1a5464c5d5f4ff293d732914afbcd0eb26d51a1240f503b80b7b5e526a43ef30

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Dec-05 22:50:46
Detected languages English - United States

Plugin Output

Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • LoadLibraryExA
  • GetProcAddress
 Can access the registry:
  • RegQueryValueExA
  • RegSetValueExA
  • RegEnumKeyA
  • RegEnumValueA
  • RegOpenKeyExA
  • RegDeleteKeyA
  • RegDeleteValueA
  • RegCloseKey
  • RegCreateKeyExA
 Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
 Can create temporary files:
  • CreateFileA
  • GetTempPathA
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: CYBELSOFT
Issuer: Symantec Class 3 Extended Validation Code Signing CA - G2
Safe VirusTotal score: 0/60 (Scanned on 2017-06-05 01:51:44) All the AVs think this file is safe.

Hashes

MD5 83f3c2b72e3b98e2a72ae5fdf92c164e 🔍
SHA1 f50b8a0199c93127859ced93f3cef61b7b7cb82f 🔍
SHA256 1a5464c5d5f4ff293d732914afbcd0eb26d51a1240f503b80b7b5e526a43ef30 🔍
SHA3 170f5465c57925ac25c68ac8697243307e2f2f2fe124cc88290b1b57fa5fd073 🔍
SSDeep 3072:5QIURTXJcOJyLZkxIU17YMl9yqgVivK531H74ZClS/:5syUGrSEMlg3yZwQ 🔍
Imports Hash d9e6a5e6bae798e211941a3a501049ea 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2009-Dec-05 22:50:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x5c00
SizeOfInitializedData 0x1d400
SizeOfUninitializedData 0x400
AddressOfEntryPoint 0x0000323C (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x7000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x4f000
SizeOfHeaders 0x400
Checksum 0x44e85
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0bc2ffd32265a08d72b795b18265828d 🔍
SHA1 dd2a446014a37556f39173b802c63a4e46e09366 🔍
SHA256 c5ee0a2892a4f9c317f9b33bfc3531e0235faa9a2a3b4c41bd71d39e4fd87d6f 🔍
SHA3 11ea595bc9adc98eea7c16af8a6b74aa6435a680e4c4d3de0baa4e919d3f2e25 🔍
VirtualSize 0x5a5a
VirtualAddress 0x1000
SizeOfRawData 0x5c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.4177

.rdata

MD5 f179218a059068529bdb4637ef5fa28e 🔍
SHA1 6035d27db526131eb0f29aee60cfcdbb5072ed7d 🔍
SHA256 f80bf00310bd25e46e26c4b2042fa8215c3e5ce759947fe081d25b454dfc0fbe 🔍
SHA3 1a90c2506162a31f6264cafaafb479568941dc807c95a93babd7ebe526f2181f 🔍
VirtualSize 0x1190
VirtualAddress 0x7000
SizeOfRawData 0x1200
PointerToRawData 0x6000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.18163

.data

MD5 975304d6dd6c4a4f076b15511e2bbbc0 🔍
SHA1 1f65340672c91ffd0f2583ff104beaece43c7855 🔍
SHA256 1e9a47766ca6c6ff180369d74d6db2eea7fd80b802eb3c8f1c1da79cfcafebc7 🔍
SHA3 bfd0fac532943cab215e411ffa4d4dd8a8a1063e6169fbe8f202a02192a9acae 🔍
VirtualSize 0x1af98
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.70903

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x10000
VirtualAddress 0x24000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 4cd3fcaf8fed9f328572e696a2dd8134 🔍
SHA1 d0ea4feedcc2085eb42d112923e803a6d8a7d6bb 🔍
SHA256 e4135e1023abfd9cea01d4fedc51ce699898d06804eb9cdcf1931f194e0df6d9 🔍
SHA3 d08407334ac26be124549dd2ad84ae9c2b8c2c5d6e61c03580f6c20927dc47f4 🔍
VirtualSize 0x1aaf0
VirtualAddress 0x34000
SizeOfRawData 0x1ac00
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.94007

Imports

KERNEL32.dll CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
USER32.dll EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
GDI32.dll SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
SHELL32.dll SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
ADVAPI32.dll RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
COMCTL32.dll ImageList_AddMasked
ImageList_Destroy
#17
ImageList_Create
ole32.dll CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
VERSION.dll GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.16672
MD5 b531d361b2acc2712a9dd805f76867f5 🔍
SHA1 3117051975613a7227d68ee86e1b7f4390373030 🔍
SHA256 ebfd1231d6e634816ca4e10ed29987079056da4d95f87480b2cdc45b38d83a58 🔍
SHA3 f56fdb2769ac8d80833f143846f81dd0483ea86145681df73dd918382a2bfd27 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.47555
MD5 520abbf22748627300c4015a54a37e72 🔍
SHA1 b04135effe779d9dde164cd13ca265faee64bfd1 🔍
SHA256 f6cd726d9b124777dcc1e9fe0d20ca823411c6dd37e66aa2efae2acb538b4398 🔍
SHA3 c6b2fa6eaed155379487cb428f96c86ba81559b1f254b0fbb0f11dd75247bd0b 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.65872
MD5 31df3a05cb21ffb27edd8a1362e7cc31 🔍
SHA1 9ffc3316ab890a3dd2fb1a21a7d1b1b52c333187 🔍
SHA256 df83b20010ea1b0552385bd58ea682bd9914b246f40c93b14ba85a00467d0fd5 🔍
SHA3 ee4ac50daffc51c9a8a7aea40e652db599d636bd8c095b1b50e517db4f41bef5 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x171f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.89479
Detected Filetype PNG graphic file
MD5 9a9500d893702ac3b30a168202131360 🔍
SHA1 00af8df12149faf6ef735efdf5957c54482bfd83 🔍
SHA256 079bca9990b3f2e056315ee34b41b493fd0bad5b00f10a3dafa04f1fa05a0fff 🔍
SHA3 a2242490069333a98edc92637ba0c09e94ff4cabff767bd9445f6b9e35c46592 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.95264
MD5 8aa678b513af9dd7ae16a9fee6970087 🔍
SHA1 a1afe0c48a8cd8e86cfa05d15e851d2514c6f660 🔍
SHA256 768b02485bdc5b008bda42a93fe155921c66b4d3a5426153463d852085d15853 🔍
SHA3 6c2cc80d25b3445193fcab7a5bc4e0a33dceca5f7755c78b515e16db7dcd0195 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.65074
MD5 ab89a988b85242b9812c101dffa40948 🔍
SHA1 d35b7d1612c7f219992448d898ece1f7ca636929 🔍
SHA256 ad416ba12526f8c3191a57f3a12bdd16f6c79fa21138c7b9cea9fd6b0a18774d 🔍
SHA3 f6419620d75bd8cac9c67b68026bc8623a6691514f8b98e52450fb267155799c 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 982079681d7ad12766abc44f06946f3e 🔍
SHA1 50f73ed0787bf5911bb907e487efbc84a9714e48 🔍
SHA256 250f52cb2d6f1966a29f6ac771fa1cd185b8f8531396c8a4026c0fe635617e0c 🔍
SHA3 b8805d45012d79cfa8bb45e23c9b4a4421cd91538d569e58437efa0f545cf4d4 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73893
MD5 386770584473e271f23dced36427f4ff 🔍
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19 🔍
SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014 🔍
SHA3 db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17 🔍
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc 🔍
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 🔍
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92787
MD5 5dfa289639a3bcc0497da8db163f01fe 🔍
SHA1 6e2c6ea1e2594b66f563fb589276642c127e875f 🔍
SHA256 18466509968c3c0bf92ba410fea075def2b257a5a799a113cbc60f13e75f4b01 🔍
SHA3 85abdc8c431d91c72f3595a39881c96637ead09a0278d3cec0c1c9a8d873f031 🔍

205

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03251
MD5 16e4e392aaffaa0ee7e77b5be867e10f 🔍
SHA1 f7f681d8ec7c8a1aaa98b7a1d6bf14cfe730bbec 🔍
SHA256 699e0b19b7a5592c6cd94847130b28d57bf86ea61019043b9a6a3c88e6debc3d 🔍
SHA3 e91dc6b4bb438e908867a57a350a8f08d1116bc10d1694ba284a5a44360277b3 🔍

206

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10966
MD5 1ffe62afd7fe045c34a23ea5c9c7eb22 🔍
SHA1 ac211007f1f7a65d868d6e9e658d5ff26dec9c8e 🔍
SHA256 184073a317c843cbe92b68cfacebcf5d73dedb538b3f79c048090f3ee5b614ff 🔍
SHA3 f34fe335d0a39aedd236cfe40879f6624bc468df8195f5360c1d7267f2bd0113 🔍

211

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06584
MD5 7ce8a17102daebb8d864cd1063e987d1 🔍
SHA1 072345a235d4947d36b53fd47da68e7e6a93fe62 🔍
SHA256 0fd40b240b9df8f2dece8947dabbebce898f12becca8e196136e4231efba2dc1 🔍
SHA3 59c7281c1d6dca36fed8a44ee5b408f11090812626d5c5fe1da3d72b526208ab 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.96825
Detected Filetype Icon file
MD5 43a7f167eba122852f6acafc09e48511 🔍
SHA1 6fa2a9a5cb0375d8cd306ec22c8d8c43fc53c2e3 🔍
SHA256 8e44fd3483062812bfc0a36cb5b75715ef347633e586433b69cd210eba8496a8 🔍
SHA3 7781b952b0869dc4ca8b0c956f0aadb4779e8732c6e4b3d5601fc00fd50a426c 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x215
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.10394
MD5 6f1fa2dee815707f6c8db07afb4b18c1 🔍
SHA1 c96d1933d55c50e9d6ef96edd688ceedd40bb203 🔍
SHA256 88c91f1165efa7a0b506ba4eba225b865b4f41798c813648a1677f6bf3e1efcd 🔍
SHA3 ec52942465ed8024f844234fed6211fe66082c8fe074eed5103b3e825c09b617 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x69ead975
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 155
Imports (VS2003 (.NET) build 4035) 17
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0! [*] Warning: [plugin_authenticode] Hashing algorithm 1.2.840.1015.13.2.5 is not supported.
Leave a comment

No comments yet.