Manalyze report for f887dbdaccb5012242dae4c065525ff460daa06f9eb80c90dbc71287de5eb471

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Oct-09 07:07:42
Detected languages	English - United States
TLS Callbacks	2 callback(s) detected.
Debug artifacts	Embedded COFF debugging symbols

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Tries to detect virtualized environments: HARDWARE\DESCRIPTION\System` `Contains domain names: .gameloft.com .oac-global.cn cdn.oac-global.cn confirmation.oac-global.cn download.oac-global.cn gameloft.com gllive.oac-global.cn global.cn https://cdn.oac-global.cn https://cdn.oac-global.cn/assets/client_assets.zip https://discord.gg https://download.oac-global.cn https://download.oac-global.cn/manifest.txt https://oac-global.cn oac-global.cn scroll.info`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5` `Microsoft's Cryptography API`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryW` `Can access the registry: RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA` `Possibly launches other programs: CreateProcessA ShellExecuteA` `Uses Windows's Native API: ntohl ntohs` `Uses Microsoft's cryptographic API: CRYPTO_free` `Uses functions commonly found in keyloggers: GetAsyncKeyState GetForegroundWindow` `Has Internet access capabilities: WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest` `Leverages the raw socket API to access the Internet: WS2_32.dll` `Manipulates other processes: ReadProcessMemory` `Can take screenshots: CreateCompatibleDC GetDC PrintWindow` `Reads the contents of the clipboard: GetClipboardData`
Suspicious	The file contains overlay data.	`21673 bytes of data starting at offset 0xd41400.`
Safe	VirusTotal score: 0/51 (Scanned on 2026-10-14 20:25:07)	`All the AVs think this file is safe.`

Hashes

MD5	`ae0724834aad6b95f43da7d7cad0bf78` 🔍
SHA1	`01000e556a419c45eb800b955f8e15bf27ddbcea` 🔍
SHA256	`f887dbdaccb5012242dae4c065525ff460daa06f9eb80c90dbc71287de5eb471` 🔍
SHA3	`083b91e10d49ed7a7a984997178880b690ae5fb6e0e8f335366712e49a912ca8` 🔍
SSDeep	`98304:AJF8rD5XJNMr7ElseK7hgvhYF5XFtUy2cBnDKri3IizS3nac+Mc855Ws2gzhCUbi:adJgzTOqdoLmwHufureGugB` 🔍
Imports Hash	`98bcc416485090a4aeffa4f09b46eed3` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	2026-Oct-09 07:07:42
PointerToSymbolTable	`0xd41400`
NumberOfSymbols	`581`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0xac7c00`
SizeOfInitializedData	`0xd41000`
SizeOfUninitializedData	`0x7e600`
AddressOfEntryPoint	`0x00000000000013E0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x140000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xdc6000`
SizeOfHeaders	`0x400`
Checksum	`0xd4c1f9`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`d15a54094723005ab5b35976f323e969 🔍`
SHA1	`2fab7b68e622037c7e569ef14fbad08a3bf10205 🔍`
SHA256	`7196d1024ac620fa938c0adbfc3ebf8ba8a4e1023d4b48c9d9694dbdf8531d4b 🔍`
SHA3	`a87c48447f65a0c793e9a488887617e58fc07f6c0b994911b31d10018bac5a1c 🔍`
VirtualSize	`0xac7b10`
VirtualAddress	`0x1000`
SizeOfRawData	`0xac7c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.34246`

.data

MD5	`65be49baef1b4d712299b67fb6e3b3fc 🔍`
SHA1	`6c4126db090d95753fbdded8b7071c9b867b30c7 🔍`
SHA256	`39fee22f90fba6a6cd22d8935d7161b2ef059af7ec5f55040af8cf38caaf778a 🔍`
SHA3	`50067abed57e233ac7c243a60cbd1bd16a77a2cdf5c6dc9c51cc74838fa22eb7 🔍`
VirtualSize	`0xff60`
VirtualAddress	`0xac9000`
SizeOfRawData	`0x10000`
PointerToRawData	`0xac8000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.98605`

.rdata

MD5	`ce05cb0330b0ae86d17966a2f412aca9 🔍`
SHA1	`8225a7f31b92d883d9acb12614d303a9d0deeba5 🔍`
SHA256	`7de6b829a50da0d18d55ae375f102237e445fa4ad1b25264b85cac41aad594f8 🔍`
SHA3	`5ed06b4a4578869a10733ab9a002b21f795a819cf40e2b59c823ba2e57b6bcad 🔍`
VirtualSize	`0x113100`
VirtualAddress	`0xad9000`
SizeOfRawData	`0x113200`
PointerToRawData	`0xad8000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.299`

.pdata

MD5	`baca12cb94cbd686ff36f8fcfba16fae 🔍`
SHA1	`f99478d1bf10ad6a55ff6f53abad76eee09d95e9 🔍`
SHA256	`540e36f4934bf2670ee76756e1c0727fdb626d2f337440fc65195d593d74aac2 🔍`
SHA3	`7644c0c008a5a8b8440a487ae343deeef3361c5ab2c866da253b66eb9c60bff8 🔍`
VirtualSize	`0x64a88`
VirtualAddress	`0xbed000`
SizeOfRawData	`0x64c00`
PointerToRawData	`0xbeb200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.51601`

.xdata

MD5	`ca5f8a51a9b0fcb58885e73a99a86c28 🔍`
SHA1	`b2f0c11f6678e5fbc427cae98dc0c1f2403aeb0a 🔍`
SHA256	`64d23d3d5986a0a6df3ebf1a3517fb3ef5eae8b6d907f0079ca739f19cacc1bf 🔍`
SHA3	`f162cf530c5e9d01fd989ef0899b978689e81d3a48de71c2b68dd522abfacd69 🔍`
VirtualSize	`0x9f218`
VirtualAddress	`0xc52000`
SizeOfRawData	`0x9f400`
PointerToRawData	`0xc4fe00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.22703`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x7e550`
VirtualAddress	`0xcf2000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.idata

MD5	`328be2e29f7b44c40fd7190616ee6006 🔍`
SHA1	`bc71f0b4483f74b8e6859d1d3b99e5e9b1fbea9a 🔍`
SHA256	`846d5aa8308b470f5566006525060808dd949f5109d0af51f83b1c7867b5423d 🔍`
SHA3	`0892698bd2290c564355e42250c2dbc8d7847564f79fcd7d07137f2623e770b3 🔍`
VirtualSize	`0x4f10`
VirtualAddress	`0xd71000`
SizeOfRawData	`0x5000`
PointerToRawData	`0xcef200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.66337`

.CRT

MD5	`0c73c878aa7b70d310bb2cc3e3f44cc2 🔍`
SHA1	`b62ee46a45230037cb484404943d07bc791312e0 🔍`
SHA256	`8ebef6d1f00bfb5280e8f65c75572497277a5652de99ba058e2d62f079c40af2 🔍`
SHA3	`fc89de460b81177d727a4c7a3bd3487e8bccfeff2518fa1ec4e464d7309023db 🔍`
VirtualSize	`0x60`
VirtualAddress	`0xd76000`
SizeOfRawData	`0x200`
PointerToRawData	`0xcf4200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.303207`

.tls

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x10`
VirtualAddress	`0xd77000`
SizeOfRawData	`0x200`
PointerToRawData	`0xcf4400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`270c921ed25e2c44484306c22b649ed6 🔍`
SHA1	`2063512ade6a2e6bdca020b47d0346f29a763c74 🔍`
SHA256	`5108eab9586b83507b91876e012205174b06dbb7ebf648c26296c92b6d044f0b 🔍`
SHA3	`39e729133fdd1e07761f5da6e2cf9cded277924b7cf113c1b50fdfe01e2fed6f 🔍`
VirtualSize	`0x34a28`
VirtualAddress	`0xd78000`
SizeOfRawData	`0x34c00`
PointerToRawData	`0xcf4600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.99396`

.reloc

MD5	`f12f1fa60b1a45750e79ad1d93133f7b 🔍`
SHA1	`d93bea303d6295b114caedf7951fd20621a17c0d 🔍`
SHA256	`808fa28f71acf86ba12cedfe8e82fff58e38acb0fdeff9b93c52bdc304c1c697 🔍`
SHA3	`a67adecc5ef86dc1ec1f85d617fdd3fe34e6e9dadb9f2c5df10b83b8c1179693 🔍`
VirtualSize	`0x18018`
VirtualAddress	`0xdad000`
SizeOfRawData	`0x18200`
PointerToRawData	`0xd29200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.44596`

Imports

libcrypto-3-x64.dll	`BIO_ctrl` `BIO_f_base64` `BIO_free` `BIO_free_all` `BIO_gets` `BIO_new` `BIO_new_mem_buf` `BIO_push` `BIO_s_mem` `BIO_set_flags` `BIO_write` `CRYPTO_free` `ERR_clear_error` `ERR_error_string` `ERR_get_error` `EVP_PKEY_free` `PEM_read_bio_X509` `RAND_poll` `RAND_seed` `RAND_status` `SHA256` `X509_NAME_print_ex` `X509_STORE_add_cert` `X509_STORE_new` `X509_free` `X509_get_issuer_name` `X509_get_pubkey` `X509_get_subject_name` `i2d_PUBKEY`
libopenal-1.dll	`alBufferData` `alDeleteBuffers` `alDeleteSources` `alDistanceModel` `alDopplerFactor` `alGenBuffers` `alGenSources` `alGetError` `alGetFloat` `alGetInteger` `alGetListenerfv` `alGetSourcef` `alGetSourcefv` `alGetSourcei` `alListener3f` `alListenerfv` `alSource3f` `alSourcePause` `alSourcePlay` `alSourceQueueBuffers` `alSourceStop` `alSourceUnqueueBuffers` `alSourcef` `alSourcei` `alSpeedOfSound` `alcCloseDevice` `alcCreateContext` `alcDestroyContext` `alcGetError` `alcMakeContextCurrent` `alcOpenDevice` `alcProcessContext` `alcSuspendContext`
libssl-3-x64.dll	`OPENSSL_init_ssl` `SSL_CTX_ctrl` `SSL_CTX_free` `SSL_CTX_new` `SSL_CTX_set_cert_store` `SSL_CTX_set_verify` `SSL_connect` `SSL_ctrl` `SSL_free` `SSL_get1_peer_certificate` `SSL_get_error` `SSL_get_verify_result` `SSL_new` `SSL_read` `SSL_set_fd` `SSL_shutdown` `SSL_write` `TLS_client_method`
zlib1.dll	`crc32` `deflate` `deflateEnd` `deflateInit2_` `deflateReset` `inflate` `inflateEnd` `inflateInit2_` `inflateInit_` `inflateReset`
ADVAPI32.dll	`GetUserNameA` `RegCloseKey` `RegEnumValueA` `RegOpenKeyExA` `RegQueryInfoKeyA` `RegQueryValueExA`
COMCTL32.dll	`InitCommonControlsEx`
dbghelp.dll	`MiniDumpWriteDump`
GDI32.dll	`ChoosePixelFormat` `CreateCompatibleBitmap` `CreateCompatibleDC` `CreateFontW` `DeleteDC` `DeleteObject` `DescribePixelFormat` `GetDeviceCaps` `GetPixel` `GetPixelFormat` `SelectObject` `SetPixelFormat` `SwapBuffers`
KERNEL32.dll	`AllocConsole` `CloseHandle` `CopyFileA` `CreateDirectoryA` `CreateEventA` `CreateFileA` `CreateMutexExA` `CreateProcessA` `CreateThread` `DeleteCriticalSection` `DeleteFileA` `EnterCriticalSection` `ExitProcess` `FindClose` `FindFirstFileA` `FindNextFileA` `FormatMessageA` `FreeConsole` `FreeLibrary` `GetCurrentDirectoryA` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetEnvironmentVariableA` `GetExitCodeProcess` `GetFileAttributesA` `GetFileAttributesExA` `GetLastError` `GetLocalTime` `GetModuleFileNameA` `GetModuleHandleA` `GetModuleHandleW` `GetPrivateProfileIntA` `GetPrivateProfileStringA` `GetProcAddress` `GetStdHandle` `GetSystemInfo` `GetThreadContext` `GetTickCount` `GetVersionExA` `GlobalAlloc` `GlobalLock` `GlobalMemoryStatus` `GlobalUnlock` `InitializeCriticalSection` `IsDBCSLeadByteEx` `LeaveCriticalSection` `LoadLibraryA` `LoadLibraryW` `LocalFree` `MoveFileA` `MultiByteToWideChar` `OutputDebugStringA` `QueryPerformanceCounter` `QueryPerformanceFrequency` `RaiseException` `ReadConsoleA` `ReadFileEx` `ReadProcessMemory` `ReleaseMutex` `RemoveDirectoryA` `ResetEvent` `ResumeThread` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlUnwindEx` `RtlVirtualUnwind` `SetConsoleMode` `SetCurrentDirectoryA` `SetEvent` `SetLastError` `SetThreadAffinityMask` `SetThreadPriority` `SetUnhandledExceptionFilter` `Sleep` `SleepEx` `SuspendThread` `TerminateProcess` `TlsGetValue` `TryEnterCriticalSection` `VirtualProtect` `VirtualQuery` `WaitForSingleObject` `WaitForSingleObjectEx` `WideCharToMultiByte` `WriteConsoleA` `WritePrivateProfileStringA` `__C_specific_handler` `lstrcmpiA`
msvcrt.dll	`___lc_codepage_func` `___mb_cur_max_func` `__argc` `__argv` `__getmainargs` `__initenv` `__iob_func` `__set_app_type` `__setusermatherr` `_amsg_exit` `_cexit` `_commode` `_ctime64` `_errno` `_fdopen` `_filelengthi64` `_fileno` `_findclose` `_findfirst64` `fwprintf` `_findnext64` `_fmode` `_fstat64` `_fullpath` `_gcvt` `_getcwd` `_gmtime64` `_initterm` `_isnan` `_itoa` `_localtime64` `_lock` `_lseeki64` `_mktime64` `_onexit` `_open_osfhandle` `_setjmp` `_snprintf` `_snwprintf` `_strdup` `_stricmp` `_strnicmp` `_strtoui64` `_time64` `_unlock` `_vscprintf` `_vsnprintf` `_wcsicmp` `_wcstoui64` `_wfopen` `abort` `acos` `asin` `atan` `atof` `atoi` `atol` `calloc` `clearerr` `exit` `fclose` `feof` `fflush` `fgetpos` `fgets` `fopen` `fprintf` `fputc` `fputs` `fputwc` `fread` `free` `fseek` `fsetpos` `ftell` `fwrite` `getc` `getenv` `getwc` `isalpha` `isspace` `iswctype` `isxdigit` `localeconv` `log10` `longjmp` `malloc` `memchr` `memcmp` `memcpy` `memmove` `memset` `putc` `putwc` `qsort` `rand` `realloc` `remove` `rename` `setlocale` `setvbuf` `signal` `srand` `strcat` `strchr` `strcmp` `strcoll` `strcpy` `strerror` `strftime` `strlen` `strncat` `strncmp` `strncpy` `strpbrk` `strrchr` `strstr` `strtol` `strtoul` `strxfrm` `tan` `tolower` `toupper` `towlower` `towupper` `ungetc` `ungetwc` `vfprintf` `wcscat` `wcscmp` `wcscoll` `wcscpy` `wcsftime` `wcslen` `wcsncpy` `wcstombs` `wcsxfrm` `_strtoui64` `_strtoi64` `_write` `_read` `_fileno` `_fdopen` `_chdir`
OPENGL32.dll	`glBindTexture` `glBlendFunc` `glClear` `glClearColor` `glClearDepth` `glClearStencil` `glColorMask` `glCopyTexSubImage2D` `glCullFace` `glDeleteTextures` `glDepthFunc` `glDepthMask` `glDepthRange` `glDisable` `glDrawArrays` `glDrawElements` `glEnable` `glFlush` `glFrontFace` `glGenTextures` `glGetError` `glGetFloatv` `glGetIntegerv` `glGetString` `glLineWidth` `glPixelStorei` `glPointSize` `glPolygonMode` `glPolygonOffset` `glReadPixels` `glScissor` `glStencilFunc` `glStencilMask` `glStencilOp` `glTexImage2D` `glTexParameterf` `glTexParameteri` `glTexSubImage2D` `glViewport` `wglCreateContext` `wglDeleteContext` `wglGetProcAddress` `wglMakeCurrent`
libwinpthread-1.dll	`nanosleep` `pthread_cond_broadcast` `pthread_cond_destroy` `pthread_cond_init` `pthread_cond_signal` `pthread_cond_timedwait` `pthread_cond_wait` `pthread_create` `pthread_exit` `pthread_getspecific` `pthread_join` `pthread_key_create` `pthread_kill` `pthread_mutex_destroy` `pthread_mutex_init` `pthread_mutex_lock` `pthread_mutex_trylock` `pthread_mutex_unlock` `pthread_once` `pthread_self` `pthread_setcanceltype` `pthread_setspecific` `pthread_testcancel`
SHELL32.dll	`ShellExecuteA`
SHLWAPI.dll	`PathFindExtensionA`
USER32.dll	`AdjustWindowRect` `AdjustWindowRectEx` `BeginPaint` `CallWindowProcA` `ChangeDisplaySettingsA` `ClientToScreen` `CloseClipboard` `CreateWindowExA` `CreateWindowExW` `DefWindowProcA` `DestroyWindow` `DispatchMessageA` `EmptyClipboard` `EndPaint` `EnumDisplayDevicesA` `EnumDisplaySettingsA` `GetActiveWindow` `GetAsyncKeyState` `GetCapture` `GetClassNameA` `GetClientRect` `GetClipboardData` `GetCursorPos` `GetDC` `GetFocus` `GetForegroundWindow` `GetKeyboardState` `GetMessageExtraInfo` `GetMonitorInfoA` `GetParent` `GetSystemMetrics` `GetWindow` `GetWindowLongA` `GetWindowLongPtrA` `GetWindowPlacement` `GetWindowRect` `GetWindowTextW` `InvalidateRect` `IsChild` `IsWindow` `IsWindowEnabled` `IsWindowVisible` `IsZoomed` `KillTimer` `LoadCursorA` `LoadIconA` `LoadImageA` `MessageBoxA` `MonitorFromWindow` `MoveWindow` `OpenClipboard` `PeekMessageA` `PostQuitMessage` `PrintWindow` `RedrawWindow` `RegisterClassA` `RegisterClassExA` `ReleaseCapture` `ReleaseDC` `ScreenToClient` `SendMessageA` `SendMessageTimeoutA` `SendMessageTimeoutW` `SendMessageW` `SetActiveWindow` `SetCapture` `SetClipboardData` `SetCursor` `SetCursorPos` `SetFocus` `SetForegroundWindow` `SetLayeredWindowAttributes` `SetTimer` `SetWindowLongPtrA` `SetWindowPlacement` `SetWindowPos` `SetWindowTextA` `SetWindowTextW` `ShowWindow` `ToAscii` `TranslateMessage` `UpdateWindow` `WindowFromPoint`
VERSION.dll	`GetFileVersionInfoA` `GetFileVersionInfoSizeA` `VerQueryValueA`
WINHTTP.dll	`WinHttpAddRequestHeaders` `WinHttpCloseHandle` `WinHttpConnect` `WinHttpOpen` `WinHttpOpenRequest` `WinHttpQueryDataAvailable` `WinHttpQueryHeaders` `WinHttpReadData` `WinHttpReceiveResponse` `WinHttpSendRequest`
WINMM.dll	`timeBeginPeriod` `timeGetTime`
WS2_32.dll	`WSACleanup` `WSAGetLastError` `WSAStartup` `__WSAFDIsSet` `accept` `bind` `closesocket` `connect` `freeaddrinfo` `getaddrinfo` `gethostbyname` `gethostname` `getsockname` `getsockopt` `htonl` `htons` `inet_addr` `inet_ntoa` `ioctlsocket` `listen` `ntohl` `ntohs` `recv` `recvfrom` `select` `send` `sendto` `setsockopt` `shutdown` `socket`

Delayed Imports

1

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2b6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.99693`
MD5	`e8735ce7a13c6ceb1d1b38da7612cb27 🔍`
SHA1	`52134a6afead04cbab431152757e7e15463eff58 🔍`
SHA256	`64f953bb16df3ed35746a7d392abaabe0283f35d3c4b62fd33bb44d6fd690ca6 🔍`
SHA3	`c08d02ad903e867ca8228ea4bfc2ea08cc6506af1d1036764ade6a006c450825 🔍`

1 (#2)

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3aa`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.7616`
Detected Filetype	PNG graphic file
MD5	`7d3e6c55c8673a55b27cf5d46ad5216d 🔍`
SHA1	`529fd46921b5b5c47b99f7284dfc057a48522f7b 🔍`
SHA256	`4e694d0fa5509cd657498663481e62a679abef011e7bb2033ff7932cbde6975d 🔍`
SHA3	`e30facc3484e6043cd72ba36708d6af0471b540195caef0ac5c1d34a1d283447 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc36`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.92352`
Detected Filetype	PNG graphic file
MD5	`deee51418e98b7b7f4a98b8dedaae41f 🔍`
SHA1	`d48864f1c7a1cadd18268644b08970eb8f086cf5 🔍`
SHA256	`bb535fb0f7b2c4fce48376d3e3da80eef94966fb1440db4862c2d63c1c8e5488 🔍`
SHA3	`b92b64da4aa7e729e3a9e145e1c9259815e87aae7b1f2f07dc4c1c7a817926aa 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x19e4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.96282`
Detected Filetype	PNG graphic file
MD5	`614784573521d882ce2197fdd7345b0d 🔍`
SHA1	`118083c1c5bc6d040a0d7061c968302e03053ff2 🔍`
SHA256	`abf11b0badd0d235a7faa53223f824939e1ad623fd9074fc5f83e70097ee63f9 🔍`
SHA3	`4232fc3ef3e2556222eeef069ce99afe4042d6c46d92f0938987d23a310676ab 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2c89`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.975`
Detected Filetype	PNG graphic file
MD5	`b8eae209a4df40862b6788631bcb54c1 🔍`
SHA1	`ffc3bb9c4a656c7d05ccae476290e6eec3a0e3ca 🔍`
SHA256	`6f0f5dc6f12402970a6188ab398e50ae41a709cb24967e920a9db932139d3f4b 🔍`
SHA3	`5c8eb7555153fb88e1c03fb04bc0335c8ba7f112ae444a967a23e0e7204f32e4 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0xa577`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.98641`
Detected Filetype	PNG graphic file
MD5	`bea440eae70bbe216c50bbcf07cf64fa 🔍`
SHA1	`444fd0f36d1bfcb7d79bbbda2d9b7666ba3cfbac 🔍`
SHA256	`8845a94652ddc7a1f82cec1f8f9fe38ec5e98a83636e748b8079ed1ec665409e 🔍`
SHA3	`09e0988039d9f95de5b32f24c84b59ea86926a74211ce159de478fe56f30124a 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x24942`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.99447`
Detected Filetype	PNG graphic file
MD5	`f4f516c0e1b5e3dd453572a99a68dc3d 🔍`
SHA1	`aff4b0cd0f14fb1c66934237d14b926b88004e21 🔍`
SHA256	`3c24ef294a2653b33bf15e7c2c857056e9ba4e72e6a22a0d9cd5241d08c406bc 🔍`
SHA3	`1694d7bbb3adf0761e5bc08c30b249a5134ed80d34147f6fd73e0f5776542ca8 🔍`

101

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.90223`
Detected Filetype	Icon file
MD5	`9f7cdf360c8c14d650fc499e439021b6 🔍`
SHA1	`f0595317643bfc114500c33e547da3a5be0d2e5d 🔍`
SHA256	`4bc3ad5e7607e441b6a26a4ab65ed6a65bcce367e23ab194aedf38cae3226707 🔍`
SHA3	`071cef1981893fe6d94c64c83b2aba9dbb84b9dad4ce34d8fdc350cef0e9c517 🔍`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x140d77000`
EndAddressOfRawData	`0x140d77008`
AddressOfIndex	`0x140d6f90c`
AddressOfCallbacks	`0x140d76038`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x00000001407BFF40` `0x00000001407BFF10`

Load Configuration

RICH Header

Errors

[*] Warning: COFF String Table's reported size is bigger than the remaining bytes!
[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.