019df3f12fef7e757a4a4e92d43244e9
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Mar-18 02:34:22 |
| Detected languages |
English - United States
|
| Debug artifacts |
d:\dbs\el\jan\Target\x64\ship\postc2r\x-none\winword.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Word |
| FileVersion | 16.0.13801.20360 |
| InternalName | WinWord |
| LegalTrademarks1 | Microsoft® is a registered trademark of Microsoft Corporation. |
| LegalTrademarks2 | Windows® is a registered trademark of Microsoft Corporation. |
| OriginalFilename | WinWord.exe |
| ProductName | Microsoft Office |
| ProductVersion | 16.0.13801.20360 |
Plugin Output
| Suspicious | The PE is possibly packed. |
Unusual section name found: .didat
Unusual section name found: .c2r |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 96.8216% of the executable. |
| Info | The PE is digitally signed. |
Signer: Microsoft Corporation
Issuer: Microsoft Code Signing PCA 2010 |
| Safe | VirusTotal score: 0/68 (Scanned on 2021-03-24 08:06:01) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x108 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2021-Mar-18 02:34:22 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x3c00 |
| SizeOfInitializedData | 0x1d7c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000001680 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.1 |
| ImageVersion | A.0 |
| SubsystemVersion | 6.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1e2000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x1ea38c |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.didat
.c2r
.rsrc
.reloc
Imports
| AppVIsvSubsystems64.dll |
#1
|
|---|---|
| ADVAPI32.dll |
RegQueryValueExW
RegOpenKeyExW RegSetValueExW RegCloseKey RegGetValueW |
| KERNEL32.dll |
RtlLookupFunctionEntry
CreateMutexW WaitForSingleObject GetCurrentThreadId ReleaseMutex SuspendThread ResumeThread CreateEventW CloseHandle CreateThread GetThreadContext OpenThread GetSystemDirectoryW GetLastError GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW GetCurrentProcessId GetFileAttributesW GetModuleHandleExW RtlCaptureContext UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlVirtualUnwind LoadLibraryExA VirtualQuery GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException GetSystemInfo VirtualProtect IsProcessorFeaturePresent QueryPerformanceCounter |
| VCRUNTIME140_1.dll |
__CxxFrameHandler4
|
| VCRUNTIME140.dll |
__current_exception_context
memmove __current_exception __C_specific_handler wcsrchr __std_exception_copy __std_exception_destroy _CxxThrowException memset |
| MSVCP140.dll |
_Query_perf_counter
_Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ |
| api-ms-win-crt-utility-l1-1-0.dll |
rand
srand |
| api-ms-win-crt-stdio-l1-1-0.dll |
__stdio_common_vsnwprintf_s
_set_fmode __stdio_common_vswprintf_s __p__commode |
| api-ms-win-crt-time-l1-1-0.dll |
_time64
|
| api-ms-win-crt-heap-l1-1-0.dll |
malloc
free _set_new_mode |
| api-ms-win-crt-runtime-l1-1-0.dll |
_crt_atexit
_initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _c_exit _cexit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _set_app_type _seh_filter_exe |
| api-ms-win-crt-string-l1-1-0.dll |
_stricmp
wcsncpy_s wcsncat_s |
| api-ms-win-crt-math-l1-1-0.dll |
__setusermatherr
|
| api-ms-win-crt-locale-l1-1-0.dll |
__initialize_lconv_for_unsigned_char
_configthreadlocale |
| Mso20Win32Client.dll (delay-loaded) |
#1110
|
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | Mso20Win32Client.dll |
| ModuleHandle | 0x8328 |
| DelayImportAddressTable | 0xa000 |
| DelayImportNameTable | 0x6218 |
| BoundDelayImportTable | 0 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
DllGetLCID
| Ordinal | 1 |
|---|---|
| Address | 0x6191 |
| ForwardName | MSO.DllGetLCID |
MICROSOFTEDPENLIGHTENEDAPPINFO
MICROSOFTEDPPERMISSIVEAPPINFO
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
1 (#2)
2 (#2)
4 (#2)
5 (#2)
6 (#2)
7 (#2)
8 (#2)
9 (#2)
12 (#2)
13 (#2)
14 (#2)
15 (#2)
16 (#2)
17 (#2)
18 (#2)
19 (#2)
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 16.0.13801.20360 |
| ProductVersion | 16.0.13801.20360 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Word |
| FileVersion (#2) | 16.0.13801.20360 |
| InternalName | WinWord |
| LegalTrademarks1 | Microsoft® is a registered trademark of Microsoft Corporation. |
| LegalTrademarks2 | Windows® is a registered trademark of Microsoft Corporation. |
| OriginalFilename | WinWord.exe |
| ProductName | Microsoft Office |
| ProductVersion (#2) | 16.0.13801.20360 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-18 02:34:22 |
| Version | 0.0 |
| SizeofData | 280 |
| AddressOfRawData | 0x6f00 |
| PointerToRawData | 0x5f00 |
| Referenced File | d:\dbs\el\jan\Target\x64\ship\postc2r\x-none\winword.pdb |
IMAGE_DEBUG_TYPE_RESERVED
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2021-Mar-18 02:34:22 |
| Version | 576.29714 |
| SizeofData | 4 |
| AddressOfRawData | 0x7018 |
| PointerToRawData | 0x6018 |
TLS Callbacks
Load Configuration
| Size | 0x130 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140008010 |
| GuardCFCheckFunctionPointer | 5368731152 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |
RICH Header
| XOR Key | 0x9f065f4d |
|---|---|
| Unmarked objects | 0 |
| Imports (VS2008 SP1 build 30729) | 16 |
| Imports (VS2019 Update 7 (16.7.1) compiler 29111) | 6 |
| C++ objects (VS2019 Update 7 (16.7.1) compiler 29111) | 27 |
| C objects (VS2019 Update 7 (16.7.1) compiler 29111) | 10 |
| ASM objects (VS2019 Update 7 (16.7.1) compiler 29111) | 3 |
| Imports (27412) | 5 |
| Total imports | 110 |
| C++ objects (29114) | 1 |
| 270 (29114) | 5 |
| Exports (29114) | 1 |
| Resource objects (29114) | 1 |
| 151 | 2 |
| Linker (29114) | 1 |