash	`5c51ef1dd5361311ac894ed0e7b8fcbb`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	2026-Jun-28 10:07:31
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0xc8800`
SizeOfInitializedData	`0x7c600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000C8460 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x148000`
SizeOfHeaders	`0x400`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`0e01cc4a9f64a3e84fc64b75c416cda0`
SHA1	`4d08bdd396a8e2f56791287f5d05d1fede687264`
SHA256	`fcabad178619da5870d27b69c67bcd0a3449570a1295b520c1f8a59d16697947`
SHA3	`50c4724b93f30cd3538c5687521cb0531a2e7e1290b3b15678d88ea46697e8c5`
VirtualSize	`0xc875a`
VirtualAddress	`0x1000`
SizeOfRawData	`0xc8800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.53269`

.rdata

MD5	`a1b62ff8cf94b38519ec66a5ae42685a`
SHA1	`2daa55f3809c5f22fd29edaab57756541030f04e`
SHA256	`08755b2818450ca18770564132c3183de0e73cfb0dbf11bd4a60e6e35802540d`
SHA3	`e8bbee0081392a10af2d3dbeec6b53d826f53b25d43ff3ac0d3ec4bf4e4469e3`
VirtualSize	`0x3ee90`
VirtualAddress	`0xca000`
SizeOfRawData	`0x3f000`
PointerToRawData	`0xc8c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.93253`

.data

MD5	`51717c38e284f03e860b18b755260cd5`
SHA1	`e0db503308722ceea0f28d588e360b773738e3e0`
SHA256	`454d70ca44949161a106b93f915f182b876e356d6c3bfffc8fd83cdc80a599a6`
SHA3	`7f3b30c130a827cb1d0008ae0ebaa67773ca78901680637096641ebf25d8a178`
VirtualSize	`0x32728`
VirtualAddress	`0x109000`
SizeOfRawData	`0x32600`
PointerToRawData	`0x107c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`7.24154`

.pdata

MD5	`340dfb4d766692d79acb270bbfa46dc4`
SHA1	`85ec9f654b870aea405a658de9504b02ff6a376a`
SHA256	`470ae8585e49e3a2e1b2b28daccac7ffa3c6824ea658cc6c01f736ce2324755e`
SHA3	`de77cb473dd2b5c2c5310d6c47ba4bf0a019f5d340de086827e23dbe880cca47`
VirtualSize	`0x9a08`
VirtualAddress	`0x13c000`
SizeOfRawData	`0x9c00`
PointerToRawData	`0x13a200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.04777`

.rsrc

MD5	`e78a78612948f6d76bb9f37b9f50dda6`
SHA1	`5c18f8f32ba184e07906f1a1a1b02fd30847defa`
SHA256	`82176c9dd9d395b4576a4bffe2d2a985fd5a46d5b9a1bfad506f5d28a097c08f`
SHA3	`3fbe0b4412acd4a987cc092d466ac51b0160af2e672d9e18e01dcb0d4b6ac45b`
VirtualSize	`0x1e0`
VirtualAddress	`0x146000`
SizeOfRawData	`0x200`
PointerToRawData	`0x143e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.71377`

.reloc

MD5	`fa11041f38285958b1dfeac4fb868bf0`
SHA1	`745f31ac6d85dc5e54f5b2d8302f265c30b5e01f`
SHA256	`b9b76127214e00438f32b956d2d5ad9cd62326de5a79a0d77fd163286ab1594b`
SHA3	`0f639e82143416b694429031091110404dfdd8717f79bb84be3819458dd6efb2`
VirtualSize	`0xe20`
VirtualAddress	`0x147000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x144000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.19515`

Imports

d3d11.dll	`D3D11CreateDeviceAndSwapChain`
D3DCOMPILER_43.dll	`D3DCompile`
d3dx11_43.dll	`D3DX11CreateShaderResourceViewFromMemory`
KERNEL32.dll	`GlobalUnlock` `GetModuleHandleA` `GetLocaleInfoA` `LoadLibraryA` `QueryPerformanceFrequency` `GetProcAddress` `VerSetConditionMask` `FreeLibrary` `QueryPerformanceCounter` `Sleep` `GetModuleHandleW` `GetSystemTimeAsFileTime` `GlobalLock` `ReadFile` `CloseHandle` `HeapAlloc` `HeapFree` `MapViewOfFile` `UnmapViewOfFile` `CreateFileMappingA` `SleepConditionVariableSRW` `SetUnhandledExceptionFilter` `GetCurrentProcessId` `WideCharToMultiByte` `GlobalFree` `GlobalAlloc` `MultiByteToWideChar` `GetFileSizeEx` `GetCurrentThreadId` `InitializeSListHead` `CreateFileA` `WakeAllConditionVariable` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive`
USER32.dll	`GetCapture` `ScreenToClient` `GetDC` `GetMessageExtraInfo` `GetKeyState` `UpdateWindow` `PostQuitMessage` `TranslateMessage` `PeekMessageW` `DispatchMessageW` `ClientToScreen` `ShowWindow` `RegisterClassExW` `GetKeyboardLayout` `CreateWindowExW` `DestroyWindow` `MonitorFromPoint` `DefWindowProcW` `SetCapture` `SetCursor` `SetProcessDPIAware` `IsWindowUnicode` `ReleaseCapture` `GetAsyncKeyState` `TrackMouseEvent` `SetCursorPos` `ReleaseDC` `GetCursorPos` `OpenClipboard` `CloseClipboard` `GetForegroundWindow` `UnregisterClassW` `EmptyClipboard` `GetClipboardData` `SetClipboardData` `LoadCursorW` `GetClientRect`
GDI32.dll	`GetDeviceCaps`
SHELL32.dll	`ShellExecuteW`
IMM32.dll	`ImmSetCompositionWindow` `ImmReleaseContext` `ImmGetContext` `ImmSetCandidateWindow`
MSVCP140.dll	`?_Xlength_error@std@@YAXPEBD@Z`
VCRUNTIME140_1.dll	`__CxxFrameHandler4`
VCRUNTIME140.dll	`strchr` `__std_exception_destroy` `__std_exception_copy` `strstr` `__std_terminate` `longjmp` `memcpy` `memmove` `memset` `memchr` `memcmp` `__current_exception` `__current_exception_context` `__C_specific_handler` `__intrinsic_setjmp` `_CxxThrowException` `strrchr`
api-ms-win-crt-stdio-l1-1-0.dll	`ftell` `__p__commode` `__acrt_iob_func` `fflush` `fclose` `fseek` `_set_fmode` `__stdio_common_vsscanf` `fread` `fwrite` `__stdio_common_vsprintf` `_wfopen` `__stdio_common_vfprintf`
api-ms-win-crt-utility-l1-1-0.dll	`qsort`
api-ms-win-crt-runtime-l1-1-0.dll	`_crt_atexit` `_cexit` `_initialize_onexit_table` `_initialize_narrow_environment` `_seh_filter_exe` `_configure_narrow_argv` `_get_initial_narrow_environment` `_initterm` `_initterm_e` `exit` `_exit` `_register_onexit_function` `__p___argc` `__p___argv` `_c_exit` `_register_thread_local_exe_atexit_callback` `terminate` `_wassert` `_set_app_type`
api-ms-win-crt-heap-l1-1-0.dll	`malloc` `_set_new_mode` `free` `_callnewh`
api-ms-win-crt-string-l1-1-0.dll	`tolower` `strncpy` `strcmp` `strlen` `strncmp`
api-ms-win-crt-convert-l1-1-0.dll	`strtol`
api-ms-win-crt-math-l1-1-0.dll	`ceilf` `powf` `logf` `floorf` `sinf` `cosf` `sqrtf` `__setusermatherr` `atan2f` `acosf` `fmodf`
api-ms-win-crt-locale-l1-1-0.dll	`_configthreadlocale`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Jun-28 10:07:31
Version	`0.0`
SizeofData	`130`
AddressOfRawData	`0xf9b10`
PointerToRawData	`0xf8710`
Referenced File	C:\Users\0x5\Downloads\inferno.rocks\examples\example_win32_directx11\Release\example_win32_directx11.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Jun-28 10:07:31
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0xf9b94`
PointerToRawData	`0xf8794`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Jun-28 10:07:31
Version	`0.0`
SizeofData	`852`
AddressOfRawData	`0xf9ba8`
PointerToRawData	`0xf87a8`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Jun-28 10:07:31
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x1400f9f20`
EndAddressOfRawData	`0x1400f9f28`
AddressOfIndex	`0x14013b588`
AddressOfCallbacks	`0x1400ca5e0`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x140109040`

RICH Header

XOR Key	`0x92bd2f2a`
Unmarked objects	`0`
Imports (VS2008 SP1 build 30729)	`18`
Imports (35721)	`6`
253 (35721)	`1`
ASM objects (35721)	`4`
C objects (35721)	`10`
C++ objects (35721)	`29`
Imports (33145)	`12`
C objects (VS2022 Update 4 (17.4.5) compiler 31942)	`26`
Imports (21202)	`7`
Total imports	`172`
C++ objects (LTCG) (36248)	`9`
Resource objects (36248)	`1`
Linker (36248)	`1`

Errors

Leave a comment

No comments yet.