fbd4ada12e3c473c23239bcf567fd79013f8ea7f7fd7fc2e44e7e7c46b310d15

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Sep-25 13:37:30
TLS Callbacks 2 callback(s) detected.

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • ingest.rubicon-telemetry.net
  • rubicon-telemetry.net
  • telemetry.net
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Uses constants related to SHA512
Uses known Mersenne Twister constants
Microsoft's Cryptography API
Suspicious The PE contains functions most legitimate programs don't use. Uses Microsoft's cryptographic API:
  • CryptAcquireContextA
  • CryptGenRandom
  • CryptReleaseContext
 Leverages the raw socket API to access the Internet:
  • WS2_32.dll
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 6cfbfa77633740d3a28b162cf462fdf4 🔍
SHA1 be64953dd21a623c966e9c78764dd1bc3c69a51e 🔍
SHA256 fbd4ada12e3c473c23239bcf567fd79013f8ea7f7fd7fc2e44e7e7c46b310d15 🔍
SHA3 4012b92214a4eb60318f815a7c0a04f884d66cc787ad8ab79dc9c6d65e3da351 🔍
SSDeep 1536:97KcmhuQ8myNGVnUJibqK+yPnS0tHCObrKCV+85j1ndmPo:9W78my0JUJwqKtnSoiYZs+1n 🔍
Imports Hash 0325b85d40e8aeab11620a1eda414044 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2026-Sep-25 13:37:30
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 2.0
SizeOfCode 0xca00
SizeOfInitializedData 0x10800
SizeOfUninitializedData 0xc00
AddressOfEntryPoint 0x0000000000001410 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x18000
SizeOfHeaders 0x400
Checksum 0x14fad
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e813dcb6aa8faa9ec2de05a0efb183bd 🔍
SHA1 4c798c4733f97ff38cb3dbcf099690afa1f63d2a 🔍
SHA256 93c9273eb5e350763079ec1b49c2978904ca2efe1d3539b3ca5a7ee531159c8e 🔍
SHA3 2e74108d1f783cbc455cc8985bc53b5cf375197d2a8503046795380de11b2843 🔍
VirtualSize 0xc838
VirtualAddress 0x1000
SizeOfRawData 0xca00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.36871

.data

MD5 c8b04407dfffe651183cd562221c89ea 🔍
SHA1 66ece9edd8f012d96d83c6da1e7f32128d29d8f5 🔍
SHA256 5e53ab3f9e0a3d2cc061c80499190f14d3f03a9af5bc1408b47d82fd32d8938b 🔍
SHA3 0373132dcbecc531fc293b20653645cf76d5b86c9cca6686536105c101b2f904 🔍
VirtualSize 0xb0
VirtualAddress 0xe000
SizeOfRawData 0x200
PointerToRawData 0xce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.79188

.rdata

MD5 19ca6ec47fd58f7cac37279702a80872 🔍
SHA1 cdc597ca417424ca60673af01637a61b2713e4de 🔍
SHA256 562a0d0a2e007eba1b94b479b4f078b5933006824f539eaa90aa35472317c774 🔍
SHA3 32bfa017e29cdc444e6851f4b1d145f8e2383847e36228ba3ce0e3d8f66e9bd8 🔍
VirtualSize 0x19a0
VirtualAddress 0xf000
SizeOfRawData 0x1a00
PointerToRawData 0xd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.01743

.pdata

MD5 ce7e00e4d20a1d83a279bc5a59d0e59a 🔍
SHA1 6fb0b04cec0887e1c4a18c74cc1e15fd1253c1eb 🔍
SHA256 cc45fb5725c9214f8933b999d41c9180d970e7d19fa128b5e0ccece43d13fd32 🔍
SHA3 94fba32dfaf30b89e0e3d43cd552ef36ec414a79b592da5e77491b299e7e0362 🔍
VirtualSize 0x660
VirtualAddress 0x11000
SizeOfRawData 0x800
PointerToRawData 0xea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.94575

.xdata

MD5 1663caf3ffefbd62223d53f682e076af 🔍
SHA1 2ceaa882cb0df81df4e25bb025da9b70876dca3d 🔍
SHA256 f047d0c2595af5ae2f1efa8d3a20dffa559f701d3bce35684551a14bf4a36152 🔍
SHA3 e407ff80d158cc0e75441e996d62c8d487c7aa26562ab8ce7ad02ebb5138060a 🔍
VirtualSize 0x834
VirtualAddress 0x12000
SizeOfRawData 0xa00
PointerToRawData 0xf200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.42985

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xb80
VirtualAddress 0x13000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 772f76d1efa298987b6eeacba9732549 🔍
SHA1 2d62c2a500f1e7ab84929173d7fd5cb08735228c 🔍
SHA256 cc313bcdc2b17afadb6a3e2fea38512d51e0ba14ca735d382dcd56da812757ec 🔍
SHA3 63c89573ecbe7af54280671247bd45879280e0cc8a2ac2402a84ba163bfa14fb 🔍
VirtualSize 0x978
VirtualAddress 0x14000
SizeOfRawData 0xa00
PointerToRawData 0xfc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.15066

.CRT

MD5 166f373c608fe517b03d0f7858d3f04a 🔍
SHA1 cfe86b29c04153f340c2efcd2866664447693c91 🔍
SHA256 63b3f9fb0ba95f7efc7963c1fdb4e3b4df9332c746671ea602712460807f18af 🔍
SHA3 89df596ed91515fc273a217ea3e2903d3bbc6406ccd39862982226f2f27737de 🔍
VirtualSize 0x60
VirtualAddress 0x15000
SizeOfRawData 0x200
PointerToRawData 0x10600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.27951

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x10
VirtualAddress 0x16000
SizeOfRawData 0x200
PointerToRawData 0x10800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.reloc

MD5 f5d77b8cd2c7d7724563a5aaac5e6425 🔍
SHA1 3728d7fe98176073d59d15e0ba39caa2309c25db 🔍
SHA256 f2719b1306ff5d1993949bf85562ea4a2f0e83fc635082d11d2646e136d68335 🔍
SHA3 7c5c9519635d9b983a6fdfdcc5fe1cef981118c1053432d262b40cddcbaf921c 🔍
VirtualSize 0x88
VirtualAddress 0x17000
SizeOfRawData 0x200
PointerToRawData 0x10a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 1.52552

Imports

ADVAPI32.dll CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
KERNEL32.dll CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
GetFileSize
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReadFile
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt.dll __C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
memset
signal
strerror
strlen
strncmp
vfprintf
wcslen
WS2_32.dll WSACleanup
WSAStartup
closesocket
connect
htons
inet_pton
recv
send
socket

Delayed Imports

Version Info

TLS Callbacks

StartAddressOfRawData 0x140016000
EndAddressOfRawData 0x140016008
AddressOfIndex 0x14001307c
AddressOfCallbacks 0x140015038
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks 0x0000000140006680
0x0000000140006650

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.