Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 1992-Jun-19 22:22:17 |
Detected languages |
Turkish - Turkey
|
CompanyName | Synaptics |
FileDescription | Synaptics Pointing Device Driver |
FileVersion | 1.0.0.4 |
InternalName | |
LegalCopyright | |
LegalTrademarks | |
OriginalFilename | |
ProductName | Synaptics Pointing Device Driver |
ProductVersion | 1.0.0.0 |
Comments |
Suspicious | PEiD Signature: | D1S1G v1.1 beta --> D1N |
Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Malicious | The PE is possibly a dropper. | Resource KBHKS detected as a PE Executable. |
Malicious | VirusTotal score: 65/70 (Scanned on 2024-01-27 12:17:22) |
ALYac:
Win32.Comet.A
APEX: Malicious AVG: Win32:Zorex-E [Wrm] Acronis: suspicious AhnLab-V3: Win32/Zorex.X1800 Alibaba: Backdoor:Win32/DarkKomet.353 Antiy-AVL: Virus/Win32.DarkKomet.a Arcabit: HEUR.VBA.Trojan.d Avast: Win32:Zorex-E [Wrm] Avira: TR/Dldr.Agent.SH BitDefender: Win32.Comet.A BitDefenderTheta: AI:Packer.F5AF03D517 Bkav: W32.Common.A575260F CAT-QuickHeal: Sus.Nocivo.E0011 ClamAV: Win.Trojan.Emotet-9850453-0 CrowdStrike: win/malicious_confidence_100% (W) Cybereason: malicious.6fc9db Cylance: unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Win32.HLLW.Siggen.10555 ESET-NOD32: Win32/Delf.NBX Elastic: malicious (high confidence) Emsisoft: Win32.Comet.A (B) F-Secure: Trojan:W97M/MaliciousMacro.GEN FireEye: Generic.mg.16c29fefd14ada0d Fortinet: VBA/Agent.IGI!tr.dldr GData: Win32.Backdoor.Agent.AXS Google: Detected Gridinsoft: Malware.Win32.Gen.sm!s1 Ikarus: Trojan-PWS.Win32.QQPass Jiangmin: Win32/Synaptics.Gen K7AntiVirus: Trojan ( 000112511 ) K7GW: Trojan ( 000112511 ) Kaspersky: Trojan.Win32.XRed.mg Kingsoft: malware.kb.a.1000 MAX: malware (ai score=82) Malwarebytes: Generic.Malware.AI.DDS MaxSecure: Trojan.Malware.1767938.susgen McAfee: GenericRXBW-CE!16C29FEFD14A MicroWorld-eScan: Win32.Comet.A Microsoft: Worm:Win32/AutoRun!atmn NANO-Antivirus: Trojan.Win32.DarkKomet.fazbwq Panda: Trj/Genetic.gen Rising: Virus.Synaptics!1.E51C (CLASSIC) SUPERAntiSpyware: Adware.FileTour/Variant Sangfor: Trojan.Win32.Save.a SentinelOne: Static AI - Malicious PE Skyhigh: BehavesLike.Win32.Obfuscated.bh Sophos: Troj/DocDl-JJH Symantec: W32.Zorex TACHYON: Backdoor/W32.DP-DarkKomet.771584 Tencent: Virus.Win32.DarkKomet.a TrendMicro: Virus.Win32.NAPWHICH.D.orig TrendMicro-HouseCall: Backdoor.Win32.DARKCOMET.ENR VBA32: TScope.Trojan.Delf VIPRE: Win32.Comet.A Varist: W32/Backdoor.OAZM-5661 ViRobot: Win32.Zorex.A Webroot: W32.Malware.gen Xcitium: Virus.Win32.Agent.DE@74b38h Yandex: BackDoor.Optix!acYWFyhu7MM Zillya: Trojan.Delf.Win32.76144 ZoneAlarm: Trojan.Win32.XRed.mg Zoner: Trojan.DOC.132395 |
e_magic | MZ |
---|---|
e_cblp | 0x50 |
e_cp | 0x2 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0xf |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0x1a |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x100 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 8 |
TimeDateStamp | 1992-Jun-19 22:22:17 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Magic | PE32 |
---|---|
LinkerVersion | 2.0 |
SizeOfCode | 0x99c00 |
SizeOfInitializedData | 0x22600 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x0009AB80 (Section: CODE) |
BaseOfCode | 0x1000 |
BaseOfData | 0x9b000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 4.0 |
ImageVersion | 0.0 |
SubsystemVersion | 4.0 |
Win32VersionValue | 0 |
SizeOfImage | 0xc2000 |
SizeOfHeaders | 0x400 |
Checksum | 0 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x4000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
kernel32.dll |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte SetCurrentDirectoryA MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLastError GetCurrentDirectoryA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle |
---|---|
user32.dll |
GetKeyboardType
LoadStringA MessageBoxA CharNextA |
advapi32.dll |
RegQueryValueExA
RegOpenKeyExA RegCloseKey |
oleaut32.dll |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
kernel32.dll (#2) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte SetCurrentDirectoryA MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLastError GetCurrentDirectoryA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle |
advapi32.dll (#2) |
RegQueryValueExA
RegOpenKeyExA RegCloseKey |
kernel32.dll (#3) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte SetCurrentDirectoryA MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLastError GetCurrentDirectoryA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle |
version.dll |
VerQueryValueA
GetFileVersionInfoSizeA GetFileVersionInfoA |
gdi32.dll |
UnrealizeObject
StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SaveDC RestoreDC RectVisible RealizePalette PlayEnhMetaFile PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsA GetTextExtentPoint32A GetSystemPaletteEntries GetStockObject GetPixel GetPaletteEntries GetObjectA GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits GdiFlush ExcludeClipRect DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectA CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileA BitBlt |
user32.dll (#2) |
GetKeyboardType
LoadStringA MessageBoxA CharNextA |
ole32.dll |
CLSIDFromString
|
kernel32.dll (#4) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte SetCurrentDirectoryA MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLastError GetCurrentDirectoryA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle |
oleaut32.dll (#2) |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
ole32.dll (#2) |
CLSIDFromString
|
oleaut32.dll (#3) |
SysFreeString
SysReAllocStringLen SysAllocStringLen |
comctl32.dll |
ImageList_SetIconSize
ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_SetDragCursorImage ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_GetImageCount ImageList_Destroy ImageList_Create |
shell32.dll |
ShellExecuteExA
ExtractIconExW |
wininet.dll |
InternetGetConnectedState
InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle |
shell32.dll (#2) |
ShellExecuteExA
ExtractIconExW |
advapi32.dll (#3) |
RegQueryValueExA
RegOpenKeyExA RegCloseKey |
wsock32.dll |
WSACleanup
WSAStartup gethostname gethostbyname inet_ntoa |
netapi32.dll |
Netbios
|
Error connecting with SSL. |
SetCipher failed. |
Error creating SSL context. |
Could not load root certificate. |
Could not load certificate. |
Could not load key, check password. |
Error geting SSL method. |
Error binding data to SSL socket. |
Mode has not been set. |
Could not load SSL library. |
SSL status: "%s" |
Uneven size in DecodeToStream. |
Uneven size in Encode. |
Message encoder not found |
Unrecognized UUE encoding scheme. |
Request rejected or failed. |
Request rejected because SOCKS server cannot connect. |
Request rejected because the client program and identd report different user-ids. |
Unknown socks error. |
Socks server did not respond. |
Invalid socks authentication method. |
Authentication error to socks server. |
General SOCKS server failure. |
Connection not allowed by ruleset. |
Network unreachable. |
Host unreachable. |
Connection refused. |
TTL expired. |
Command not supported. |
Address type not supported. |
Error accepting connection with SSL. |
Software caused connection abort. |
Connection reset by peer. |
No buffer space available. |
Socket is already connected. |
Socket is not connected. |
Cannot send or receive after socket is closed. |
Too many references, cannot splice. |
Connection timed out. |
Connection refused. |
Too many levels of symbolic links. |
File name too long. |
Host is down. |
No route to host. |
Directory not empty |
Host not found. |
TIdMessagePart can not be created. Use descendant classes. |
Operation already in progress. |
Socket operation on non-socket. |
Destination address required. |
Message too long. |
Protocol wrong type for socket. |
Bad protocol option. |
Protocol not supported. |
Socket type not supported. |
Operation not supported on socket. |
Protocol family not supported. |
Address family not supported by protocol family. |
Address already in use. |
Cannot assign requested address. |
Network is down. |
Network is unreachable. |
Net dropped connection or reset. |
%s |
Connect timed out. |
Encoding text |
Encoding attachment |
Unknown Message Part Type. |
Invalid Encoding. UU only allows Body and Attachments |
%s is not a valid service. |
Socket Error # %d |
%s |
Interrupted system call. |
Bad file number. |
Access denied. |
Bad address. |
Invalid argument. |
Too many open files. |
Operation would block. |
Operation now in progress. |
Only one TIdAntiFreeze can exist per application. |
Not Connected |
Object type not supported. |
No data to read. |
Can not bind in port range (%d - %d) |
Invalid Port Range (%d - %d) |
Read Timeout |
Max line length exceeded. |
@ Outside address |
Error on call Winsock2 library function %s |
Error on loading Winsock2 library (%s) |
Resolving hostname %s. |
Connecting to %s. |
Connected. |
Disconnecting. |
Disconnected. |
Cannot change the size of a JPEG image |
JPEG error #%d |
JPEG Image File |
OLE error %.8x |
Method '%s' not supported by automation object |
Variant does not reference an automation object |
Dispatch methods do not support more than 64 parameters |
Already connected. |
Cannot allocate socket. |
Connection Closed Gracefully. |
Could not bind socket. Address and port are already in use. |
Failed attempting to retrieve time zone information. |
Not enough data in buffer. |
Winsock Initialization Error. |
Set Size Exceeded. |
File "%s" not found |
Highlight Text |
Inactive Border |
Inactive Caption |
Inactive Caption Text |
Info Background |
Info Text |
Menu Background |
Menu Text |
None |
Scroll Bar |
3D Dark Shadow |
3D Light |
Window Background |
Window Frame |
Window Text |
No help keyword specified. |
Money Green |
Sky Blue |
Cream |
Medium Gray |
Active Border |
Active Caption |
Application Workspace |
Background |
Button Face |
Button Highlight |
Button Shadow |
Button Text |
Caption Text |
Default |
Gray Text |
Highlight Background |
Black |
Maroon |
Green |
Olive |
Navy |
Purple |
Teal |
Gray |
Silver |
Red |
Lime |
Yellow |
Blue |
Fuchsia |
Aqua |
White |
Ins |
Del |
Shift+ |
Ctrl+ |
Alt+ |
Clipboard does not support Icons |
Text exceeds memo capacity |
Menu '%s' is already being used by another form |
Docked control must have a name |
Error removing control from dock tree |
- Dock zone not found |
- Dock zone has no control |
Unable to find a Table of Contents |
No help found for %s |
No context-sensitive help installed |
No topic-based help system installed |
&All |
N&o to All |
Yes to &All |
BkSp |
Tab |
Esc |
Enter |
Space |
PgUp |
PgDn |
End |
Home |
Left |
Up |
Right |
Down |
Metafiles |
Enhanced Metafiles |
Icons |
Bitmaps |
Warning |
Error |
Information |
Confirm |
&Yes |
&No |
OK |
Cancel |
&Help |
&Abort |
&Retry |
&Ignore |
Sub-menu is not in menu |
Not enough timers available |
GroupIndex cannot be less than a previous menu item's GroupIndex |
Cannot create form. No MDI forms are currently active |
A control cannot have itself as its parent |
OK |
Cancel |
&Yes |
&No |
&Help |
&Close |
&Ignore |
&Retry |
Abort |
&All |
Cannot drag a form |
Out of system resources |
Canvas does not allow drawing |
Invalid image size |
Invalid ImageList |
Invalid ImageList Index |
Failed to read ImageList data from stream |
Failed to write ImageList data to stream |
Error creating window device context |
Error creating window class |
Cannot focus a disabled or invisible window |
Control '%s' has no parent window |
Cannot hide an MDI Child Form |
Cannot change Visible in OnShow or OnHide |
Cannot make a visible window modal |
Menu index out of range |
Menu inserted twice |
Failed to set data for '%s' |
Resource %s not found |
%s.Seek not implemented |
Operation not allowed on sorted list |
%s not in a class registration group |
Property %s does not exist |
Stream write error |
Thread creation error: %s |
Thread Error: %s (%d) |
Bitmap image is not valid |
Icon image is not valid |
Metafile is not valid |
Invalid pixel format |
Scan line index out of range |
Cannot change the size of an icon |
Unsupported clipboard format |
Cannot open file "%s". %s |
Unable to write to %s |
Invalid stream format |
''%s'' is not a valid component name |
Invalid property value |
Invalid property path |
Invalid property value |
Invalid data type for '%s' |
List capacity out of bounds (%d) |
List count out of bounds (%d) |
List index out of bounds (%d) |
Out of memory while expanding memory stream |
Error reading %s%s%s: %s |
Stream read error |
Property is read-only |
Failed to get data for '%s' |
Tuesday |
Wednesday |
Thursday |
Friday |
Saturday |
Ancestor for '%s' not found |
Cannot assign a %s to a %s |
Bits index out of range |
Can't write to a read-only resource stream |
CheckSynchronize called from thread $%x, which is NOT the main thread |
Class %s not found |
A class named %s already exists |
List does not allow duplicates ($0%x) |
A component named %s already exists |
String list does not allow duplicates |
Cannot create file "%s". %s |
June |
July |
August |
September |
October |
November |
December |
Sun |
Mon |
Tue |
Wed |
Thu |
Fri |
Sat |
Sunday |
Monday |
Feb |
Mar |
Apr |
May |
Jun |
Jul |
Aug |
Sep |
Oct |
Nov |
Dec |
January |
February |
March |
April |
May |
Overflow while converting variant of type (%s) into type (%s) |
Variant overflow |
Invalid argument |
Invalid variant type |
Operation not supported |
Unexpected variant error |
External exception %x |
Assertion failed |
Interface not supported |
Exception in safecall method |
%s (%s, line %d) |
Abstract Error |
Access violation at address %p in module '%s'. %s of address %p |
System Error. Code: %d. |
%s |
A call to an OS function failed |
Jan |
Operation aborted |
Exception %s in module %s at %p. |
%s%s |
Application Error |
Format '%s' invalid or incompatible with argument |
No argument for format '%s' |
Variant method calls not supported |
Read |
Write |
Error creating variant or safe array |
Variant or safe array index out of bounds |
Variant or safe array is locked |
Invalid variant type conversion |
Invalid variant operation |
Invalid NULL variant operation |
Invalid variant operation (%s%.8x) |
%s |
Could not convert variant of type (%s) into type (%s) |
Disk full |
Invalid numeric input |
Division by zero |
Range check error |
Integer overflow |
Invalid floating point operation |
Floating point division by zero |
Floating point overflow |
Floating point underflow |
Invalid pointer operation |
Invalid class typecast |
Access violation at address %p. %s of address %p |
Access violation |
Stack overflow |
Control-C hit |
Privileged instruction |
'%s' is not a valid integer value |
'%s' is not a valid floating point value |
'%s' is not a valid date |
'%s' is not a valid time |
'%s' is not a valid date and time |
'%s' is not a valid GUID value |
'%s' is not a valid boolean value |
Invalid argument to time encode |
Invalid argument to date encode |
Out of memory |
I/O error %d |
File not found |
Invalid filename |
Too many open files |
File access denied |
Read beyond end of file |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 1.0.0.4 |
ProductVersion | 1.0.0.4 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | Turkish - Turkey |
CompanyName | Synaptics |
FileDescription | Synaptics Pointing Device Driver |
FileVersion (#2) | 1.0.0.4 |
InternalName | |
LegalCopyright | |
LegalTrademarks | |
OriginalFilename | |
ProductName | Synaptics Pointing Device Driver |
ProductVersion (#2) | 1.0.0.0 |
Comments |
Resource LangID | Turkish - Turkey |
---|
StartAddressOfRawData | 0x4a3000 |
---|---|
EndAddressOfRawData | 0x4a3010 |
AddressOfIndex | 0x49b0c4 |
AddressOfCallbacks | 0x4a4010 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_TYPE_REG
|
Callbacks | (EMPTY) |