070798e224b8e025f19c6839c2011e522692b813a045fed6848f9cc87d6330a3

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-19 20:38:47
Detected languages English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Can access the registry:
  • RegEnumValueW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegCreateKeyExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: InPvP Inc
Issuer: Microsoft ID Verified CS EOC CA 04
Suspicious VirusTotal score: 1/71 (Scanned on 2026-08-18 12:42:44) VBA32: Trojan.Win32.Generic

Hashes

MD5 770ed1e6d3fa2e9ae3467482b3567277 🔍
SHA1 da93d1c6e1ce05971c29bab7b5721a880ca9fa70 🔍
SHA256 070798e224b8e025f19c6839c2011e522692b813a045fed6848f9cc87d6330a3 🔍
SHA3 c036f8d6cd4c1f095f289fe725fc0796a16a4f7ffdab52ca2416c547111a6c33 🔍
SSDeep 98304:uvuHiNj4jrdTJCBuqMmw4h9niv2WxHaL5sTzz:uHNUdgx3niO5e 🔍
Imports Hash 46ce5c12b293febbeb513b196aa7f843 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2026-Apr-19 20:38:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6800
SizeOfInitializedData 0x22200
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x0000369F (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xb0000
SizeOfHeaders 0x400
Checksum 0x35cbfe
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 295c61b0e67fadb8bb65aa7730c5b490 🔍
SHA1 da82febabd04d2fa10614fe28fada1311840dc2d 🔍
SHA256 d87ff7d8bd1e93a341b9858454df95bf3dde0f6f92702c668de2425ac69eea7c 🔍
SHA3 43518a4df3ff70f8547dd8d4b985a7de31da3ebf17e20a65ed9bc081000ce375 🔍
VirtualSize 0x671e
VirtualAddress 0x1000
SizeOfRawData 0x6800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45363

.rdata

MD5 e913094d8cceaca6b405bbbb52936387 🔍
SHA1 20df51227f19cb63323b43e74e506b2d2a09dce8 🔍
SHA256 512cb9ab76c260c6f4f8bb183a3e121f54906dcb42a74cded744aa6f6a330a19 🔍
SHA3 7f1ef0d8b4b6df73acc9b3d021673ec2f165f8688099c2a999d75994bfd54654 🔍
VirtualSize 0x1358
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.0997

.data

MD5 7804e762c184b9332b0f971ae6b70797 🔍
SHA1 8472c5f3c2c8fe4f67c738dd03d997c53ba4ff41 🔍
SHA256 4f3337ad54736bde3ba1187a1bdf44e352d04b717c4494c531075a7cbfc92c0a 🔍
SHA3 05c7948c9942d5c22ef7ba3840edc1acc3ce56686c62f2e86693f4710d97c942 🔍
VirtualSize 0x1fb78
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.12465

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1f000
VirtualAddress 0x2a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 4120e0234c981e91550f24782686f772 🔍
SHA1 a338f137be84a5846b46132ab29c631a187f1761 🔍
SHA256 74d1fa5234c58ab45bc413985a5dbd9f69815104f2b15005ace3d89b3a82b7cc 🔍
SHA3 f55cdc133eca09a9db39c93dcc1e0ae01f512f9e608cb4482778f0575f66c341 🔍
VirtualSize 0x66a48
VirtualAddress 0x49000
SizeOfRawData 0x66c00
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.64329

Imports

ADVAPI32.dll RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
SHELL32.dll SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32.dll CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
COMCTL32.dll ImageList_Destroy
#17
ImageList_AddMasked
ImageList_Create
USER32.dll MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
GDI32.dll GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
KERNEL32.dll RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.4503
MD5 81d8b636b060704bb613e3567c3f106a 🔍
SHA1 8648602f3f0b438ce15d24413f9bbc68739e2806 🔍
SHA256 5bf3bdf3081f271e519b2dd2e769881fdf366f98cdd269ffe5eb575ccbd83b13 🔍
SHA3 49045c09f5e163145cc6d29e78a5265588f8ccb5bd55daa4c83c9ddda9ad114b 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.70738
MD5 fef854f0432ed42f72677296e616d53e 🔍
SHA1 d8121888bff72ae2689a46f2b69822a38083bea9 🔍
SHA256 29035f3cdf768d3fe59f9ace93aa88393588ac2d534b0e59604eb781469e9b50 🔍
SHA3 511a3a627a0c57c0ea4ebec21a5d7b15b9568b422d975eb7037905dce1f19a37 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.86302
MD5 022f4656b79a1603840775f60d0c0fc8 🔍
SHA1 cf83797f0b2ea0fd1c197684aef4874145f675a1 🔍
SHA256 bd52801cb741c8df3a81d9777f85af10d4ba11c82c233e5c6bc4a2d64803f51c 🔍
SHA3 78082e353c8daea0661aad236d0b54c5bffd87a1b70fa0fc50cd43c8f15e0d5b 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.13823
MD5 610fe366204325cf9af7282a16cb3c06 🔍
SHA1 54a1349a1476ab6f777f918bbbcf98cb87e7b825 🔍
SHA256 b49980e0cea6b972f43b6f36560f31c18329a329598175f7200717a5333c9b11 🔍
SHA3 3cade53efdab2258995dfc336c8e4718849d9c8d3343953bd13414dbe459df73 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37809
MD5 2b045ad7e00d352ba7022f8ac94d685f 🔍
SHA1 f3a328d6e596e83ef19035f6e66cff0ff1f72c2e 🔍
SHA256 4cc0f0e0f64468e89ca12d4b34f6d6ff2ad044ffa0dc8e58a9e49d0d739ddc5e 🔍
SHA3 0566b8fbbe6b37df20f4241ff0df002f63c7c43efe4e79093f8b493d87acbe7c 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1a68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.51198
MD5 986b26b0ec53045e10bfc7f37bfc471a 🔍
SHA1 6b45e8f474bb48ce2ce111e2d35fa2781a24f166 🔍
SHA256 b13e25239b513728b6648190f42bf596408779a9a6d0ac9f90b091be01d53de9 🔍
SHA3 7215b0c006687086108e5091412c06e0df538c929799896c92f828ceba072ddc 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.80708
MD5 362096212e3e66608e01a7d49d62d4d6 🔍
SHA1 29cb983b203004c793e38c35f839f85f5e5b8d86 🔍
SHA256 649e1a21310d0398fd9263c0887ff40cfc5ba1d30337101a1af40d33179d7fb7 🔍
SHA3 25a4ed0c021b18b86aa8abd1ce006e28068468fc9c8128467018b8db7e0c5d7f 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.0702
MD5 ed19672df20853096687af3a80b92687 🔍
SHA1 92ef9b06d89c8d011950fd710ae5e82eb5b05153 🔍
SHA256 ce6ab5220f9dc787faa2560ae36fb8da61eefc457d87f77ada9170d2e421c0bd 🔍
SHA3 b1d970c27d94da1e6eff6c48c40a366c0928c1be1de1e2e67c245bd3427952f7 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.21726
MD5 408b3dfdbe6146c853eeb54e8ed8dcfe 🔍
SHA1 3c2704e2b79236fb2ec42efa27a5f0b9f96115c6 🔍
SHA256 b7b8f2490ba166d995ecfd0b085821e186362f9719e4bba0430606a5c170e6b0 🔍
SHA3 f4a351cead18fa71e3994430997e55cb81ca99c399ca5460e15ec01a18cc94b8 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73893
MD5 386770584473e271f23dced36427f4ff 🔍
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19 🔍
SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014 🔍
SHA3 db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17 🔍
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc 🔍
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 🔍
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b 🔍

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa 🔍
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843 🔍
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023 🔍
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f 🔍
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673 🔍
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763 🔍
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97548
Detected Filetype Icon file
MD5 1377f75adbae2bd79a9bd033298d6563 🔍
SHA1 b8b584753d4325d4178cb438c8ecc1b9d68a2ef9 🔍
SHA256 6f1f1acf586efcf3526e1118702481a13a9232e8b9e9f932a53e67c52febb6c5 🔍
SHA3 0dab155d607476fa4091051d6770a571048b0da8962d580d6dc6a5c28cfa7042 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x423
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.29674
MD5 8618e3c849e02fe9c0972500fbb9bbdd 🔍
SHA1 0a10aeb580199d453de1a2f70e8c63e602385bc1 🔍
SHA256 165c275d8d1f3a0b996cf412656fd0c22ab984b14c8df72c9b9f84fa00bb6ed1 🔍
SHA3 68bcb9e90752afa9c5bfc28ff67dcb4ad9a60c49e52cc04043c083fdd7176021 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd24e50e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 163
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.