Manalyzer :: 0e488d64b98ebd51488a5744375c412e2489757cb870469856183865a433cc73

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2002-Jan-21 04:38:55
Detected languages	English - United States
CompanyName	CrissCross Technologies
ProductName	CCT Solitaire
FileVersion	`1.00`
ProductVersion	`1.00`
InternalName	solitair
OriginalFilename	solitair.exe

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual Basic v5.0/v6.0` `Microsoft Visual Basic v5.0 - v6.0` `Microsoft Visual Basic v6.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: virus` `Contains domain names: crisscrosstech.com www.crisscrosstech.com`
Safe	VirusTotal score: 0/70 (Scanned on 2024-07-18 05:01:29)	`All the AVs think this file is safe.`

Hashes

MD5	`450fb5b856f7b4263780e11973b4ccce`
SHA1	`e4c0f28beff3b0ebefa583b496683ed04462a058`
SHA256	`0e488d64b98ebd51488a5744375c412e2489757cb870469856183865a433cc73`
SHA3	`e7f2986d8a158f0f9675d78f911aa9861a48fec535e96747f6cd7904bccc3944`
SSDeep	`1536:sryFijrBKGJ1GgAJI+7hLd/Sx1TNCnAC4IvYg0EUOtPRGJ+H:/CxAvEEKw`
Imports Hash	`fe748e077763716c9ab4f9512c6412d6`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xc8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2002-Jan-21 04:38:55
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x2b000`
SizeOfInitializedData	`0x4000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00001650 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x2c000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`4.0`
ImageVersion	`1.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x30000`
SizeOfHeaders	`0x1000`
Checksum	`0x36f31`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`83e35b4bd0e5d67501fb85a0cc88e9fa`
SHA1	`cb5ac292b2c7c01a670318b55227111d0531640f`
SHA256	`9ed058d06f5ae87f71944ff0d5d1b0c3e6e539a6360da1d8d1e3b87cf7bb760e`
SHA3	`55dca63e40ad4d4fb7c2c6185bbf6484e3eb9deb70fdd150c27d89771f88ae8b`
VirtualSize	`0x2a4b0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x2b000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.54679`

.data

MD5	`620f0b67a91f7f74151bc5be745b7110`
SHA1	`1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d`
SHA256	`ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7`
SHA3	`a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563`
VirtualSize	`0x28d8`
VirtualAddress	`0x2c000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x2c000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`bb95186a5b1ed43e0e08928338bfb7c5`
SHA1	`db72ea8f1f5880c0493fa60c4fb58f69e7dfaf84`
SHA256	`45e59da432c0c48ecddc534695665ce10f9c16ff01147d07c286f55caf233af5`
SHA3	`6c0023c81aed4324ed3ec09cb5dd2f09e25e10990f9a804b20137185b704c189`
VirtualSize	`0x8fc`
VirtualAddress	`0x2f000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x2d000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.97618`

Imports

MSVBVM60.DLL	`__vbaVarSub` `_CIcos` `_adj_fptan` `__vbaVarMove` `__vbaFreeVar` `__vbaStrVarMove` `__vbaLenBstr` `__vbaFreeVarList` `_adj_fdiv_m64` `__vbaFreeObjList` `_adj_fprem1` `__vbaStrCat` `__vbaVarCmpNe` `__vbaSetSystemError` `__vbaHresultCheckObj` `_adj_fdiv_m32` `__vbaAryDestruct` `#593` `#594` `__vbaObjSet` `_adj_fdiv_m16i` `__vbaObjSetAddref` `_adj_fdivr_m16i` `__vbaBoolVarNull` `_CIsin` `__vbaChkstk` `EVENT_SINK_AddRef` `__vbaGenerateBoundsError` `__vbaStrCmp` `__vbaAryConstruct2` `__vbaVarTstEq` `__vbaObjVar` `__vbaI2I4` `DllFunctionCall` `__vbaVarOr` `_adj_fpatan` `__vbaLateIdCallLd` `EVENT_SINK_Release` `_CIsqrt` `__vbaVarAnd` `EVENT_SINK_QueryInterface` `__vbaExceptHandler` `__vbaStrToUnicode` `_adj_fprem` `_adj_fdivr_m64` `__vbaVarCmpLe` `__vbaFPException` `__vbaI2Var` `_CIlog` `__vbaErrorOverflow` `__vbaNew2` `__vbaInStr` `_adj_fdiv_m32i` `_adj_fdivr_m32i` `__vbaStrCopy` `__vbaFreeStrList` `_adj_fdivr_m32` `_adj_fdiv_r` `#100` `__vbaI4Var` `__vbaVarCmpEq` `__vbaVarAdd` `__vbaStrToAnsi` `#613` `__vbaFpI2` `__vbaVarCopy` `__vbaLateMemCallLd` `__vbaR8IntI2` `#617` `_CIatan` `__vbaStrMove` `__vbaStrVarCopy` `#619` `_allmul` `__vbaLateIdSt` `_CItan` `_CIexp` `__vbaFreeObj` `__vbaFreeStr` `#581`

Delayed Imports

30001

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x130`
TimeDateStamp	2002-Jan-21 04:38:54
Entropy	`2.57965`
MD5	`a20d09bee9b4207ad5a3b67a78c1dce3`
SHA1	`ca85fbf532389887f3837bbadd1c579040b99c8b`
SHA256	`2d3915cdc82e909357d44c4de1b8890bd753605c28df11b10299e3fd09d930b9`
SHA3	`e3b2b0325b24bb74af126af0863b39a6e63c08820f69cf0ae582a31bfc1052db`

30002

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x2e8`
TimeDateStamp	2002-Jan-21 04:38:54
Entropy	`1.76987`
MD5	`24799ca590d42134e7103b06d46fd960`
SHA1	`4af9a0fe3b7371abc50a18e851f3122fce9a2ffa`
SHA256	`a32e750bc1b0315530097434a7e1d324b843e1f5ffd95238b49d3a8aa8e6fe09`
SHA3	`9a17698629ef5e7a1c567a9669be74aa2c9d8356ecfba40c48811e4dcf5ea875`

30003

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x128`
TimeDateStamp	2002-Jan-21 04:38:54
Entropy	`2.07177`
MD5	`e6c5053ba1c848d7e16701a2d08fb8c6`
SHA1	`f253482c0fa25197130f6475f2ded060527843bf`
SHA256	`46dc088910439dad6a0d69da5e64227d04a640845fd1c31e90a7d4340c539fe0`
SHA3	`1e6c369197dd1a466ea87357db49ec559ecf82c0c3fa13af1a383445945861e6`

1

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x30`
TimeDateStamp	2002-Jan-21 04:38:54
Entropy	`2.97836`
Detected Filetype	Icon file
MD5	`835a20def9b2661b64b8ac06b4901f36`
SHA1	`70732dac88537f00c89d105f986ef843d3aca818`
SHA256	`cbdcb84268fcf2a25b844c1dca787de835c0376e82c1a2e62814a3c940a26cfb`
SHA3	`9a2de99425a7e2086c65d82719bf44696cfe58b8077ce214e814ceeeb78ba1f4`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	Unicode (UTF 16LE)
Size	`0x23c`
TimeDateStamp	2002-Jan-21 04:38:54
Entropy	`3.1456`
MD5	`fc5fc170e5598be661384d7b6ae039b9`
SHA1	`49b40139dcb70859b9f78c133f77f1de94db666d`
SHA256	`9cfde912f2e862c628c7595df388ca5a79868a58799f840e56504f2784470c22`
SHA3	`95c92871ffbc354e594dfb45f0f9cada4e8fbd294a506b830b6911c6b923e728`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	CrissCross Technologies
ProductName	CCT Solitaire
FileVersion (#2)	1.00
ProductVersion (#2)	1.00
InternalName	solitair
OriginalFilename	solitair.exe

Resource LangID	English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0x8ace4641`
Unmarked objects	`0`
14 (7299)	`1`
9 (8783)	`6`
13 (8877)	`1`

Errors

Leave a comment

No comments yet.