0dc6c06ce160b14df5dda5019b96adf6

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2018-May-10 14:36:12
Detected languages English - United States
Russian - Russia
Comments MediaGet installer
CompanyName MediaGet LLC
FileDescription MediaGet installer
FileVersion 1.0
InternalName mediaget-installer
LegalCopyright Copyright (c) 2011 MediaGet LLC
OriginalFilename mediaget-installer.exe
ProductName mediaget-installer Module
ProductVersion 1.0

Plugin Output

Suspicious PEiD Signature: UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX -> www.upx.sourceforge.net
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Possibly launches other programs:
  • ShellExecuteW
Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
Has Internet access capabilities:
  • InternetOpenW
Leverages the raw socket API to access the Internet:
  • #115
Manipulates other processes:
  • EnumProcesses
Can take screenshots:
  • BitBlt
  • GetDC
Info The PE contains encrypted or compressed resources. Resource 1 is possibly compressed or encrypted.
Resource 129 is possibly compressed or encrypted.
Info The PE is digitally signed. Signer: GLOBAL MICROTRADING PTE. LTD..
Issuer: thawte SHA256 Code Signing CA.
Malicious VirusTotal score: 21/66 (Scanned on 2018-05-15 10:45:39) Malwarebytes: PUP.Optional.MediaGet
SUPERAntiSpyware: PUP.MediaGet/Variant
K7GW: Unwanted-Program ( 004e12851 )
K7AntiVirus: Unwanted-Program ( 004e12851 )
Cyren: W32/MediaGet.G.gen!Eldorado
Symantec: ML.Attribute.HighConfidence
ESET-NOD32: a variant of Win32/MediaGet.AL potentially unwanted
Kaspersky: not-a-virus:HEUR:Downloader.Win32.MediaGet.gen
Avast: FileRepMalware [PUP]
Emsisoft: Application.MGet (A)
Comodo: Application.Win32.MediaGet.G
F-Prot: W32/MediaGet.G.gen!Eldorado
Webroot: W32.Adware.Gen
Endgame: malicious (moderate confidence)
ZoneAlarm: not-a-virus:HEUR:Downloader.Win32.MediaGet.gen
Microsoft: PUA:Win32/MediaGet
Sophos: MediaGet (PUA)
Ikarus: not-a-virus:Downloader.Win32
GData: Win32.Adware.MediaGet.A
AVG: FileRepMalware [PUP]
Qihoo-360: Win32/Virus.e7d

Hashes

MD5 0dc6c06ce160b14df5dda5019b96adf6
SHA1 f7e714345d5b51e5c5e20006cd8fc910eb9ed984
SHA256 48cb86b5960b65991a82c7e147d67d35bde4c68755ecdb0f36060e66501b5fc6
SHA3 0016a8a77c00186377df282b686f39bf305d792c18067b570ade4cdba094e988
SSDeep 12288:f5KZw7o6+5hvihKg7jMzvrojbpzBhkCjAQQAGrU2xUVOFwWwe2qle:f5KS7ScH72rEbpzBhkCjAHAG3xkOF59Y
Imports Hash 7fb106e6b75d6bf66ab0cbffc134d2a0

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2018-May-10 14:36:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 9.0
SizeOfCode 0x38000
SizeOfInitializedData 0x5a000
SizeOfUninitializedData 0xb4000
AddressOfEntryPoint 0x000EC4C0 (Section: UPX1)
BaseOfCode 0xb5000
BaseOfData 0xed000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.0
ImageVersion 0.0
SubsystemVersion 5.0
Win32VersionValue 0
SizeOfImage 0x147000
SizeOfHeaders 0x1000
Checksum 0x96beb
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 c5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470
VirtualSize 0xb4000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

UPX1

MD5 849916c750defdc18da91882d7af4401
SHA1 4093f8446ff6523094297e812797e28d8930faf9
SHA256 914459b4260a38e424cd7c5eb21492738311a38518bd1990f7ef5413e867c73f
SHA3 d4b0770f4d7851dea9a8a4413e556afdac6cf5f292d9fd45987cc9fad9f3bdbd
VirtualSize 0x38000
VirtualAddress 0xb5000
SizeOfRawData 0x37800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.92408

.rsrc

MD5 f2712c96aad10d0cfc40e07afe06dbbc
SHA1 4c82ac5f9f497a00d93f4ac7d91e94feb6f9347f
SHA256 67157b020317306feacb0d104cbe9607f85136316bef62b47c18952b5078f221
SHA3 80505540957e3b54982e53a64c076626d316b57b255955d1cbdb72417a29345f
VirtualSize 0x5a000
VirtualAddress 0xed000
SizeOfRawData 0x59c00
PointerToRawData 0x37c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.94914

Imports

KERNEL32.DLL LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
ADVAPI32.dll RegCloseKey
COMCTL32.dll InitCommonControlsEx
GDI32.dll BitBlt
ole32.dll CoInitialize
OLEAUT32.dll #6
PSAPI.DLL EnumProcesses
SHELL32.dll ShellExecuteW
SHLWAPI.dll AssocQueryStringW
USER32.dll GetDC
WININET.dll InternetOpenW
WS2_32.dll #115

Delayed Imports

HTML

Type ARCHIVE_7Z
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x50e13
Entropy 7.99944
Detected Filetype 7-Zip compressed file
MD5 16e5a36c053b6893e63c0f8e3e71f105
SHA1 366029921389be9257506f61872ccfa3d04fe9a7
SHA256 ffd29bb878edf814b9e3b9411ce471cceafc8f8899b56ee032e4c34623addd23
SHA3 8726862315dcf926714459559ea4f5773f606b3bd8117155d0a616f6cc058924

PRELOADER

Type ARCHIVE_7Z
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x3b96
Entropy 7.98607
Detected Filetype 7-Zip compressed file
MD5 7a916463e9aa8c35984ab2649d32f950
SHA1 7d93a27bfcaa3225e86ae73bd8e098f5f66fa504
SHA256 2588b14cc5f4811a497d282c8c5f7dc967973f30cf4c3c03178d1ae92c0adeca
SHA3 1b0313555eeed97379ca4bf20d79ede7b504ab6cceb45620b973082ca95932c3

1

Type RT_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x468
Entropy 7.7297
MD5 37a43757a75e33d1953ee71a366de793
SHA1 c5402b6b4d6f0e379965c4a36c8de388ba52dc51
SHA256 a03abe86ed2a60c5ae01aec9989c397684a28dd3c25115d7591eb30710369ac8
SHA3 146be9a900690738fcfcd26e189d44e4c2adda1bacac924a1530221bd5e33382

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
Entropy 4.95548
MD5 0391899fff52c23cbf226ea473cfb620
SHA1 c230baaf0c35dc6d546e021edbb5a5b13e6fe290
SHA256 663ba2a76dd6bd107e20f87a3d0d04c85b2cebcd5324e1acb30df201be1c9f29
SHA3 846edeb815eca0f176f700b20cb06f8e85d1addd7ee0b574939dbb4fff7d4348

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
Entropy 5.18073
MD5 38ee163b193d8b3dbaed29c3edd9332e
SHA1 9a525f5792bf2f01088ced0c4fb346ca820af546
SHA256 b48c12b91b9f2a2371f3c5602b6e531dbce77662068bd737415de2f0931fa8c7
SHA3 d8989a3465232a59df71262cb8e24bdd8f1f2a6ea23d14ae3e5d60a3d8ac49f8

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x988
Entropy 5.05232
MD5 efd7367e0c935fff330ce2b27e4e10a0
SHA1 e41f3a6aa937efc73ae0e30c6751f5e09c661d52
SHA256 b6c6f66305362100c89d129d32b2d5fa069fd0da7ed5725197444ffa23566cbe
SHA3 9261a3371b2ab070a3cf65e21adb213938c147d31afe7a5a1d8c73876be766ca

5

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
Entropy 4.75162
MD5 f68a43230d48bb24badeb9062cb73f48
SHA1 68fdb46a34869ea1f58283262958782cbc637181
SHA256 2b4fd6d5f97086f9963fe9f6fb51085979a0cea3767f76ef5396b221d5a4ae9e
SHA3 25f1e8c63d2d4033bdd6fa078f04e693b7148226ab7ea2c48a1d4e8894309b0b

129

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x110
Entropy 7.14152
MD5 71c275de19f05c94a03ac05a407a2226
SHA1 9aee01a28ce0a39946423938747f1953cf45014e
SHA256 18f5f2a44476937abb0b98e5112e4c4ee8a86cbbc45724ef32796077f42f0796
SHA3 136019b01d5661924700e8c48a6a56253b8de5bdefdae465dfe03dc15b262094

128

Type RT_ACCELERATOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x70
Entropy 6.40776
MD5 0b4244da6558816b0e9882c4837ee386
SHA1 97ff375f2ff612af96d68bc82dbb3bc23d2ff08e
SHA256 54ce1400a3632f57a036f906501c8ab3523cc039e757e93be7d101bfb98d272e
SHA3 ba4a0736489a50af4e0744d2da6ff249abdab4ac8dbb8149db14a578b9aa3915

128 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x3e
Entropy 2.68598
Detected Filetype Icon file
MD5 032cd024a49e37ce77d4720582291440
SHA1 5eab7e784b579aa72de4a04121ef7d7e865c596e
SHA256 99e222853c95957d4e8af20500231dfb884884edbcc1ad69e3c80259997cf285
SHA3 9d8f80af8e10d413a567ceb7deb58b0a3ab6cdcaf573ae3d0c663dd38d6e1221

219

Type RT_GROUP_ICON
Language Russian - Russia
Codepage Latin 1 / Western European
Size 0x14
Entropy 4.22193
MD5 178c9e812017b458d08cd74a34921bd0
SHA1 9b3cd9833a9c84501006f26fc656b548a75cacb6
SHA256 0c57f11b277bc3c1d2677dc9292c38870d7c65c6317e06ef791488b286922c85
SHA3 d9ff2a35bf4fb97cd0f155d8f829fdbe21bb3ce95470cc9f1be12d502311dca2

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x354
Entropy 3.28905
MD5 86790bee0c590faa2333c7649583f499
SHA1 9ebe77f155c7ec08dce25f8371840c9118d0302d
SHA256 13098abad379ee22547e25e2023699231d28ca7ea3b55f1c4f72bb7567a1ebfb
SHA3 10ce55d1834900484d35c45b7eb2d71c5a07d50cd43e25581a4264801616e1cc

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x249
Entropy 5.19483
MD5 3a66d5be081e05d22ba2c3d6b55fe9f5
SHA1 8add6582876296113e7a42986c23395c7813e7fa
SHA256 e71edaa2dad5fd322625c047b080165d5b4f50c925f4a0d3153b57875519393b
SHA3 4711318f0d93ec3be903478518ef6d93fc98d9e6d6b541abac908d3589f795f3

129 (#2)

Type UNKNOWN
Language English - United States
Codepage Latin 1 / Western European
Size 0xaa
Entropy 6.78563
MD5 3ddc1e59aff8b0252e0ca087f50faaa2
SHA1 c28accae82cef734b5f12ccbbc453e8749c16532
SHA256 fa1be57873a93940ecf7e495229455a2eb4cc302eba5834ff392b4818430a4a2
SHA3 be9f79c002961cc18ff480b3ec0eeeb4a201c6d0c58387784428f72c8093bc3a

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments MediaGet installer
CompanyName MediaGet LLC
FileDescription MediaGet installer
FileVersion (#2) 1.0
InternalName mediaget-installer
LegalCopyright Copyright (c) 2011 MediaGet LLC
OriginalFilename mediaget-installer.exe
ProductName mediaget-installer Module
ProductVersion (#2) 1.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x47ead4
SEHandlerTable 0x472f00
SEHandlerCount 315

RICH Header

XOR Key 0x14578280
Unmarked objects 0
150 (20413) 1
ASM objects (VS2008 build 21022) 26
C objects (VS2008 build 21022) 142
C objects (VS2012 build 50727 / VS2005 build 50727) 8
Imports (VS2012 build 50727 / VS2005 build 50727) 25
Total imports 342
C objects (VS2008 SP1 build 30729) 9
C++ objects (VS2008 SP1 build 30729) 1
137 (VS2008 build 21022) 14
C++ objects (VS2008 build 21022) 107
Linker (VS2008 build 21022) 1
151 1
Resource objects (VS2008 build 21022) 1

Errors

[*] Warning: Section UPX0 has a size of 0! [*] Warning: Section UPX0 has a size of 0! [*] Warning: Resource is empty!