PE check for 'sample03.exe':
Entropy: 5.505908 (Min=0.0, Max=8.0)
MD5     hash: df8fd5e415ba533bd468e132dda4e0a6
SHA-1   hash: 4e6b0973cf795eeeae9c6b602fab4cf14ed17229
SHA-256 hash: 6e6daa421b992ea72284f7f955511d063b52f8118f37f7f41877789e1ce7d195
SHA-512 hash: 96281572be6ef525f2e995b5e137aafe9aa63213995fa6ff02a4f77a77ed654e1112c7856ed3532df0920bfa6b49b9b79c805433592f79e422a774713404ddf2
.text entropy: 5.883852 (Min=0.0, Max=8.0)
.rdata entropy: 4.219876 (Min=0.0, Max=8.0)
.data entropy: 3.311255 (Min=0.0, Max=8.0)
.reloc entropy: 3.945519 (Min=0.0, Max=8.0)
Dump Info:
----------DOS_HEADER----------

[IMAGE_DOS_HEADER]
0x0        0x0   e_magic:                       0x5A4D    
0x2        0x2   e_cblp:                        0x90      
0x4        0x4   e_cp:                          0x3       
0x6        0x6   e_crlc:                        0x0       
0x8        0x8   e_cparhdr:                     0x4       
0xA        0xA   e_minalloc:                    0x0       
0xC        0xC   e_maxalloc:                    0xFFFF    
0xE        0xE   e_ss:                          0x0       
0x10       0x10  e_sp:                          0xB8      
0x12       0x12  e_csum:                        0x0       
0x14       0x14  e_ip:                          0x0       
0x16       0x16  e_cs:                          0x0       
0x18       0x18  e_lfarlc:                      0x40      
0x1A       0x1A  e_ovno:                        0x0       
0x1C       0x1C  e_res:                         
0x24       0x24  e_oemid:                       0x0       
0x26       0x26  e_oeminfo:                     0x0       
0x28       0x28  e_res2:                        
0x3C       0x3C  e_lfanew:                      0xB8      

----------NT_HEADERS----------

[IMAGE_NT_HEADERS]
0xB8       0x0   Signature:                     0x4550    

----------FILE_HEADER----------

[IMAGE_FILE_HEADER]
0xBC       0x0   Machine:                       0x14C     
0xBE       0x2   NumberOfSections:              0x4       
0xC0       0x4   TimeDateStamp:                 0x6052FE47 [Thu Mar 18 07:16:23 2021 UTC]
0xC4       0x8   PointerToSymbolTable:          0x0       
0xC8       0xC   NumberOfSymbols:               0x0       
0xCC       0x10  SizeOfOptionalHeader:          0xE0      
0xCE       0x12  Characteristics:               0x10E     
Flags: IMAGE_FILE_32BIT_MACHINE, IMAGE_FILE_EXECUTABLE_IMAGE, IMAGE_FILE_LINE_NUMS_STRIPPED, IMAGE_FILE_LOCAL_SYMS_STRIPPED

----------OPTIONAL_HEADER----------

[IMAGE_OPTIONAL_HEADER]
0xD0       0x0   Magic:                         0x10B     
0xD2       0x2   MajorLinkerVersion:            0x5       
0xD3       0x3   MinorLinkerVersion:            0xC       
0xD4       0x4   SizeOfCode:                    0x2200    
0xD8       0x8   SizeOfInitializedData:         0x1000    
0xDC       0xC   SizeOfUninitializedData:       0x0       
0xE0       0x10  AddressOfEntryPoint:           0x1000    
0xE4       0x14  BaseOfCode:                    0x1000    
0xE8       0x18  BaseOfData:                    0x4000    
0xEC       0x1C  ImageBase:                     0x400000  
0xF0       0x20  SectionAlignment:              0x1000    
0xF4       0x24  FileAlignment:                 0x200     
0xF8       0x28  MajorOperatingSystemVersion:   0x4       
0xFA       0x2A  MinorOperatingSystemVersion:   0x0       
0xFC       0x2C  MajorImageVersion:             0x0       
0xFE       0x2E  MinorImageVersion:             0x0       
0x100      0x30  MajorSubsystemVersion:         0x4       
0x102      0x32  MinorSubsystemVersion:         0x0       
0x104      0x34  Reserved1:                     0x0       
0x108      0x38  SizeOfImage:                   0x7000    
0x10C      0x3C  SizeOfHeaders:                 0x400     
0x110      0x40  CheckSum:                      0x0       
0x114      0x44  Subsystem:                     0x2       
0x116      0x46  DllCharacteristics:            0x0       
0x118      0x48  SizeOfStackReserve:            0x100000  
0x11C      0x4C  SizeOfStackCommit:             0x1000    
0x120      0x50  SizeOfHeapReserve:             0x100000  
0x124      0x54  SizeOfHeapCommit:              0x1000    
0x128      0x58  LoaderFlags:                   0x0       
0x12C      0x5C  NumberOfRvaAndSizes:           0x10      
DllCharacteristics: 

----------PE Sections----------

[IMAGE_SECTION_HEADER]
0x1B0      0x0   Name:                          .text
0x1B8      0x8   Misc:                          0x20F6    
0x1B8      0x8   Misc_PhysicalAddress:          0x20F6    
0x1B8      0x8   Misc_VirtualSize:              0x20F6    
0x1BC      0xC   VirtualAddress:                0x1000    
0x1C0      0x10  SizeOfRawData:                 0x2200    
0x1C4      0x14  PointerToRawData:              0x400     
0x1C8      0x18  PointerToRelocations:          0x0       
0x1CC      0x1C  PointerToLinenumbers:          0x0       
0x1D0      0x20  NumberOfRelocations:           0x0       
0x1D2      0x22  NumberOfLinenumbers:           0x0       
0x1D4      0x24  Characteristics:               0x60000020
Flags: IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Entropy: 5.883852 (Min=0.0, Max=8.0)
MD5     hash: 122e535ee64716dd245a64c7ca8af734
SHA-1   hash: d4f08a63c4bc38f275a9a328f809b4547216f548
SHA-256 hash: deeaadc0470549e5d75604217a2e09a554195898d1020e609279d15009fa04ef
SHA-512 hash: 7e8f4cb538f14e90d19f1b4e34b6887724d42b2fe41079c45c37b7abc8bc9a6cd0b3a47e81ebb6fda8ad1913126cd674f0743ab7c66f33a3724c0acd700d0f8d

[IMAGE_SECTION_HEADER]
0x1D8      0x0   Name:                          .rdata
0x1E0      0x8   Misc:                          0x830     
0x1E0      0x8   Misc_PhysicalAddress:          0x830     
0x1E0      0x8   Misc_VirtualSize:              0x830     
0x1E4      0xC   VirtualAddress:                0x4000    
0x1E8      0x10  SizeOfRawData:                 0xA00     
0x1EC      0x14  PointerToRawData:              0x2600    
0x1F0      0x18  PointerToRelocations:          0x0       
0x1F4      0x1C  PointerToLinenumbers:          0x0       
0x1F8      0x20  NumberOfRelocations:           0x0       
0x1FA      0x22  NumberOfLinenumbers:           0x0       
0x1FC      0x24  Characteristics:               0x40000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Entropy: 4.219876 (Min=0.0, Max=8.0)
MD5     hash: af34779d0eb6ce52086e14d75d0fc401
SHA-1   hash: 807021e0546a3347eab6fbf27064d5cc7e07825e
SHA-256 hash: aa1cb8315e20d97b7fa19cb4c31df245ee69bf106a839167454dea5ccb452810
SHA-512 hash: 2a538c40a90ab76d6b34059e5a95d50fadfee8817be0484e44c44ac908ee55fecdc3fff8cd91317e173969eb15381d03fa189ac8b26b3d45d1b9deb27d1c48e6

[IMAGE_SECTION_HEADER]
0x200      0x0   Name:                          .data
0x208      0x8   Misc:                          0x240     
0x208      0x8   Misc_PhysicalAddress:          0x240     
0x208      0x8   Misc_VirtualSize:              0x240     
0x20C      0xC   VirtualAddress:                0x5000    
0x210      0x10  SizeOfRawData:                 0x400     
0x214      0x14  PointerToRawData:              0x3000    
0x218      0x18  PointerToRelocations:          0x0       
0x21C      0x1C  PointerToLinenumbers:          0x0       
0x220      0x20  NumberOfRelocations:           0x0       
0x222      0x22  NumberOfLinenumbers:           0x0       
0x224      0x24  Characteristics:               0xC0000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Entropy: 3.311255 (Min=0.0, Max=8.0)
MD5     hash: 990738db800d8c89d83cf8ee02f21fe3
SHA-1   hash: 43a10a94cee1c46aa135c290bb150a0b826e34db
SHA-256 hash: 876c8891dea39ed7e6e387f28d1c8a6aac4e04efca522d5c573c3b6e8c37e25b
SHA-512 hash: 3124bb2616de33eb0e6f190a4f0dc93bec1cea16d1bf09bf5fc2824ce3fb0de67f82f17512c173ca26ae1de7a35e02a5b4d7377379b3578a530672d231015e93

[IMAGE_SECTION_HEADER]
0x228      0x0   Name:                          .reloc
0x230      0x8   Misc:                          0x182     
0x230      0x8   Misc_PhysicalAddress:          0x182     
0x230      0x8   Misc_VirtualSize:              0x182     
0x234      0xC   VirtualAddress:                0x6000    
0x238      0x10  SizeOfRawData:                 0x200     
0x23C      0x14  PointerToRawData:              0x3400    
0x240      0x18  PointerToRelocations:          0x0       
0x244      0x1C  PointerToLinenumbers:          0x0       
0x248      0x20  NumberOfRelocations:           0x0       
0x24A      0x22  NumberOfLinenumbers:           0x0       
0x24C      0x24  Characteristics:               0x42000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
Entropy: 3.945519 (Min=0.0, Max=8.0)
MD5     hash: 4fd5b23d779975cd2fd563800cc7a057
SHA-1   hash: a90f0a9a5226e1b945c78380ae3096130e98b604
SHA-256 hash: 2e70c1df01ee461577f44f5057ca34fdd1e9c6642e38fd14cc355d33bd44c7f6
SHA-512 hash: 5c15609b64d169dfeca7a00af1a06be3e522d6d4ff2913d02570b7ac183c4672eebe05cf3ae9338d9f6a5d05bb917855b9b6a5fd4f85ee607126c64c1b8d5a68

----------Directories----------

[IMAGE_DIRECTORY_ENTRY_EXPORT]
0x130      0x0   VirtualAddress:                0x0       
0x134      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_IMPORT]
0x138      0x0   VirtualAddress:                0x4140    
0x13C      0x4   Size:                          0xC8      
[IMAGE_DIRECTORY_ENTRY_RESOURCE]
0x140      0x0   VirtualAddress:                0x0       
0x144      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_EXCEPTION]
0x148      0x0   VirtualAddress:                0x0       
0x14C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_SECURITY]
0x150      0x0   VirtualAddress:                0x0       
0x154      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_BASERELOC]
0x158      0x0   VirtualAddress:                0x6000    
0x15C      0x4   Size:                          0x124     
[IMAGE_DIRECTORY_ENTRY_DEBUG]
0x160      0x0   VirtualAddress:                0x0       
0x164      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_COPYRIGHT]
0x168      0x0   VirtualAddress:                0x0       
0x16C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_GLOBALPTR]
0x170      0x0   VirtualAddress:                0x0       
0x174      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_TLS]
0x178      0x0   VirtualAddress:                0x0       
0x17C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG]
0x180      0x0   VirtualAddress:                0x0       
0x184      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT]
0x188      0x0   VirtualAddress:                0x0       
0x18C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_IAT]
0x190      0x0   VirtualAddress:                0x4000    
0x194      0x4   Size:                          0x140     
[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]
0x198      0x0   VirtualAddress:                0x0       
0x19C      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]
0x1A0      0x0   VirtualAddress:                0x0       
0x1A4      0x4   Size:                          0x0       
[IMAGE_DIRECTORY_ENTRY_RESERVED]
0x1A8      0x0   VirtualAddress:                0x0       
0x1AC      0x4   Size:                          0x0       

----------Imported symbols----------

[IMAGE_IMPORT_DESCRIPTOR]
0x2740     0x0   OriginalFirstThunk:            0x42C0    
0x2740     0x0   Characteristics:               0x42C0    
0x2744     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2748     0x8   ForwarderChain:                0x0       
0x274C     0xC   Name:                          0x4454    
0x2750     0x10  FirstThunk:                    0x40B8    

user32.dll.SendMessageA Hint[509]
user32.dll.RegisterClassA Hint[480]
user32.dll.LoadIconA Hint[408]
user32.dll.LoadCursorA Hint[404]
user32.dll.GetWindowThreadProcessId Hint[350]
user32.dll.ShowWindow Hint[584]
user32.dll.GetMessageA Hint[290]
user32.dll.TranslateMessage Hint[606]
user32.dll.UpdateWindow Hint[618]
user32.dll.wsprintfA Hint[637]
user32.dll.GetClassNameA Hint[230]
user32.dll.EnumWindows Hint[203]
user32.dll.CreateWindowExA Hint[86]
user32.dll.DispatchMessageA Hint[147]
user32.dll.DefWindowProcA Hint[131]
user32.dll.GetWindowTextA Hint[346]

[IMAGE_IMPORT_DESCRIPTOR]
0x2754     0x0   OriginalFirstThunk:            0x4218    
0x2754     0x0   Characteristics:               0x4218    
0x2758     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x275C     0x8   ForwarderChain:                0x0       
0x2760     0xC   Name:                          0x4656    
0x2764     0x10  FirstThunk:                    0x4010    

kernel32.dll.LocalAlloc Hint[496]
kernel32.dll.OpenProcess Hint[534]
kernel32.dll.SetEvent Hint[640]
kernel32.dll.LocalFree Hint[500]
kernel32.dll.OpenMutexA Hint[532]
kernel32.dll.GetModuleHandleA Hint[308]
kernel32.dll.WriteFile Hint[759]
kernel32.dll.WaitForSingleObject Hint[744]
kernel32.dll.VirtualFree Hint[731]
kernel32.dll.VirtualAlloc Hint[729]
kernel32.dll.SystemTimeToFileTime Hint[700]
kernel32.dll.Sleep Hint[695]
kernel32.dll.CloseHandle Hint[35]
kernel32.dll.CreateEventA Hint[57]
kernel32.dll.CreateFileA Hint[61]
kernel32.dll.CreateMutexA Hint[74]
kernel32.dll.CreateThread Hint[86]
kernel32.dll.DeleteFileA Hint[105]
kernel32.dll.ExitProcess Hint[155]
kernel32.dll.FileTimeToSystemTime Hint[164]
kernel32.dll.GetCommandLineA Hint[230]
kernel32.dll.GetCommandLineW Hint[231]
kernel32.dll.GetCurrentProcess Hint[256]
kernel32.dll.GetCurrentProcessId Hint[257]
kernel32.dll.GetLocalTime Hint[297]
kernel32.dll.GetModuleFileNameA Hint[306]
kernel32.dll.GetVolumeInformationA Hint[408]
kernel32.dll.GetProcAddress Hint[339]
kernel32.dll.GetTempPathA Hint[388]
kernel32.dll.SetFilePointer Hint[645]

[IMAGE_IMPORT_DESCRIPTOR]
0x2768     0x0   OriginalFirstThunk:            0x4208    
0x2768     0x0   Characteristics:               0x4208    
0x276C     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2770     0x8   ForwarderChain:                0x0       
0x2774     0xC   Name:                          0x46A4    
0x2778     0x10  FirstThunk:                    0x4000    

advapi32.dll.GetSidSubAuthority Hint[271]
advapi32.dll.OpenProcessToken Hint[408]
advapi32.dll.GetTokenInformation Hint[273]

[IMAGE_IMPORT_DESCRIPTOR]
0x277C     0x0   OriginalFirstThunk:            0x4314    
0x277C     0x0   Characteristics:               0x4314    
0x2780     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2784     0x8   ForwarderChain:                0x0       
0x2788     0xC   Name:                          0x473A    
0x278C     0x10  FirstThunk:                    0x410C    

wsock32.dll.WSAStartup Hint[33]
wsock32.dll.closesocket Hint[38]
wsock32.dll.connect Hint[39]
wsock32.dll.htons Hint[53]
wsock32.dll.ioctlsocket Hint[57]
wsock32.dll.recv Hint[62]
wsock32.dll.select Hint[67]
wsock32.dll.send Hint[68]
wsock32.dll.setsockopt Hint[71]
wsock32.dll.shutdown Hint[72]
wsock32.dll.socket Hint[73]
wsock32.dll.WSACleanup Hint[27]

[IMAGE_IMPORT_DESCRIPTOR]
0x2790     0x0   OriginalFirstThunk:            0x42B8    
0x2790     0x0   Characteristics:               0x42B8    
0x2794     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x2798     0x8   ForwarderChain:                0x0       
0x279C     0xC   Name:                          0x475C    
0x27A0     0x10  FirstThunk:                    0x40B0    

shell32.dll.CommandLineToArgvW Hint[5]

[IMAGE_IMPORT_DESCRIPTOR]
0x27A4     0x0   OriginalFirstThunk:            0x4304    
0x27A4     0x0   Characteristics:               0x4304    
0x27A8     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27AC     0x8   ForwarderChain:                0x0       
0x27B0     0xC   Name:                          0x4792    
0x27B4     0x10  FirstThunk:                    0x40FC    

ws2_32.dll.freeaddrinfo Hint[87]
ws2_32.dll.WSAIoctl Hint[40]
ws2_32.dll.getaddrinfo Hint[88]

[IMAGE_IMPORT_DESCRIPTOR]
0x27B8     0x0   OriginalFirstThunk:            0x4294    
0x27B8     0x0   Characteristics:               0x4294    
0x27BC     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27C0     0x8   ForwarderChain:                0x0       
0x27C4     0xC   Name:                          0x47D4    
0x27C8     0x10  FirstThunk:                    0x408C    

ole32.dll.CoUninitialize Hint[100]
ole32.dll.CoInitialize Hint[56]
ole32.dll.CoCreateInstance Hint[15]

[IMAGE_IMPORT_DESCRIPTOR]
0x27CC     0x0   OriginalFirstThunk:            0x42AC    
0x27CC     0x0   Characteristics:               0x42AC    
0x27D0     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27D4     0x8   ForwarderChain:                0x0       
0x27D8     0xC   Name:                          0x4802    
0x27DC     0x10  FirstThunk:                    0x40A4    

secur32.dll.GetUserNameExA Hint[21]
secur32.dll.GetUserNameExW Hint[22]

[IMAGE_IMPORT_DESCRIPTOR]
0x27E0     0x0   OriginalFirstThunk:            0x42A4    
0x27E0     0x0   Characteristics:               0x42A4    
0x27E4     0x4   TimeDateStamp:                 0x0        [Thu Jan  1 00:00:00 1970 UTC]
0x27E8     0x8   ForwarderChain:                0x0       
0x27EC     0xC   Name:                          0x4826    
0x27F0     0x10  FirstThunk:                    0x409C    

psapi.dll.GetModuleFileNameExA Hint[14]

----------Base relocations----------

[IMAGE_BASE_RELOCATION]
0x3400     0x0   VirtualAddress:                0x1000    
0x3404     0x4   SizeOfBlock:                   0x4C      

[IMAGE_BASE_RELOCATION]
0x344C     0x0   VirtualAddress:                0x2000    
0x3450     0x4   SizeOfBlock:                   0x7C      

[IMAGE_BASE_RELOCATION]
0x34C8     0x0   VirtualAddress:                0x3000    
0x34CC     0x4   SizeOfBlock:                   0x5C      


Signature:
 No signature

PEiD:
Error: signature database missing
Entry point:
ep:          0x00001000
ep address:  0x00401000
Section:     .text
ep offset:   0x00000400

TLS Callbacks:
 No TLS

Overlay:
 No overlay
