1af0906a9977c2f6c3a414f49e15ba0e5053d3b740b503a0e61d49464281a544

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2019-Apr-02 22:54:52
Detected languages English - United States
Debug artifacts C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x64\StubExe.pdb
CompanyName Code Systems Corporation
FileDescription Turbo Virtual Machine Executable
FileVersion 19.4.1394.0
InternalName StubExe.exe
LegalCopyright Copyright © 2017 Code Systems Corporation
OriginalFilename StubExe.exe
ProductName Turbo Virtual Machine
ProductVersion 19.4.1394.0

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
 Manipulates other processes:
  • OpenProcess
Info The PE is digitally signed. Signer: Code Systems Corporation
Issuer: COMODO RSA Code Signing CA
Safe VirusTotal score: 0/71 (Scanned on 2019-05-16 20:48:39) All the AVs think this file is safe.

Hashes

MD5 75e9acc6e4ba7bc31a0d4d83d8346576 🔍
SHA1 35174280d00d14f3bdbd5165fedb3dd0a5d636d7 🔍
SHA256 1af0906a9977c2f6c3a414f49e15ba0e5053d3b740b503a0e61d49464281a544 🔍
SHA3 12ecdb75e3a9ca1802888d82fe3a5d4bf040ee0f8cd3341c5dd84561fdee2099 🔍
SSDeep 768:+IO8Mnh47Q+arvOzZ7FYkfkqSU4Nhi0xDiP:+IOQM+MvOhFYkfkhJNI0xDiP 🔍
Imports Hash 92f694988deed85a7cb067c901f32a93 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 5
TimeDateStamp 2019-Apr-02 22:54:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 11.0
SizeOfCode 0x5200
SizeOfInitializedData 0xe00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000002CD4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 0.0
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0xb000
SizeOfHeaders 0x400
Checksum 0xa667
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e7271c1a491a68bd8e869fe9b6c38d3d 🔍
SHA1 ba73fb1ca6b0fa5f727e7f118ca80f627b612e54 🔍
SHA256 56b1652853c80bc6ecf133dcbaa949f3b94da29fac4fb60e8fbdd1a2c596c8fd 🔍
SHA3 e6189846a6c121674071dd18de5c5ff3d45bb92af415a3a9e0aed04fa99f29c4 🔍
VirtualSize 0x5156
VirtualAddress 0x1000
SizeOfRawData 0x5200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.19311

.data

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x4a8
VirtualAddress 0x7000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata

MD5 8600491e079dcbee45dba9d41055cb6b 🔍
SHA1 06893b4b5eb6318b36992dad91263ab05b657052 🔍
SHA256 ea7f41555b9bc838cbff72d79ddf8fa1ad4bd01ee6b65e4940330e59bb01023b 🔍
SHA3 3a68affd6092037a1579ada87086930b57691c0a5f8f4f3026234242a0993a60 🔍
VirtualSize 0x168
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.93796

.rsrc

MD5 dc3521a8d616d65ef0719a0190ccb14b 🔍
SHA1 c182af70faf68486e098f43d7e2797bd1b2d9678 🔍
SHA256 a96983d14b5152f57eb4e189e554837629d551b21542cba6d52a8d6d2ac1c589 🔍
SHA3 d6e0e18a7d63f8392b9c622b0744b4d8c07576c171d158d615c0aa04e42f65c0 🔍
VirtualSize 0x3b0
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x5800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.12148

.reloc

MD5 e9b5a365d6580af2807cc9f60e49f7ac 🔍
SHA1 8f4799dfd8229305d40f7dd47335a1ef7fe0a76e 🔍
SHA256 3f38e2186416571df117985087976e56ae153bc4d058572259d2974bbae1656f 🔍
SHA3 cb74f4633f2deb2a24360b1518f7e1bd1b20cf4a377b7a210b801ddba37a5893 🔍
VirtualSize 0x6e
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x5c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.373034

Imports

KERNEL32.dll HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x34c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.46696
MD5 f0df1cd6c7de0386e4a83d3ec538d32b 🔍
SHA1 8fc745d21944eaa066c258ed3d38a761c9a9a356 🔍
SHA256 046178247dde49cbc4f2da244b9198259b1aebd524817bed49fdb46621da065c 🔍
SHA3 2065ab1f1e269559c2c9cd9bab79ddaa12886c575faeac8156cb8b9c0a9cc26f 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 19.4.1394.0
ProductVersion 19.4.1394.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Code Systems Corporation
FileDescription Turbo Virtual Machine Executable
FileVersion (#2) 19.4.1394.0
InternalName StubExe.exe
LegalCopyright Copyright © 2017 Code Systems Corporation
OriginalFilename StubExe.exe
ProductName Turbo Virtual Machine
ProductVersion (#2) 19.4.1394.0
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2019-Apr-02 22:54:52
Version 0.0
SizeofData 106
AddressOfRawData 0x2418
PointerToRawData 0x1818
Referenced File C:\bamboo-home\xml-data\build-dir\SPOONVM-VM-JOB1\vm\Build\Output\x64\StubExe.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2019-Apr-02 22:54:52
Version 0.0
SizeofData 16
AddressOfRawData 0x2484
PointerToRawData 0x1884

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x2f8bfe07
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 3
Total imports 29
211 (VS2012 UPD4 build 61030) 11
Resource objects (VS2012 UPD4 build 61030) 1
Linker (VS2012 UPD4 build 61030) 1

Errors

[*] Warning: Section .data has a size of 0!
Leave a comment

No comments yet.