1084e517bf35fda87c281084e67eb13f425d487fe7e2e3a3aaceff52295eb27e

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2013-Apr-01 07:08:22
Detected languages English - United States
ProductName Project1
FileVersion 1.00
ProductVersion 1.00
InternalName TJprojMain
OriginalFilename TJprojMain.exe

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • inkscape.org
  • www.inkscape.org
Malicious This PE is packed with Themida Unusual section name found:
Section is both writable and executable.
Unusual section name found:
Unusual section name found:
Section is both writable and executable.
Unusual section name found: .imports
Unusual section name found: .themida
Section .themida is both writable and executable.
Unusual section name found: .boot
The PE only has 2 import(s).
The RICH header checksum is invalid.
Suspicious The file contains overlay data. 1918846 bytes of data starting at offset 0x24cf8e.
The overlay data has an entropy of 7.81807 and is possibly compressed or encrypted.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 5c92eff0afdfd1c402dadc6d058efa4d
SHA1 1bd6000afa651924b8d51b98ae84551208f76150
SHA256 1084e517bf35fda87c281084e67eb13f425d487fe7e2e3a3aaceff52295eb27e
SHA3 c01fa07069a734afcc0d44abac775ddeb269c154c376c4b23ddd51bf7f27d53a
SSDeep 98304:jXzhW148Pd+Tf1mpcOldJQ3/VhqbOq6oqDqPBqnhqKq++q68qBhqt2qClmF:DFK4s0TfLOdo/koCkFcZ0wo
Imports Hash b672bf4528e2ef8904397d0b17905606

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xb8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2013-Apr-01 07:08:22
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x1a000
SizeOfInitializedData 0x3000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x003D8058 (Section: .boot)
BaseOfCode 0x1000
BaseOfData 0x1b000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x616000
SizeOfHeaders 0x1000
Checksum 0x5f18af
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

MD5 02b114353af714feb26266bf0d1f709c
SHA1 8c8040cdce017345827450e50529c9db844693e1
SHA256 c3ecf93fe3fe36a05fd881418dbe6a30e9779922b32b5eb54afa4c24b7ac5e02
SHA3 b4231cc15233470cdc2049b7031d610e8383b036b4d4200da5690b69f598e313
VirtualSize 0x191d4
VirtualAddress 0x1000
SizeOfRawData 0x890d
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.97643

(#2)

MD5 f49fb968754ecf28b3aa8982347ff654
SHA1 d2ebe992ea362d77cd9b55cabc23933d02024afb
SHA256 27f07e6c4f5d0a3923d4d5f6cf5301812ba6dcaf831c95ca4efc4584d0e11c56
SHA3 d372abc768c332a48d617f68dfab6f1944747631350e54737d3b32baa7fe6529
VirtualSize 0x180c
VirtualAddress 0x1b000
SizeOfRawData 0x7
PointerToRawData 0xa000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.80735

(#3)

MD5 ec68e6c21d654d13e46bb0b7053a7ada
SHA1 23d475a7f1a50bd651f688596e2bc4b501e764fe
SHA256 8cff36a8f690ffd97acfd107847092bcdc781dad532548d6901a3d56d3de2c59
SHA3 0800e8cd593ad7263cfa06ab0beda9ae2dd1c9dedd73bb82e34b673c5e9d13e4
VirtualSize 0x13f0
VirtualAddress 0x1d000
SizeOfRawData 0x424
PointerToRawData 0xb000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 53
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.77304

.imports

MD5 12bc61d64335963249b58f7839803931
SHA1 d000f55555c226ef08a566406c308f68499be8b4
SHA256 2e414b078df986bb602c0fc4fd8d8c84bf5098418d0b48a464c3e0f49621b529
SHA3 30ce0054a3da2f934dcd4d72eaed268f6aef791e04ef05b0e8adc10f97982c6e
VirtualSize 0x1000
VirtualAddress 0x1f000
SizeOfRawData 0x1000
PointerToRawData 0xc000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.239843

.rsrc

MD5 6c5c32281b9adbcfc1821015c3a2e945
SHA1 f6062b88eda7bee07b068c2ba13774207e654b2e
SHA256 119c6d60c1bd4f44dc39c90f5a0316df950ee64bba17f2eea2925e5775b0cf0b
SHA3 4cf1106d83af8e1160cb91fb2608cbffcd4b22488e4a35c6bc6313209861ab80
VirtualSize 0x2000
VirtualAddress 0x20000
SizeOfRawData 0x2000
PointerToRawData 0xd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.03035

.themida

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x3b6000
VirtualAddress 0x22000
SizeOfRawData 0
PointerToRawData 0xf000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot

MD5 bf8e1cdc3d27cac7cfed4f3cc0c199d7
SHA1 2b111d6bbd0ec5d80c9696f6dc9026e719841c18
SHA256 7696404fa8f7cf089e9a87cb9a7cdeed1d78429bdfd724910cdbf6d6591aac76
SHA3 d5789dd3cb0ee79b9dc7a7dd1804f1529f1c9348f0aec354c86e05016447228e
VirtualSize 0x23e000
VirtualAddress 0x3d8000
SizeOfRawData 0x23df8e
PointerToRawData 0xf000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.95568

Imports

kernel32.dll GetModuleHandleA
MSVBVM60.DLL EVENT_SINK_GetIDsOfNames

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xcd0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.3626
MD5 760a7cf6d6cdbb97a51245cd667b0b37
SHA1 c060da1483c6df3e24a7d179e8be730a8f6aba2b
SHA256 a1dbf224116689cef37fe0d9d2e5af6229478ebbd40aa660a3c1c0e99de14319
SHA3 0dece97651a38bc48a8b72e59fd5e551b87fc4401f140c834fb7ddfd1e71d605

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.5789
Detected Filetype Icon file
MD5 96368a1d01b9b3ad7ba32197a2f5ab9b
SHA1 8fe4086815852f396a60e076cf81470be5d0736f
SHA256 917277758ec26a2ac726258b0330a530d9e69918ef94104faeff9a418f932244
SHA3 3a10cdd2ad4c78ab863d5cceae110eb3061f61d55f5bd2a8817d958d67a0fb2d

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1ec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.13718
MD5 36248eae0c0c17c1fbbd52476d5b612d
SHA1 c76b019abb540f0f942c99cb1daf61b202f8bd4a
SHA256 d5afa151e677a98f00aa6af43d6155c0dc5bbb8039c1581f744e3188616a434c
SHA3 142782a145302989fd0404f34e6892589970ec956f1ae364d10822ba360c93a1

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x3e7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.71018
MD5 2d212c52d195db17de44fc66fc64ec7b
SHA1 0bc303796fc25884f30daa43579f37084aa86551
SHA256 95effec3e13ef3dde1b82a54cce79dc610c686a6b74d5018e8895a2c923dede5
SHA3 733a2075eb69fb272214c25fe350578d31209a61701d4a24bc85046af292c7e0

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
ProductName Project1
FileVersion (#2) 1.00
ProductVersion (#2) 1.00
InternalName TJprojMain
OriginalFilename TJprojMain.exe
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x91a515f9
Unmarked objects 0
14 (7299) 1
9 (8041) 8
13 (8169) 1

Errors

[*] Warning: Section .themida has a size of 0!
Leave a comment

No comments yet.