PE check for 'sample02.exe':
Entropy: 5.581849 (Min=0.0, Max=8.0)
MD5     hash: 80f563f3992e9e7d87086f3f4966969f
SHA-1   hash: 7eb9c859d30baf89d5547a13171418f7411c3e1a
SHA-256 hash: c9dc59066fe4cd939a7c33572a4db6918e18e1abc76c897abd39b127e7575e18
SHA-512 hash: 75ca09b3271fa5ca32dd72ccac169a6638067844c28535b29df76509f75a25131bcc2d1d6b54dd60f9e3a7615576774bf9eaadb23fb4d5f20cf9504977153981
.text entropy: 5.883852 (Min=0.0, Max=8.0)
.rdata entropy: 4.674386 (Min=0.0, Max=8.0)
.data entropy: 3.358808 (Min=0.0, Max=8.0)
.reloc entropy: 3.959802 (Min=0.0, Max=8.0)
Dump Info:
----------DOS_HEADER----------

[IMAGE_DOS_HEADER]
0x0        0x0   e_magic:                       0x5A4D    
0x2        0x2   e_cblp:                        0x90      
0x4        0x4   e_cp:                          0x3       
0x6        0x6   e_crlc:                        0x0       
0x8        0x8   e_cparhdr:                     0x4       
0xA        0xA   e_minalloc:                    0x0       
0xC        0xC   e_maxalloc:                    0xFFFF    
0xE        0xE   e_ss:                          0x0       
0x10       0x10  e_sp:                          0xB8      
0x12       0x12  e_csum:                        0x0       
0x14       0x14  e_ip:                          0x0       
0x16       0x16  e_cs:                          0x0       
0x18       0x18  e_lfarlc:                      0x40      
0x1A       0x1A  e_ovno:                        0x0       
0x1C       0x1C  e_res:                         
0x24       0x24  e_oemid:                       0x0       
0x26       0x26  e_oeminfo:                     0x0       
0x28       0x28  e_res2:                        
0x3C       0x3C  e_lfanew:                      0xB8      

----------NT_HEADERS----------

[IMAGE_NT_HEADERS]
0xB8       0x0   Signature:                     0x4550    

----------FILE_HEADER----------

[IMAGE_FILE_HEADER]
0xBC       0x0   Machine:                       0x14C     
0xBE       0x2   NumberOfSections:              0x4       
0xC0       0x4   TimeDateStamp:                 0x6052FE47 [Thu Mar 18 07:16:23 2021 UTC]
0xC4       0x8   PointerToSymbolTable:          0x0       
0xC8       0xC   NumberOfSymbols:               0x0       
0xCC       0x10  SizeOfOptionalHeader:          0xE0      
0xCE       0x12  Characteristics:               0x10E     
Flags: IMAGE_FILE_32BIT_MACHINE, IMAGE_FILE_EXECUTABLE_IMAGE, IMAGE_FILE_LINE_NUMS_STRIPPED, IMAGE_FILE_LOCAL_SYMS_STRIPPED

----------OPTIONAL_HEADER----------

[IMAGE_OPTIONAL_HEADER]
0xD0       0x0   Magic:                         0x10B     
0xD2       0x2   MajorLinkerVersion:            0x5       
0xD3       0x3   MinorLinkerVersion:            0xC       
0xD4       0x4   SizeOfCode:                    0x2200    
0xD8       0x8   SizeOfInitializedData:         0x1000    
0xDC       0xC   SizeOfUninitializedData:       0x0       
0xE0       0x10  AddressOfEntryPoint:           0x1000    
0xE4       0x14  BaseOfCode:                    0x1000    
0xE8       0x18  BaseOfData:                    0x4000    
0xEC       0x1C  ImageBase:                     0x400000  
0xF0       0x20  SectionAlignment:              0x1000    
0xF4       0x24  FileAlignment:                 0x200     
0xF8       0x28  MajorOperatingSystemVersion:   0x4       
0xFA       0x2A  MinorOperatingSystemVersion:   0x0       
0xFC       0x2C  MajorImageVersion:             0x0       
0xFE       0x2E  MinorImageVersion:             0x0       
0x100      0x30  MajorSubsystemVersion:         0x4       
0x102      0x32  MinorSubsystemVersion:         0x0       
0x104      0x34  Reserved1:                     0x0       
0x108      0x38  SizeOfImage:                   0x7000    
0x10C      0x3C  SizeOfHeaders:                 0x400     
0x110      0x40  CheckSum:                      0x0       
0x114      0x44  Subsystem:                     0x2       
0x116      0x46  DllCharacteristics:            0x0       
0x118      0x48  SizeOfStackReserve:            0x100000  
0x11C      0x4C  SizeOfStackCommit:             0x1000    
0x120      0x50  SizeOfHeapReserve:             0x100000  
0x124      0x54  SizeOfHeapCommit:              0x1000    
0x128      0x58  LoaderFlags:                   0x0       
0x12C      0x5C  NumberOfRvaAndSizes:           0x10      
DllCharacteristics: 

----------PE Sections----------

[IMAGE_SECTION_HEADER]
0x1B0      0x0   Name:                          .text
0x1B8      0x8   Misc:                          0x20F6    
0x1B8      0x8   Misc_PhysicalAddress:          0x20F6    
0x1B8      0x8   Misc_VirtualSize:              0x20F6    
0x1BC      0xC   VirtualAddress:                0x1000    
0x1C0      0x10  SizeOfRawData:                 0x2200    
0x1C4      0x14  PointerToRawData:              0x400     
0x1C8      0x18  PointerToRelocations:          0x0       
0x1CC      0x1C  PointerToLinenumbers:          0x0       
0x1D0      0x20  NumberOfRelocations:           0x0       
0x1D2      0x22  NumberOfLinenumbers:           0x0       
0x1D4      0x24  Characteristics:               0x60000020
Flags: IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Entropy: 5.883852 (Min=0.0, Max=8.0)
MD5     hash: 122e535ee64716dd245a64c7ca8af734
SHA-1   hash: d4f08a63c4bc38f275a9a328f809b4547216f548
SHA-256 hash: deeaadc0470549e5d75604217a2e09a554195898d1020e609279d15009fa04ef
SHA-512 hash: 7e8f4cb538f14e90d19f1b4e34b6887724d42b2fe41079c45c37b7abc8bc9a6cd0b3a47e81ebb6fda8ad1913126cd674f0743ab7c66f33a3724c0acd700d0f8d

[IMAGE_SECTION_HEADER]
0x1D8      0x0   Name:                          .rdata
0x1E0      0x8   Misc:                          0x830     
0x1E0      0x8   Misc_PhysicalAddress:          0x830     
0x1E0      0x8   Misc_VirtualSize:              0x830     
0x1E4      0xC   VirtualAddress:                0x4000    
0x1E8      0x10  SizeOfRawData:                 0xA00     
0x1EC      0x14  PointerToRawData:              0x2600    
0x1F0      0x18  PointerToRelocations:          0x0       
0x1F4      0x1C  PointerToLinenumbers:          0x0       
0x1F8      0x20  NumberOfRelocations:           0x0       
0x1FA      0x22  NumberOfLinenumbers:           0x0       
0x1FC      0x24  Characteristics:               0x40000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Entropy: 4.674386 (Min=0.0, Max=8.0)
MD5     hash: 4fbbb1d440e527997c8dba70b03c8826
SHA-1   hash: b70c5e6131a545c46713aaabd94c3f3e3fdaec5c
SHA-256 hash: 3f97111361e54f0b8566de043182e75d44a27187014c3ce1846dbd8a6b0e29be
SHA-512 hash: 2a9fa71d2570078c70a4b2a10bc3acaaf845255a8ec050bce9a1ffe85101886948070ef2f8d4232277a9b70845545f4afe1b24c1da498123ac25b7d0ea1bb645

[IMAGE_SECTION_HEADER]
0x200      0x0   Name:                          .data
0x208      0x8   Misc:                          0x240     
0x208      0x8   Misc_PhysicalAddress:          0x240     
0x208      0x8   Misc_VirtualSize:              0x240     
0x20C      0xC   VirtualAddress:                0x5000    
0x210      0x10  SizeOfRawData:                 0x400     
0x214      0x14  PointerToRawData:              0x3000    
0x218      0x18  PointerToRelocations:          0x0       
0x21C      0x1C  PointerToLinenumbers:          0x0       
0x220      0x20  NumberOfRelocations:           0x0       
0x222      0x22  NumberOfLinenumbers:           0x0       
0x224      0x24  Characteristics:               0xC0000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Entropy: 3.358808 (Min=0.0, Max=8.0)
MD5     hash: eda2a3994949bd4b46a11d1c5981cfdb
SHA-1   hash: 8aa67040983111495bfd490d8e037369bab6b90f
SHA-256 hash: 34ff8f67ddecb1d8a33ec834083635e3a796440c8f7afc9dfad7e6a924446f86
SHA-512 hash: 5dfe8908d4da01e1ebd4fee6da9ace795107cd64f7cdf065fd3a9247225ae16c791cf6eeaa98a8579a980b8ff8b6d161f9fb3ab6be3e3c0db77523be86a0baa9

[IMAGE_SECTION_HEADER]
0x228      0x0   Name:                          .reloc
0x230      0x8   Misc:                          0x182     
0x230      0x8   Misc_PhysicalAddress:          0x182     
0x230      0x8   Misc_VirtualSize:              0x182     
0x234      0xC   VirtualAddress:                0x6000    
0x238      0x10  SizeOfRawData:                 0x200     
0x23C      0x14  PointerToRawData:              0x3400    
0x240      0x18  PointerToRelocations:          0x0       
0x244      0x1C  PointerToLinenumbers:          0x0       
0x248      0x20  NumberOfRelocations:           0x0       
0x24A      0x22  NumberOfLinenumbers:           0x0       
0x24C      0x24  Characteristics:               0x42000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
Entropy: 3.959802 (Min=0.0, Max=8.0)
MD5     hash: f944cbb7aff2f2c79595365267ca35d4
SHA-1   hash: 90e206eb7fbfaf54f936004c2aeba8a10283dd5e
SHA-256 hash: cd9d303e3ae53b99469add1f56217934da5103cd01b938062bba7fbb5a5c3135
SHA-512 hash: c4f45923097876be1f322e2c242f076df4f2668be3df991ea075b60b7bf89adcb631156d2e02914804437e34deae7a92a51af0732edb8ce89b47f747cee4203e

----------Directories----------

[IMAGE_DIRECTORY_ENTRY_EXPORT]
0x130      0x0   VirtualAddress:                0x0       
0x134      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_IMPORT]
0x138      0x0   VirtualAddress:                0x4140    
0x13C      0x4   Size:                          0xC8      
[IMAGE_DIRECTORY_ENTRY_RESOURCE]
0x140      0x0   VirtualAddress:                0x0       
0x144      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_EXCEPTION]
0x148      0x0   VirtualAddress:                0x0       
0x14C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_SECURITY]
0x150      0x0   VirtualAddress:                0x0       
0x154      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_BASERELOC]
0x158      0x0   VirtualAddress:                0x6000    
0x15C      0x4   Size:                          0x124     
[IMAGE_DIRECTORY_ENTRY_DEBUG]
0x160      0x0   VirtualAddress:                0x0       
0x164      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_COPYRIGHT]
0x168      0x0   VirtualAddress:                0x0       
0x16C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_GLOBALPTR]
0x170      0x0   VirtualAddress:                0x0       
0x174      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_TLS]
0x178      0x0   VirtualAddress:                0x0       
0x17C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG]
0x180      0x0   VirtualAddress:                0x0       
0x184      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT]
0x188      0x0   VirtualAddress:                0x0       
0x18C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_IAT]
0x190      0x0   VirtualAddress:                0x4000    
0x194      0x4   Size:                          0x140     
[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]
0x198      0x0   VirtualAddress:                0x0       
0x19C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]
0x1A0      0x0   VirtualAddress:                0x0       
0x1A4      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_RESERVED]
0x1A8      0x0   VirtualAddress:                0x0       
0x1AC      0x4   Size:                          0x0       

----------Imported symbols----------

[IMAGE_IMPORT_DESCRIPTOR]
0x2740     0x0   OriginalFirstThunk:            0x42C0    
0x2740     0x0   Characteristics:               0x42C0    
0x2744     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2748     0x8   ForwarderChain:                0x0       
0x274C     0xC   Name:                          0x4454    
0x2750     0x10  FirstThunk:                    0x40B8    

user32.dll.SendMessageA Hint[509] Bound: 0x767661E0
user32.dll.RegisterClassA Hint[480] Bound: 0x76764050
user32.dll.LoadIconA Hint[408] Bound: 0x7676BFD0
user32.dll.LoadCursorA Hint[404] Bound: 0x76782870
user32.dll.GetWindowThreadProcessId Hint[350] Bound: 0x7677CDD0
user32.dll.ShowWindow Hint[584] Bound: 0x76784B80
user32.dll.GetMessageA Hint[290] Bound: 0x76765A90
user32.dll.TranslateMessage Hint[606] Bound: 0x7677C940
user32.dll.UpdateWindow Hint[618] Bound: 0x76776C50
user32.dll.wsprintfA Hint[637] Bound: 0x7676AB70
user32.dll.GetClassNameA Hint[230] Bound: 0x76765FD0
user32.dll.EnumWindows Hint[203] Bound: 0x7676BCA0
user32.dll.CreateWindowExA Hint[86] Bound: 0x7676A8B0
user32.dll.DispatchMessageA Hint[147] Bound: 0x7676A1F0
user32.dll.DefWindowProcA Hint[131] Bound: 0x770A7D40
user32.dll.GetWindowTextA Hint[346] Bound: 0x76767CD0

[IMAGE_IMPORT_DESCRIPTOR]
0x2754     0x0   OriginalFirstThunk:            0x4218    
0x2754     0x0   Characteristics:               0x4218    
0x2758     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x275C     0x8   ForwarderChain:                0x0       
0x2760     0xC   Name:                          0x4656    
0x2764     0x10  FirstThunk:                    0x4010    

kernel32.dll.LocalAlloc Hint[496] Bound: 0x75BE0460
kernel32.dll.OpenProcess Hint[534] Bound: 0x75BE0630
kernel32.dll.SetEvent Hint[640] Bound: 0x75BE3080
kernel32.dll.LocalFree Hint[500] Bound: 0x75BDF530
kernel32.dll.OpenMutexA Hint[532] Bound: 0x75BD2E60
kernel32.dll.GetModuleHandleA Hint[308] Bound: 0x75BE0A60
kernel32.dll.WriteFile Hint[759] Bound: 0x75BE35B0
kernel32.dll.WaitForSingleObject Hint[744] Bound: 0x75BE30D0
kernel32.dll.VirtualFree Hint[731] Bound: 0x75BDF4C0
kernel32.dll.VirtualAlloc Hint[729] Bound: 0x75BDF3C0
kernel32.dll.SystemTimeToFileTime Hint[700] Bound: 0x75BE1120
kernel32.dll.Sleep Hint[695] Bound: 0x75BE0F00
kernel32.dll.CloseHandle Hint[35] Bound: 0x75BE2EE0
kernel32.dll.CreateEventA Hint[57] Bound: 0x75BE2F30
kernel32.dll.CreateFileA Hint[61] Bound: 0x75BE3130
kernel32.dll.CreateMutexA Hint[74] Bound: 0x75BE2F70
kernel32.dll.CreateThread Hint[86] Bound: 0x75BE0F10
kernel32.dll.DeleteFileA Hint[105] Bound: 0x75BE3160
kernel32.dll.ExitProcess Hint[155] Bound: 0x75BE4E10
kernel32.dll.FileTimeToSystemTime Hint[164] Bound: 0x75BE3620
kernel32.dll.GetCommandLineA Hint[230] Bound: 0x75BE1EE0
kernel32.dll.GetCommandLineW Hint[231] Bound: 0x75BE1D70
kernel32.dll.GetCurrentProcess Hint[256] Bound: 0x75BE2E80
kernel32.dll.GetCurrentProcessId Hint[257] Bound: 0x75BE2E90
kernel32.dll.GetLocalTime Hint[297] Bound: 0x75BE0B60
kernel32.dll.GetModuleFileNameA Hint[306] Bound: 0x75BE0E30
kernel32.dll.GetVolumeInformationA Hint[408] Bound: 0x75BE3430
kernel32.dll.GetProcAddress Hint[339] Bound: 0x75BDF550
kernel32.dll.GetTempPathA Hint[388] Bound: 0x75BE3410
kernel32.dll.SetFilePointer Hint[645] Bound: 0x75BE3550

[IMAGE_IMPORT_DESCRIPTOR]
0x2768     0x0   OriginalFirstThunk:            0x4208    
0x2768     0x0   Characteristics:               0x4208    
0x276C     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2770     0x8   ForwarderChain:                0x0       
0x2774     0xC   Name:                          0x46A4    
0x2778     0x10  FirstThunk:                    0x4000    

advapi32.dll.GetSidSubAuthority Hint[271] Bound: 0x768FE940
advapi32.dll.OpenProcessToken Hint[408] Bound: 0x768FE340
advapi32.dll.GetTokenInformation Hint[273] Bound: 0x768FDFA0

[IMAGE_IMPORT_DESCRIPTOR]
0x277C     0x0   OriginalFirstThunk:            0x4314    
0x277C     0x0   Characteristics:               0x4314    
0x2780     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2784     0x8   ForwarderChain:                0x0       
0x2788     0xC   Name:                          0x473A    
0x278C     0x10  FirstThunk:                    0x410C    

wsock32.dll.WSAStartup Hint[33] Bound: 0x75DF9CC0
wsock32.dll.closesocket Hint[38] Bound: 0x75DFEA60
wsock32.dll.connect Hint[39] Bound: 0x75E05710
wsock32.dll.htons Hint[53] Bound: 0x75DF56E0
wsock32.dll.ioctlsocket Hint[57] Bound: 0x75E02520
wsock32.dll.recv Hint[62] Bound: 0x72AF1E40
wsock32.dll.select Hint[67] Bound: 0x75E05E50
wsock32.dll.send Hint[68] Bound: 0x75E058A0
wsock32.dll.setsockopt Hint[71] Bound: 0x72AF13D0
wsock32.dll.shutdown Hint[72] Bound: 0x75E032B0
wsock32.dll.socket Hint[73] Bound: 0x75DFC990
wsock32.dll.WSACleanup Hint[27] Bound: 0x75DF6400

[IMAGE_IMPORT_DESCRIPTOR]
0x2790     0x0   OriginalFirstThunk:            0x42B8    
0x2790     0x0   Characteristics:               0x42B8    
0x2794     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2798     0x8   ForwarderChain:                0x0       
0x279C     0xC   Name:                          0x475C    
0x27A0     0x10  FirstThunk:                    0x40B0    

shell32.dll.CommandLineToArgvW Hint[5] Bound: 0x76B6A190

[IMAGE_IMPORT_DESCRIPTOR]
0x27A4     0x0   OriginalFirstThunk:            0x4304    
0x27A4     0x0   Characteristics:               0x4304    
0x27A8     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27AC     0x8   ForwarderChain:                0x0       
0x27B0     0xC   Name:                          0x4792    
0x27B4     0x10  FirstThunk:                    0x40FC    

ws2_32.dll.freeaddrinfo Hint[87] Bound: 0x75DF7580
ws2_32.dll.WSAIoctl Hint[40] Bound: 0x75DFF3B0
ws2_32.dll.getaddrinfo Hint[88] Bound: 0x75DFA810

[IMAGE_IMPORT_DESCRIPTOR]
0x27B8     0x0   OriginalFirstThunk:            0x4294    
0x27B8     0x0   Characteristics:               0x4294    
0x27BC     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27C0     0x8   ForwarderChain:                0x0       
0x27C4     0xC   Name:                          0x47D4    
0x27C8     0x10  FirstThunk:                    0x408C    

ole32.dll.CoUninitialize Hint[100] Bound: 0x76557F70
ole32.dll.CoInitialize Hint[56] Bound: 0x74F09BC0
ole32.dll.CoCreateInstance Hint[15] Bound: 0x7658C970

[IMAGE_IMPORT_DESCRIPTOR]
0x27CC     0x0   OriginalFirstThunk:            0x42AC    
0x27CC     0x0   Characteristics:               0x42AC    
0x27D0     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27D4     0x8   ForwarderChain:                0x0       
0x27D8     0xC   Name:                          0x4802    
0x27DC     0x10  FirstThunk:                    0x40A4    

secur32.dll.GetUserNameExA Hint[21] Bound: 0x71DDDCE0
secur32.dll.GetUserNameExW Hint[22] Bound: 0x71DDDBE0

[IMAGE_IMPORT_DESCRIPTOR]
0x27E0     0x0   OriginalFirstThunk:            0x42A4    
0x27E0     0x0   Characteristics:               0x42A4    
0x27E4     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27E8     0x8   ForwarderChain:                0x0       
0x27EC     0xC   Name:                          0x4826    
0x27F0     0x10  FirstThunk:                    0x409C    

psapi.dll.GetModuleFileNameExA Hint[14] Bound: 0x75BA16D0

----------Base relocations----------

[IMAGE_BASE_RELOCATION]
0x3400     0x0   VirtualAddress:                0x1000    
0x3404     0x4   SizeOfBlock:                   0x4C      

[IMAGE_BASE_RELOCATION]
0x344C     0x0   VirtualAddress:                0x2000    
0x3450     0x4   SizeOfBlock:                   0x7C      

[IMAGE_BASE_RELOCATION]
0x34C8     0x0   VirtualAddress:                0x3000    
0x34CC     0x4   SizeOfBlock:                   0x5C      


Signature:
 No signature

PEiD:
Error: signature database missing
Entry point:
ep:          0x00001000
ep address:  0x00401000
Section:     .text
ep offset:   0x00000400

TLS Callbacks:
 No TLS

Overlay:
 No overlay
