| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2026-Mar-11 12:51:39 |
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
loader.pdb
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe8 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2026-Mar-11 12:51:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x18000 |
| SizeOfInitializedData | 0xa400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000171C0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x26000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetLastError
VirtualProtect CreateThread WaitForSingleObject CloseHandle IsProcessorFeaturePresent HeapFree GetProcessHeap FormatMessageW LoadLibraryExA VirtualAlloc |
|---|---|
| oleaut32.dll |
SysFreeString
SysStringLen |
| api-ms-win-core-synch-l1-2-0.dll |
WakeByAddressAll
WaitOnAddress WakeByAddressSingle |
| KERNEL32.dll |
UnhandledExceptionFilter
IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId QueryPerformanceCounter SetUnhandledExceptionFilter HeapReAlloc lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetFileInformationByHandleEx CreateFileW GetFileInformationByHandle GetConsoleMode GetModuleHandleW GetFullPathNameW GetModuleHandleA HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP |
| ntdll.dll |
NtWriteFile
RtlNtStatusToDosError NtReadFile |
| VCRUNTIME140.dll |
__current_exception
__C_specific_handler _CxxThrowException memcmp memset memcpy memmove __CxxFrameHandler3 __current_exception_context |
| api-ms-win-crt-runtime-l1-1-0.dll |
_initialize_onexit_table
_exit __p___argc __p___argv exit terminate _register_thread_local_exe_atexit_callback _cexit _register_onexit_function _initterm_e _crt_atexit _initterm _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _c_exit |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-stdio-l1-1-0.dll |
_set_fmode
__p__commode |
| api-ms-win-crt-locale-l1-1-0.dll |
_configthreadlocale
|
| api-ms-win-crt-heap-l1-1-0.dll |
_set_new_mode
free |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-11 12:51:39 |
| Version | 0.0 |
| SizeofData | 35 |
| AddressOfRawData | 0x1e0f4 |
| PointerToRawData | 0x1d4f4 |
| Referenced File | loader.pdb |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-11 12:51:39 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x1e118 |
| PointerToRawData | 0x1d518 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Mar-11 12:51:39 |
| Version | 0.0 |
| SizeofData | 816 |
| AddressOfRawData | 0x1e12c |
| PointerToRawData | 0x1d52c |
| StartAddressOfRawData | 0x14001e480 |
|---|---|
| EndAddressOfRawData | 0x14001e4d8 |
| AddressOfIndex | 0x140022240 |
| AddressOfCallbacks | 0x1400193b8 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x0000000140005810
|
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140022100 |
| XOR Key | 0x9d8dec74 |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 12 |
| Imports (35207) | 2 |
| ASM objects (35207) | 3 |
| C objects (35207) | 9 |
| C++ objects (35207) | 23 |
| Imports (33145) | 9 |
| Total imports | 189 |
| Unmarked objects (#2) | 28 |
| Linker (35223) | 1 |
No comments yet.