019850f400f5b0f7de761782029e858d
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2009-Nov-02 20:23:03 |
| Detected languages |
English - United States
|
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ 8 Microsoft Visual C++ 8.0 MSVC++ v.8 (procedure 1 recognized - h) |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | This PE is a WinZip self-extractor | Unusual section name found: _winzip_ |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Technik Markt TMA e.K.
Issuer: Sectigo Public Code Signing CA EV R36 |
| Safe | VirusTotal score: 0/71 (Scanned on 2025-04-27 16:25:09) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2009-Nov-02 20:23:03 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x12000 |
| SizeOfInitializedData | 0xa000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000A79E (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x13000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x373000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x3774dd |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x7d00 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x7d00 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
_winzip_
Imports
| SHELL32.dll |
SHGetPathFromIDListA
SHGetSpecialFolderLocation ShellExecuteA FindExecutableA SHBrowseForFolderA SHGetMalloc |
|---|---|
| USER32.dll |
GetClientRect
SetRect EndPaint LoadCursorA GetLastActivePopup KillTimer ShowWindow PostMessageA SendMessageA EnableWindow SetTimer SetWindowTextA SetForegroundWindow SetActiveWindow SetDlgItemTextA GetKeyState CharUpperBuffA PeekMessageA GetSysColor DispatchMessageA GetParent SendDlgItemMessageA GetDlgItem InvalidateRect UpdateWindow LoadStringA MessageBoxA DialogBoxParamA GetWindowLongA SetWindowLongA GetDlgItemTextA EndDialog GetWindowRect GetSystemMetrics SetWindowPos SetCursor CharNextA BeginPaint SetWindowWord GetWindowWord DefWindowProcA RegisterClassA TranslateMessage |
| KERNEL32.dll |
GetLocaleInfoA
GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetStdHandle HeapCreate HeapDestroy VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize Sleep GetCurrentThreadId SetLastError TlsFree TlsSetValue GetVersionExA FindClose FindFirstFileA GetCurrentDirectoryA SetCurrentDirectoryA CreateDirectoryA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetDriveTypeA GetEnvironmentVariableA SetFilePointer CreateFileA GetWindowsDirectoryA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime LocalFree ExitProcess FormatMessageA GetLastError GetModuleHandleA GetVolumeInformationA WideCharToMultiByte CreateProcessA lstrcmpiA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers WriteConsoleW CloseHandle RtlUnwind HeapAlloc HeapFree HeapReAlloc RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress TlsGetValue TlsAlloc |
| GDI32.dll |
SetTextColor
SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject SetBkColor |
| ADVAPI32.dll |
RegQueryValueA
|
| COMCTL32.dll |
#17
|
Delayed Imports
ADMIN_MANIFEST
1
100
400
63
64
65
66
67
126
127
1 (#2)
1 (#3)
String Table contents
| This is an incomplete self-extractor; |
| please re-create the file and try again. |
| Please insert disk %d in drive %s. |
| Please insert last disk of set in drive %s. |
| No disk or invalid disk in drive. |
| Please insert disk number %d. |
| The disk in the drive appears to be |
| missing or has an incorrect label. |
| Insert disk number %d. |
| No password specified |
| Incorrect password specified |
| NOAUTO |
| Setup |
| AUTO |
| This 32-bit self-extracting Zip file requires Windows 95, 98, NT, 2000 or XP. |
| Abort unzip operation? |
| File %s is in use by the system. Skipping ... |
| Unzip Aborted |
| Error %d running command %s |
| Error changing to "Unzip To" folder |
| File %s already exists. Overwrite file? |
| No folder specified. |
| \TEMP |
| This file is intended for use under Windows 95, 98, NT, 2000, XP or a system with compatible long filename support. |
| On the version of Windows you are currently running, any long filenames will probably be truncated and improper operation may result. |
| Continue anyway? |
| TEMP= |
| %d file(s) unzipped successfully |
| To unzip all files in %s to the specified folder press the Unzip button. |
| WinZip |
| extensions |
| When &done unzipping open: |
| This copy of WinZip Self-Extractor is NOT LICENSED for distribution. Any distribution of this file is prohibited and is a violation of US Copyright law and international treaty. |
| The registered version does not display this message. |
| WinZip not found on your system. |
| WinZip is an award-winning Windows archive utility that brings the convenience of Windows to the use of Zip files. WinZip features built-in ZIP and UNZIP and an easy to use drag-and-drop interface. Fully functional evaluation versions of WinZip are available from the WinZip web site: http://www.winzip.com |
| Can't create output file: %s |
| Unsupported compression method |
| ZIP damaged: file %s: Bad CRC. Possible cause: file transfer error. |
| Invalid ZIP header. Possible cause: file transfer error. |
| Could not create "%s" - unzip operation cancelled. |
| Error in folder name specified on the command line. |
| Unzipping %s |
| Error writing to %s. Possible cause: disk full. |
| Error reading %s. Possible cause: bad disk or file transfer error. |
| I/O error on file. Possible cause: file transfer error. |
| To unzip all files in %s press the "Unzip" button. Files will be unzipped to the folder specified in the "Unzip To Folder" field. This folder will be created if it does not exist. |
| You can also unzip this file with a standard zip utility like WinZip. |
| Zip file is damaged, truncated, or has been changed since it was created. If you downloaded this file, try downloading again. |
| %s |
| %s |
| Licensed to %s |
| NOT LICENSED FOR DISTRIBUTION OF ANY KIND |
| This self-extracting Zip file was created by a |
| registered user of WinZip Self-Extractor %s (%s) |
| WinZip(R) Self-Extractor is Copyright(c) 1995-2009 by |
| WinZip International LLC (www.winzip.com) |
| This self-extracting Zip file was created by an |
| unregistered user of WinZip Self-Extractor %s (%s) |
| WinZip(R) Self-Extractor is Copyright(c) 1995-2009 by |
| WinZip International LLC (www.winzip.com) |
| Drive %s is not a valid drive, unzip operation cancelled. |
| Cannot use command file %s |
| Windows does not have a program associated to run with it. |
| TMP= |
| Unzip to Folder: |
| TEMP |
| Zip file contains filenames longer than are allowed by |
| Windows. WinZip Self-Extractor cannot process this |
| Zip file. |
| this self-extractor file |
| The selected folder contains unsupported |
| characters, please choose a different folder. |
| Invalid command line parameter (%s). |
| WinZip Self-Extractor |
| Please save the file %s (created on your desktop) and inform WinZip Computing. |
| Internet: support@winzip.com |
| Web: http://www.winzip.com |
| Postal mail: P.O. Box 540, Mansfield, CT 06268 USA |
| WinZip Self-Extractor header corrupt. Possible cause: bad disk or file transfer error |
| not enough memory |
| WinZip internal error in file %s line %d |
| Current date/time: %02d/%02d/%04d %02d:%02d |
| Module name = %s |
| Operating System Version %d.%02d |
| Windows NT |
| Win32s |
| Windows 95/98 |
| Version %d.%d |
| Memory in use = %ld%% |
| Total physical memory = %ld Kbytes |
| Physical memory available = %ld Kbytes |
| Total virtual memory = %ld Kbytes |
| Virtual memory available = %ld Kbytes |
Version Info
TLS Callbacks
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x417420 |
| SEHandlerTable | 0x414fc0 |
| SEHandlerCount | 18 |
RICH Header
| XOR Key | 0x4d51635 |
|---|---|
| Unmarked objects | 0 |
| ASM objects (VS2012 build 50727 / VS2005 build 50727) | 19 |
| C objects (VS2012 build 50727 / VS2005 build 50727) | 112 |
| Total imports | 198 |
| Imports (VS2003 (.NET) build 4035) | 13 |
| C++ objects (VS2012 build 50727 / VS2005 build 50727) | 61 |
| Exports (VS2012 build 50727 / VS2005 build 50727) | 1 |
| Resource objects (VS2012 build 50727 / VS2005 build 50727) | 1 |
| Unmarked objects (#2) | 2 |
| Linker (VS2012 build 50727 / VS2005 build 50727) | 1 |