| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Mar-13 03:24:34 |
| Detected languages |
English - United States
|
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x130 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 9 |
| TimeDateStamp | 2025-Mar-13 03:24:34 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x10e000 |
| SizeOfInitializedData | 0x31f000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000C8888 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x180000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x433000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.DLL |
CreateEventW
CreateFileMappingW MapViewOfFile GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA WriteProcessMemory ReadProcessMemory SuspendThread WriteConsoleW HeapSize DeleteFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFullPathNameW GetCurrentDirectoryW SetEndOfFile SetStdHandle GetFileAttributesExW HeapReAlloc FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetConsoleOutputCP ReadConsoleW GetConsoleMode GetModuleFileNameW ExitProcess TerminateThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW LoadLibraryA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess Sleep GetModuleHandleExW FreeLibraryAndExitThread VerSetConditionMask TlsFree SetLastError TlsGetValue TlsAlloc InterlockedFlushSList RtlUnwindEx RaiseException RtlPcToFileHeader GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent InitializeSListHead ResetEvent AddVectoredExceptionHandler CloseHandle WriteFile GetFileAttributesA CreateFileW CreateDirectoryW GetTickCount64 WideCharToMultiByte VirtualProtect GetLocalTime GetCurrentThreadId GetCurrentThread RtlUnwind WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection TlsSetValue GetLastError MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock ExitThread GlobalAlloc InitializeCriticalSection SetFilePointerEx InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LoadLibraryExW VirtualQuery VirtualFree VirtualAlloc FlushInstructionCache SetThreadContext ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW CreateFileA GetFileSizeEx ResumeThread GetThreadContext |
|---|---|
| ADVAPI32.dll |
CryptImportKey
CryptEncrypt CryptDestroyKey CryptDestroyHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptHashData RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA CryptCreateHash |
| CRYPT32.dll |
CertEnumCertificatesInStore
CertCloseStore CertOpenStore CryptStringToBinaryA CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore CertCreateCertificateChainEngine |
| d3d11.dll |
D3D11CreateDeviceAndSwapChain
|
| D3DCOMPILER_43.dll |
D3DCompile
|
| d3dx11_43.dll |
D3DX11CreateShaderResourceViewFromMemory
|
| GDI32.dll |
GetDeviceCaps
|
| IMM32.dll |
ImmSetCandidateWindow
ImmAssociateContextEx ImmSetCompositionWindow ImmGetContext ImmReleaseContext |
| Normaliz.dll |
IdnToAscii
|
| USER32.dll |
FindWindowW
OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard TrackMouseEvent DefWindowProcA GetDC ReleaseDC MessageBoxA wsprintfW UnregisterClassA RegisterClassExA SetTimer IsChild DestroyWindow SetLayeredWindowAttributes SetWindowPos BringWindowToTop SetFocus GetKeyState GetCapture SetCapture ReleaseCapture GetForegroundWindow SetWindowTextW GetClientRect AdjustWindowRectEx SetCursorPos SetCursor SetForegroundWindow CreateWindowExA PostMessageA ShowWindow GetCursorPos ClientToScreen ScreenToClient WindowFromPoint GetWindowLongW SetWindowLongA SetWindowLongW LoadCursorA MonitorFromWindow GetMonitorInfoA EnumDisplayMonitors SetProcessDPIAware TranslateMessage DispatchMessageA PeekMessageA PostQuitMessage UpdateWindow IsIconic CharUpperA |
| WLDAP32.dll |
#217
#301 #200 #30 #79 #35 #33 #32 #27 #26 #22 #41 #50 #45 #60 #211 #46 #143 |
| WS2_32.dll |
getaddrinfo
freeaddrinfo WSAResetEvent htonl ioctlsocket gethostname select __WSAFDIsSet WSAIoctl WSASetLastError ntohs getsockopt getsockname getpeername WSAWaitForMultipleEvents socket closesocket connect htons recv send sendto WSACleanup WSAGetLastError accept bind WSAEventSelect setsockopt WSACloseEvent WSACreateEvent recvfrom WSAEnumNetworkEvents listen WSAStartup |
| Ordinal | 1 |
|---|---|
| Address | 0x5160 |
| StartAddressOfRawData | 0x18013e8f8 |
|---|---|
| EndAddressOfRawData | 0x18013e900 |
| AddressOfIndex | 0x18041d458 |
| AddressOfCallbacks | 0x18010fbc0 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x138 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x180370d08 |
| XOR Key | 0x5ebe7e4f |
|---|---|
| Unmarked objects | 0 |
| C objects (27412) | 28 |
| ASM objects (27412) | 23 |
| C++ objects (27412) | 202 |
| C++ objects (VS 2015/2017/2019 runtime 29913) | 37 |
| ASM objects (VS 2015/2017/2019 runtime 29913) | 1 |
| 253 (28518) | 7 |
| C++ objects (30034) | 87 |
| C objects (30034) | 17 |
| ASM objects (30034) | 10 |
| C++ objects (30154) | 3 |
| C objects (VS2019 Update 2 (16.2) compiler 27905) | 116 |
| Imports (27412) | 24 |
| Imports (21202) | 7 |
| Total imports | 357 |
| C++ objects (30157) | 54 |
| Exports (30157) | 1 |
| Resource objects (30157) | 1 |
| Linker (30157) | 1 |