188a12e951090d6a92fcf879b5e19fbbe988e84795a30df605f6ad930423b9ab

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Sep-09 16:51:56
Debug artifacts C:\Users\Public\AppData\Local\vstsAgent\CI-Dev\_work\46\s\src\iShipPrep\obj\x86\Release\iShipPrep.pdb
Comments Performs administrative setup of iShip components and data files.
CompanyName iShip, Inc.
FileDescription iShipPrep
FileVersion 2.0.7.0
InternalName iShipPrep.exe
LegalCopyright Copyright (c) 2009-2024 iShip, Inc.
LegalTrademarks Shipping Insight.
OriginalFilename iShipPrep.exe
ProductName iShipPrep
ProductVersion 2.0.7.0
Assembly Version 2.0.7.0

Plugin Output

Info Matching compiler(s): .NET DLL -> Microsoft
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to internet browsers:
  • chrome.exe
  • firefox.exe
  • iexplore.exe
 Contains references to security software:
  • rshell.exe
 May have dropper capabilities:
  • %TEMP%
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • http://wixtoolset.org
  • iship.com
  • wixtoolset.org
Info The PE is digitally signed. Signer: iShip Inc.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Safe VirusTotal score: 0/64 (Scanned on 2025-09-30 07:46:25) All the AVs think this file is safe.

Hashes

MD5 497f19c9f3f7b9f5118f5e809645ba25 🔍
SHA1 4d93df7bf25a919719027bf96d684bdc318a0dd0 🔍
SHA256 188a12e951090d6a92fcf879b5e19fbbe988e84795a30df605f6ad930423b9ab 🔍
SHA3 6661a70b437d1100ec7b721b25cfdef6b759d60edb52352720c5d26577ff24a6 🔍
SSDeep 6144:dcvGW1oCHuhO99YzOaaKgTqDXRCADMH5khqOOLeE+QciAeNz8FKZPsKn:30oCHuhOszHXRCd5kEOOL6Kn 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2024-Sep-09 16:51:56
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x5bc00
SizeOfInitializedData 0x1800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0005DA46 (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x5e000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x62000
SizeOfHeaders 0x200
Checksum 0x639ed
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 96c04e41cb460978bfc50281d7f18437 🔍
SHA1 2602d6f011a6cacc2414c4612b305ca4a72a2da6 🔍
SHA256 f4a510b60c8fb3466907efa44fae3e49c6df96f0f6efa948e7ac9577aaa9f137 🔍
SHA3 4a27e4ac7f3fa1c5263c2385b6b3ed2369117439b4a8a1043df1f92b6df39d05 🔍
VirtualSize 0x5ba70
VirtualAddress 0x2000
SizeOfRawData 0x5bc00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.56316

.rsrc

MD5 ff4c59f59fac0428562a1b8d0be4f736 🔍
SHA1 10a698978ad8e5a8e6942b33737d47e1fe7d7ff0 🔍
SHA256 ebb5d26ba5331982432970947a0429e5d221c4e04c850ae39abdb07cd9259a69 🔍
SHA3 5b3928a33831e69e729fcaeb48d17c6beb857a1ca1fa7c794de89807ad208f67 🔍
VirtualSize 0x1510
VirtualAddress 0x5e000
SizeOfRawData 0x1600
PointerToRawData 0x5be00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.7981

.reloc

MD5 d0a9f26b1cd1bbd1dec1364b140e6c26 🔍
SHA1 189462e8beb7193d653343e9c25197c66ef45efb 🔍
SHA256 5db12d9024354c24abb404eac99b4cc17c8e2db2017251f2c4285a911a406b03 🔍
SHA3 7290000607a8e1aefb0bb7f21d1521786af0f9b6db1de81aafaf4894a1ad6af5 🔍
VirtualSize 0xc
VirtualAddress 0x60000
SizeOfRawData 0x200
PointerToRawData 0x5d400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31479
MD5 197b63280f91095e907cbbe18f215cbf 🔍
SHA1 a26f5bf0cbb26456bd7ff42e0ac402a768b606a5 🔍
SHA256 3cdf7bec99bd3b344a0328bec8b97e67d4e5a84a60429cdd935b93e5fe2f6ed4 🔍
SHA3 ba2c85a0aa6e287b16ef92bedca572b614a2b84da9abdd51aa98cb5741c92d05 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.81924
Detected Filetype Icon file
MD5 cbee427fa121aba9b9b265ff05de5383 🔍
SHA1 24fcae33001c8e0f5ec795c6edf076a69d59589f 🔍
SHA256 494e4fd717fa1ee0c5c7bb3b4e28fdab4b7f6e95b4f9865f5ab86f03f62ae62c 🔍
SHA3 a3fa35d56632275ba55716a4964f02031270f61f06a903fc460ac2dd6bebde85 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x3f4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.39224
MD5 e6d1e49dde7d48119fff8d428add5cb8 🔍
SHA1 71766f9ebb563d9bc605dd49ace355d3581e902b 🔍
SHA256 943c76751534918cbdb53a7c8520bbd3e95b586924b3c2a3a78f8ffcfb096c84 🔍
SHA3 6bb2254e01cafbe972079c8ade5185d07df88bd3e6805451973e14924b4661ed 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x729
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.33397
MD5 56d85efa88a054728be3e1638ac08676 🔍
SHA1 e877f8006f925a3d5926e68efdba7c49f77b6b42 🔍
SHA256 43c2d85ce2f26dbb55b11995000cfb8dff6081bc583767b4356e393f698e7a1a 🔍
SHA3 025a4f660901d09f042a479b635e9c00e004176bbc95c09003f23cd0df0b6c41 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.0.7.0
ProductVersion 2.0.7.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments Performs administrative setup of iShip components and data files.
CompanyName iShip, Inc.
FileDescription iShipPrep
FileVersion (#2) 2.0.7.0
InternalName iShipPrep.exe
LegalCopyright Copyright (c) 2009-2024 iShip, Inc.
LegalTrademarks Shipping Insight.
OriginalFilename iShipPrep.exe
ProductName iShipPrep
ProductVersion (#2) 2.0.7.0
Assembly Version 2.0.7.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2024-Sep-09 16:51:56
Version 0.0
SizeofData 284
AddressOfRawData 0x5d8d8
PointerToRawData 0x5bad8
Referenced File C:\Users\Public\AppData\Local\vstsAgent\CI-Dev\_work\46\s\src\iShipPrep\obj\x86\Release\iShipPrep.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.