13d65f6e059fe94009c0d1b49e2bad63

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Aug-23 03:54:50
Detected languages English - United States

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • abyssmedia.com
  • https://www.abyssmedia.com
  • www.abyssmedia.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to RC5 or RC6
Suspicious The PE is possibly packed. Unusual section name found: .didata
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
  • LoadLibraryA
 Functions which can be used for anti-debugging purposes:
  • SwitchToThread
 Can access the registry:
  • RegQueryValueExW
  • RegOpenKeyExW
  • RegCloseKey
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
Info The PE's resources present abnormal characteristics. Resource SRC is possibly compressed or encrypted.
Malicious The file contains overlay data. 9179590 bytes of data starting at offset 0x7b600.
The file contains a Zip Compressed Archive after the PE data.
Overlay data amounts for 94.7822% of the executable.
Malicious VirusTotal score: 15/69 (Scanned on 2023-03-14 07:12:31) Sangfor: Trojan.Win32.Agent.Vebw
CrowdStrike: win/malicious_confidence_60% (W)
Elastic: malicious (moderate confidence)
APEX: Malicious
Paloalto: generic.ml
Cynet: Malicious (score: 100)
Avast: Win64:TrojanX-gen [Trj]
Zillya: Trojan.Obfus.BAT.3
McAfee-GW-Edition: BehavesLike.Win64.BadFile.tc
Jiangmin: Backdoor.Gulpix.tc
Webroot: W32.Malware.Gen
Gridinsoft: Trojan.Win64.Gen.cl
McAfee: Artemis!13D65F6E059F
Fortinet: W32/PossibleThreat
AVG: Win64:TrojanX-gen [Trj]

Hashes

MD5 13d65f6e059fe94009c0d1b49e2bad63
SHA1 563543d2d2eccd784b83b22fc634b1c03d10abe3
SHA256 56cf2c9022ca5f99d069dbc43c4811b56939b3ecac13b5cde48a1fdbb477efa3
SHA3 44fc036d2e4b4a24b0b08ade77ff4f39dd4045013961ba603533f1d25d586ff7
SSDeep 196608:WAYJw5b7epK/BFKK0iGlYehZ5sITebWvV6uNYNhEVOcUffQbVm6U:WfJceQ17GCeh8IT9vV6AROFoc
Imports Hash 82ab4d24cedb81c2dcd0e1c504ac741b

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 10
TimeDateStamp 2021-Aug-23 03:54:50
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32+
LinkerVersion 8.2
SizeOfCode 0x5cc00
SizeOfInitializedData 0x1e600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000005D1A0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 5.2
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x8c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x2000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6cd0e20a6757a9b4bb29b3376472dfd9
SHA1 51a408c389ea24b756e3c59863aa6c330380b799
SHA256 0780a7ac9f6db7999b2d0725aa06e596265623e7a1e1c6b8c49552a014f928f5
SHA3 b3fe85c0b7c098867fa7b0bc7b70f7e536cf5b947e7e881efb95dc0b2a3ef16a
VirtualSize 0x5ca10
VirtualAddress 0x1000
SizeOfRawData 0x5cc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.83011

.data

MD5 fdd92a44cd352355f47f557d4400729a
SHA1 70f7cb8c74d69adc9b9c3acefafcdb65e5d27471
SHA256 69832b18f1f6e7a06a0243b2ded0a2b8b6cbc407771cfca9be251071b52dd32d
SHA3 a03548919450d5c6e0d19326b35e525c5cd73c329910770255ed6c0538b3c2ba
VirtualSize 0xd748
VirtualAddress 0x5e000
SizeOfRawData 0xd800
PointerToRawData 0x5d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.09344

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x9530
VirtualAddress 0x6c000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 eb3a548cdbf52daf02006e47a0b4bd2e
SHA1 09fc4da710c517540545eb37e5a012450f56292d
SHA256 41094444179f94020f9c265571455f68ee43fc75196c6af521c164cff2b92134
SHA3 f161b91727bf292dd99ca39ef03db136bdf132c9207ca8c4c9799e1f8258a7d1
VirtualSize 0x1532
VirtualAddress 0x76000
SizeOfRawData 0x1600
PointerToRawData 0x6a800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.95548

.didata

MD5 5a8d1de5ae517d06bc15fec5f61af53b
SHA1 bad2133670b9831d912ce0e3710139b7f7b0cee7
SHA256 0e87e22c34fc0847f09f5849074a1a51fa0ae25ad1a55fd6b15f6e489cd80252
SHA3 458bac9bc7a6ab2e4302ec558b7fdeb0b446d1862ef9a9492a9030c32c89b863
VirtualSize 0x18c
VirtualAddress 0x78000
SizeOfRawData 0x200
PointerToRawData 0x6be00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.03592

.edata

MD5 b6e4c76e6c227ddbb996d20b7b85ad28
SHA1 226b0e55eefdd608d4dcddc09cfb7f1659cc4592
SHA256 f6e2244e14fdc54d6736da4ccbdeabd1204d5b76526304cd2dd28822dae5b18a
SHA3 576a3efbc10ed06835aca1e572678adcbb6188d36146e48f851cf1b94b5b9bef
VirtualSize 0x96
VirtualAddress 0x79000
SizeOfRawData 0x200
PointerToRawData 0x6c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.81853

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1a0
VirtualAddress 0x7a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 4cb4d9ae4f1e5cd6f0a8af97f599845f
SHA1 28234f1ea94d8fc26f8fbe48a8e7c8b3c648666c
SHA256 9c3e5b8307e30d71045cb439c748aa5520a0aa1cc1c97bce27ee9c825669dc36
SHA3 9142567c23526076d7bc35b706e77e161ca6d74bec038ad76db8cbc9b4030ff4
VirtualSize 0x28
VirtualAddress 0x7b000
SizeOfRawData 0x200
PointerToRawData 0x6c200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.210826

.pdata

MD5 70fab6a5195b7a1f51d0f8f80005aaf1
SHA1 d2c6287b602f3b6cd9141497e5124f40238d102f
SHA256 2b8ab960dab9c3dde2d9dd65e33c1eb6e1af55dee0c921876826bdcd6cf1947e
SHA3 19796a6d502de26914152305aaff588d2c7d17fa308bd089ffe6e34e13450c0b
VirtualSize 0x5328
VirtualAddress 0x7c000
SizeOfRawData 0x5400
PointerToRawData 0x6c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.66768

.rsrc

MD5 a1bfb988b61f6ba99b01feacef5a8286
SHA1 77fda5268979e9edf983c4189e6431021fb78a73
SHA256 a76e66cff3a8bbbc0504bec992eedb12623224d7616fcae7c3020a8e8208612b
SHA3 81078b8adc616343314e66fe9cc9ab24704ed72618b037fdcb51eda2303c5481
VirtualSize 0x9c08
VirtualAddress 0x82000
SizeOfRawData 0x9e00
PointerToRawData 0x71800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.44463

Imports

oleaut32.dll SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32.dll RegQueryValueExW
RegOpenKeyExW
RegCloseKey
user32.dll MessageBoxA
CharNextW
LoadStringW
kernel32.dll Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
kernel32.dll (#2) Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
user32.dll (#2) MessageBoxA
CharNextW
LoadStringW
kernel32.dll (#3) Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
SHFolder.dll SHGetFolderPathW
kernel32.dll (#4) Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
oleaut32.dll (#2) SysFreeString
SysReAllocStringLen
SysAllocStringLen
msvcrt.dll memcpy
kernel32.dll (delay-loaded) Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle

Delayed Imports

Attributes 0x1
Name kernel32.dll
ModuleHandle 0x78060
DelayImportAddressTable 0x78078
DelayImportNameTable 0x780a8
BoundDelayImportTable 0x780d8
UnloadDelayImportTable 0x780f8
TimeStamp 1970-Jan-01 00:00:00

dbkFCallWrapperAddr

Ordinal 1
Address 0x70d68

__dbk_fcall_wrapper

Ordinal 2
Address 0xe370

TMethodImplementationIntercept

Ordinal 3
Address 0x3c910

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.963663
MD5 3c820f685879b5885ec6f4dd76a614b5
SHA1 b9b6861b4b74f301a13310867d3803f54c68fea8
SHA256 eddfc6a28290782b24bcf1c68f1b824493a75696bbdd66bdec229798994f7aaf
SHA3 5ec7bd05c0583c85f63e34afeb1df35909d3374a4312902150ed5ba4276fb0ed

4089

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.55494
MD5 bb0523f2f17f4a28008e03c85ea742cb
SHA1 31aeb0e979bb858632187dc35fa4de662064beb2
SHA256 15ceca5bef51140dc599d132cf20ec90fe6598a578e7b464c0f9e9489c0eb9c6
SHA3 ecbc54e46868ff0e7da8ae71f19262ecba5c7283802268b984052a2490308147

4090

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x304
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43355
MD5 21037384ad483e69b50de22d42afa88e
SHA1 dc73b5a1a8f5ad2cb4fbdb55f14f2144e6abd603
SHA256 ef67f425106d47c1644ef43ccb088df953dd79e7dc62481be71b202f0f6a1450
SHA3 a9e56094ac401ea4b2b0090b684ee045348ecf141f5bbe375f74d47289cc0abc

4091

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xd0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2023
MD5 2c445e7460778069a108bfa6e5838bf4
SHA1 ada7c52ba585077d914fb80b269ec8a841801795
SHA256 67fa84ed1924419c10197924c66863e6a229a1e590b17e32bde70bb75a809f82
SHA3 266c4ad63b3566332930feba77a9fb887467da0eb433709aa903dd5b70f234ec

4092

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xb8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34911
MD5 4a1e6314536c88cfa0467bf5b0cc0dd1
SHA1 34d0696c00ac0a6e0171d94cdb9cb2b3bc662afb
SHA256 dbd0defe0cb0baca38eba086f1db49f41b260ac4f9cd2d6cdaed54074f04e2f9
SHA3 f1cc84f17e27543fee905fa4c85e54deef05696a42b067f54e122085710e76d2

4093

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x298
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.3725
MD5 c720cb619e54e5f7f44478a85c79c55e
SHA1 682251e8a19c36f18c28e6c94fb5a6869290145d
SHA256 70d6cea09f844aacee85056fcc922123c3be4674c6c6a802a41dab839de2db91
SHA3 85f75d3a86a498c7488dd14d2e4fdd8fd0a46cd55d76aea721a71745f02922c9

4094

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27126
MD5 f34f4b2fbffb2b2dc74250b07c7dbc42
SHA1 4ca332f32fa8678103b78406f05e3e3e8b31993b
SHA256 78160f5ba775c340c1c5dcdfe1cf96d0190a2d49090d4acba36acb041e2b825f
SHA3 640df8a9b7437cb1c4926e5c37d7ba48534c9a48e3104dc14e1b9610afda14f1

4095

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x338
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.35594
MD5 bc06ca47ee6f8d20c4389834f53a44f4
SHA1 102cf0807762abbf7250c533692c282d045a5239
SHA256 e78299e236878f8931b75a5cb1ef7a566f6d2e204d6a3ab5a40d01df44709545
SHA3 c9ace61db2f1daf8a5203b1d42290d62e58289f030e2946a1e32b002ccdf530c

4096

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2d0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28919
MD5 0cc5ea1dc96f98e878fcf0230bd0983c
SHA1 efec3eb732bedc1c6ff61bd8deeac727ea8e2ecf
SHA256 9dcff67237cae3374ea8485e09302cc03947d46ddd08c195b93cd7ce28b2ae87
SHA3 f9eb2e9ec6a3b0e29c87f5f0ac8c3a8dd08fb8ce403e2cc8ee29af8d96cb3e11

OPT

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x30
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.2359
MD5 7fa682a9067dca0b3ec4797c44c5c8ec
SHA1 3878dec8c340553e5ef4a3c1999294a116095fe9
SHA256 ec129c1ea387a1d80071d862e8b1c03eba6c4d506cf080f6a186787e7e312895
SHA3 aa795585d069cf321ead6e96c870b390f2c7a103c4c42497dc56eac1a030aea5

PLATFORMTARGETS

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1
MD5 598f4fe64aefab8f00bcbea4c9239abf
SHA1 688934845f22049cb14668832efa33d45013b6b9
SHA256 9b4fb24edd6d1d8830e272398263cdbf026b97392cc35387b991dc0248a628f9
SHA3 2951e8c89ecc8e8aa730f646caa10afd48f0be1353aaf5cc35815497dc6ba0db

SRC

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x5b70
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.96141
MD5 1e8db52c46a1ce6f86ef25d83bcf41ee
SHA1 14fe074aa4ec885d71e4db1dffd24262825da7f1
SHA256 f503587b9d0a593dea5bb65ab74dd79324b0c830fb882bd2ac0de593462413b8
SHA3 fcd5b8004dc15d046bb18f57705ff40e45259bdafe4932a00a3b01734e885b81

MAINICON

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.91924
Detected Filetype Icon file
MD5 6da8e7d5ae1d5d15e0230a67a7c16c6d
SHA1 678db52cbe5d617c33c6269bfd4b6d8d1a17f956
SHA256 6eb54801f91b6d8effccbfaefe6b2d7705a274a75940e6226e24e0d4ec58c396
SHA3 994fc217c7b8bc8008ac262ff58044403206de6eceafd424d4640ecad395eb2f

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x398
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.34845
MD5 d7b3927772d29e6b1d4f5a76fbb2ebc1
SHA1 15948006b7c02dfa299d9724cfc4040acb485e2e
SHA256 243451f08f41e14dff26428f25f0bdb763be6968ede242bef6623fdbcd0382ab
SHA3 8b3e25ac823d79df7721ae767bc553803d47a93edf303cd0d068e87ddb80ec50

String Table contents

Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 2000
Windows XP
Windows Server 2003
Windows Server 2003 R2
Windows Server 2012
Windows 8
cmdln
MYFILES
Error loading resources.
Could not create process.
Quick Batch File Compiler Runtime Module Version 5.x
Copyright (C) 2004-2021 Abyss Media Company, https://www.abyssmedia.com
Cannot assign a %s to a %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid file name - %s
%s.Seek not implemented
Stream write error
The specified file was not found
Argument out of range
Item not found
Duplicates not allowed
%s (Version %d.%d, Build %d, %5:s)
%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)
32-bit Edition
64-bit Edition
Windows
Windows Vista
November
December
Sun
Mon
Tue
Wed
Thu
Fri
Sat
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Jul
Aug
Sep
Oct
Nov
Dec
January
February
March
April
May
June
July
August
September
October
Exception in safecall method
Object lock not owned
Monitor support function not initialized
Feature not implemented
Method called on disposed object
%s (%s, line %d)
Abstract Error
Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
%s%s
A call to an OS function failed
Jan
Feb
Mar
Apr
May
Jun
Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation
Invalid NULL variant operation
Invalid variant operation (%s%.8x)
%s
Could not convert variant of type (%s) into type (%s)
Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Floating point underflow
Invalid pointer operation
Invalid class typecast
Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction
Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'
Variant method calls not supported
Read
Write
Error creating variant or safe array
'%d.%d' is not a valid timestamp
Invalid argument to time encode
Invalid argument to date encode
Out of memory
I/O error %d
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow
Invalid floating point operation
Floating point division by zero
Floating point overflow

Version Info

TLS Callbacks

StartAddressOfRawData 0x47a000
EndAddressOfRawData 0x47a1a0
AddressOfIndex 0x460414
AddressOfCallbacks 0x47b020
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0! [*] Warning: Section .tls has a size of 0!
<-- -->