0694046257925cc87f35b372023f429d6c20d7021b02ac0886d35db4665391a7

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages English - United States
Russian - Russia
Comments
CompanyName tgjiitejioyekpgwlrpkbotrjbo
FileDescription tgjiitejioyekpgwlrpkbotrjbo tgjiitejioyekpgwlrpkbotrjbo Inst
FileVersion tgjiitejioyekpgwlrpk
LegalCopyright tgjiitejioyekpgwlrpkbotrjbo

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to security software:
  • rshell.exe
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • gmail.com
  • https://ghost-new-live.ink
  • mail.versio.nl
  • okbm-bus.nl
  • versio.nl
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • FindWindowA
 Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
 Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
  • RegSetValueExA
  • RegQueryInfoKeyA
  • RegEnumKeyExA
  • RegCreateKeyExA
 Possibly launches other programs:
  • WinExec
  • ShellExecuteA
 Can create temporary files:
  • GetTempPathA
  • CreateFileA
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Manipulates other processes:
  • OpenProcess
 Can take screenshots:
  • CreateCompatibleDC
  • BitBlt
  • GetDCEx
  • GetDC
  • FindWindowA
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2011-Dec-13 00:00:22
Suspicious The file contains overlay data. 1504417 bytes of data starting at offset 0x41400.
The overlay data has an entropy of 7.99675 and is possibly compressed or encrypted.
Overlay data amounts for 84.9147% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 04edb6f92c80d88f3750de7bdf2f211d 🔍
SHA1 cb5f59bbed8d2d88acd4c83a1c8de023685a41be 🔍
SHA256 0694046257925cc87f35b372023f429d6c20d7021b02ac0886d35db4665391a7 🔍
SHA3 e662d9e6041a3e7c87b51d9761134398c704da5516c3680bfc57b65fede7154c 🔍
SSDeep 24576:oAT8QE+kMfkQlRdzJl7Wy91Hse3vxAghb8iEC2IdWPKgRBTbXs3+NBtc/Ll4q:oAI+bl/zJJ9F1AghvEC9W7FQ32bc5 🔍
Imports Hash b28ee14bfd2d9cf0dd7828bad72ca488 🔍

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x24600
SizeOfInitializedData 0x1ca00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00025468 (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0x26000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x48000
SizeOfHeaders 0x400
Checksum 0x4b473
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 5e14e4ede2e2215bc7d72837b9871f8f 🔍
SHA1 b23023c88b9130efa688c77a0d24e6a2c423fab6 🔍
SHA256 75656197ad5cd8fbf10851b56fe7b1118383ce2fe69e9ba2e0eb86ee62833d3d 🔍
SHA3 d921e73fd7b3b6b81d0aadf66e63f2299ca3b2c191217e6c371ee64d0ba30162 🔍
VirtualSize 0x244cc
VirtualAddress 0x1000
SizeOfRawData 0x24600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.59443

DATA

MD5 abafcbfbd7f8ac0226ca496a92a0cf06 🔍
SHA1 e6d34e556463e08e8b1c5b5cbb9967c3c662c029 🔍
SHA256 1706c98e15f709d9343227787f451017d335ab86c060c7cbbb5cf12170f4e54d 🔍
SHA3 99ba741825583169851f5fc2106947193c1021ddc956a8bf921c453b2ee93673 🔍
VirtualSize 0x2894
VirtualAddress 0x26000
SizeOfRawData 0x2a00
PointerToRawData 0x24a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.79376

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x10f5
VirtualAddress 0x29000
SizeOfRawData 0
PointerToRawData 0x27400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 a4e0ac39d5ed487ceea059fa23dfce5e 🔍
SHA1 57dbb9ad99992432dba6a1ca14ffddf7780ddf98 🔍
SHA256 1589bb39ca35524604119bfedf88a265c1790f280ec5dd58ce279b57d7b38d37 🔍
SHA3 bf789146bda84ea8224c271684b7f3b296b735439a77559febe69cd7d78171f9 🔍
VirtualSize 0x1798
VirtualAddress 0x2b000
SizeOfRawData 0x1800
PointerToRawData 0x27400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.88555

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8
VirtualAddress 0x2d000
SizeOfRawData 0
PointerToRawData 0x28c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 c4fdd0c5c9efb616fcc85d66056ca490 🔍
SHA1 7d9ccb6391020266050c96487449a1aadfbe589d 🔍
SHA256 47fb5182ffc61caf80b51da5ccc9690af4db7850e9606940aa64090eebb0561f 🔍
SHA3 e73ffc12e5d80d115e474806fa706823f53afebd7eb00e88f4d4c7917059f51e 🔍
VirtualSize 0x18
VirtualAddress 0x2e000
SizeOfRawData 0x200
PointerToRawData 0x28c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 0.204488

.reloc

MD5 867a1120317d51734587a74f6ee70016 🔍
SHA1 4d98e9a5cd438d32008aa2db9c2af8f5714c89fd 🔍
SHA256 4bfa53f467e9ba6e24b464f4752e9b753fe097cfafc81796a450acc5bf3a8bd2 🔍
SHA3 739b765ee273d2e256360c45444e6e24c2c66a9164e4d6d331eae0dd622a393e 🔍
VirtualSize 0x1884
VirtualAddress 0x2f000
SizeOfRawData 0x1a00
PointerToRawData 0x28e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 6.58665

.rsrc

MD5 04c7caf00b70884a12a033cfb5b9f6da 🔍
SHA1 6ca18b5c3d2955dd06390b05498b0889e7c6dcb7 🔍
SHA256 adc8503b8c4e566dd6cd11f64e9b1868d5f76f0cb83c495078da47773af39686 🔍
SHA3 a9180e5eb773cc4f46ea35b4037ddbc2ac35c34aab290dc76d69bc9683d335a8 🔍
VirtualSize 0x16b0c
VirtualAddress 0x31000
SizeOfRawData 0x16c00
PointerToRawData 0x2a800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 5.149

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll GetKeyboardType
MessageBoxA
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll SysFreeString
SysReAllocStringLen
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll (#3) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
gdi32.dll StretchDIBits
StretchBlt
SetWindowOrgEx
SetTextColor
SetStretchBltMode
SetRectRgn
SetROP2
SetPixel
SetDIBits
SetBrushOrgEx
SetBkMode
SetBkColor
SelectObject
SaveDC
RestoreDC
OffsetRgn
MoveToEx
IntersectClipRect
GetStockObject
GetPixel
GetDIBits
ExtSelectClipRgn
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CombineRgn
BitBlt
user32.dll (#2) GetKeyboardType
MessageBoxA
winmm.dll timeKillEvent
timeSetEvent
oleaut32.dll (#2) SysFreeString
SysReAllocStringLen
ole32.dll OleInitialize
comctl32.dll ImageList_Draw
ImageList_SetBkColor
ImageList_Create
InitCommonControls
shell32.dll SHGetFileInfoA
user32.dll (#3) GetKeyboardType
MessageBoxA
gdi32.dll (#2) StretchDIBits
StretchBlt
SetWindowOrgEx
SetTextColor
SetStretchBltMode
SetRectRgn
SetROP2
SetPixel
SetDIBits
SetBrushOrgEx
SetBkMode
SetBkColor
SelectObject
SaveDC
RestoreDC
OffsetRgn
MoveToEx
IntersectClipRect
GetStockObject
GetPixel
GetDIBits
ExtSelectClipRgn
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CombineRgn
BitBlt
kernel32.dll (#4) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32.dll (#3) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32.dll (#2) SHGetFileInfoA
cabinet.dll FDIDestroy
FDICopy
FDICreate
ole32.dll (#2) OleInitialize
shell32.dll (#3) SHGetFileInfoA

Delayed Imports

50

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.64628
MD5 4c9ef6ba5c27c3671528c9d7977e7e21 🔍
SHA1 be72764df773729ee30bad3f3da73930a7b6e191 🔍
SHA256 1558b6fa82f4febcd26a16bf85ec14efd0415bfdfc3e62fc553ffb0e393e66b6 🔍
SHA3 11ec2210b5992005410da61eae91fd0d1c12355b50a4d8c0b66be870e4ac5b3d 🔍

51

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.50231
MD5 c20a9f5032e27e98a05245f170a5af30 🔍
SHA1 eec09dd3315a4b376430e00eb0a9de8f7ebf64d5 🔍
SHA256 68ea467d120c489218a4f577a56d1a63c29b69e61cad9414187efc530a6f9574 🔍
SHA3 718571664c9db38572159eaa27e94fa17cb889424495d6c19cfecb8e3f32eafd 🔍

52

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.75127
MD5 1c9246602b1441baa5c3e6966f98fa2d 🔍
SHA1 ade879f71eb3db9de0849eeaa695f12aa8fd2654 🔍
SHA256 6e880cebe4524919d7d713cd0320366167164ea4c96a4a0a89f3b6fb56d9842f 🔍
SHA3 7706c343a7e2a2ab3fee7d5da857b7bfb1f0c20994cb23d40ec6870e889b5bbf 🔍

53

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.81591
MD5 29c78868c396d4195d468f1d9e966b08 🔍
SHA1 9cc95e73228aa613954adbbca67eb0939b85a82a 🔍
SHA256 24b397abb07dc9cdd702c2679716f130472a89fcfcea482fc93dfced4b9f7fbf 🔍
SHA3 9d2a83f8fc5d5f0a397d2c34a651b2114862a60878dc4c2f466cf46e2fb6e594 🔍

54

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31637
MD5 778bc89ff9af1bc1e3804bfa48e0bcb5 🔍
SHA1 5fd1195ebb78722583093d23d26874e30f136fbf 🔍
SHA256 3b639db1da296f9f2396191b178a8e13607f0e82bc350f0305fcd35b052d0566 🔍
SHA3 6f7a3d5ec572600801400d2446101e15ac0565297a4be70deb17f0a0be9a6fda 🔍

55

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.59265
MD5 87d3083bdefd232524b1e5d9829aac31 🔍
SHA1 643368f3d45aae757171a567a0aded825cd47af2 🔍
SHA256 28129d43e0c99ad00642556ac8da4aff48c9f18eaf6451cc58acdf10b69f79b9 🔍
SHA3 2dcaf1824eb5b7057bbbcbfac02ce475802ce2b08c2f1b7c0722aaaa86f4894d 🔍

56

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.82315
MD5 7255b08a214e66702295ef6427919bde 🔍
SHA1 bda1bbe7202c7594fe8d8ef65b8fc2bfde11c911 🔍
SHA256 0b9c53e702e613b5a0e5077b746e442fb2ef3692101aed48fa824808bd30d67a 🔍
SHA3 7f33ba0157f403cbf49cc1b3f253d04e7f79e5d715f57be5eb5ae6f6484545cd 🔍

DVCLAL

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x10
TimeDateStamp 2011-Dec-13 00:00:22
Entropy 4
MD5 d8090aba7197fbf9c7e2631c750965a8 🔍
SHA1 04f73efb0801b18f6984b14cd057fb56519cd31b 🔍
SHA256 88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610 🔍
SHA3 a5a67ad8166061d38fc75cfb2c227911de631166c6531a6664cd49cfb207e8bb 🔍

PACKAGEINFO

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x110
TimeDateStamp 2011-Dec-13 00:00:22
Entropy 5.28362
MD5 fbba41fa21bdd3ce99d0268d577f352a 🔍
SHA1 5a87423f2d852d431478881c160c6c7f6262d5df 🔍
SHA256 0d9a7ca2193a69f7048c46748a3e98e7e101bda4e5bbe903858539e20ffed78d 🔍
SHA3 9bfadc055ec99191e78759bd6ce0a3f29cfed82fb137210895ec1c38eb38402b 🔍

MAINICON

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92956
Detected Filetype Icon file
MD5 9c0b1b6fe7a63b568eb719d49e12fbb5 🔍
SHA1 baf4ff0e72de563083b082c857bc45647d625dd5 🔍
SHA256 1938ed8520b793cfd09b7f5e809f39779fc6dcad39d617e951f6bb19c2d33fda 🔍
SHA3 bfe467b4b0f8f32336ee840fc84981f230fa69672c2150e41fe1fc3e0bccbaeb 🔍

1

Type RT_VERSION
Language Russian - Russia
Codepage UNKNOWN
Size 0x374
TimeDateStamp 2011-Dec-13 00:00:22
Entropy 3.00085
MD5 81def5f1ec2235f92fd2232aeb51da83 🔍
SHA1 9ac5bb7e081cca8e4644846763d71fff08d7fb44 🔍
SHA256 d929850f046416ed7856eac46fd801777417ec7201a5786e78de6d3418da00f1 🔍
SHA3 812bda4a62e8723e05498aa5fc743efda42844492181b4d142c6521db7dffa5a 🔍

1 (#2)

Type RT_MANIFEST
Language Russian - Russia
Codepage UNKNOWN
Size 0x376
TimeDateStamp 2011-Dec-13 00:00:22
Entropy 4.93923
MD5 609957cfd6c1674f59c260b2da0a2a72 🔍
SHA1 2949d33d30c03887a101ebefca1db917f1d2bac7 🔍
SHA256 1e9cffb6544cb40c042cf9413e0481026699ef5f8e74613293bd60ae098f3c09 🔍
SHA3 413f25170a49ac4d961ec8a798af1da7800fb4d2db8734d4172695e4a2ebc823 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments
CompanyName tgjiitejioyekpgwlrpkbotrjbo
FileDescription tgjiitejioyekpgwlrpkbotrjbo tgjiitejioyekpgwlrpkbotrjbo Inst
FileVersion (#2) tgjiitejioyekpgwlrpk
LegalCopyright tgjiitejioyekpgwlrpkbotrjbo
Resource LangID Russian - Russia

TLS Callbacks

StartAddressOfRawData 0x42d000
EndAddressOfRawData 0x42d008
AddressOfIndex 0x42608c
AddressOfCallbacks 0x42e010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section BSS has a size of 0! [*] Warning: Section .tls has a size of 0!
Leave a comment

No comments yet.