1b7659064551c22617ba40af5d337d81

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages Greek - Greece

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: CODE
Unusual section name found: DATA
Unusual section name found: BSS
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • GetProcAddress
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • FindWindowA
Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • CallNextHookEx
Can take screenshots:
  • CreateCompatibleDC
  • BitBlt
  • GetDCEx
  • GetDC
  • FindWindowA
Reads the contents of the clipboard:
  • GetClipboardData
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2008-Mar-08 23:14:46
Malicious VirusTotal score: 3/69 (Scanned on 2018-10-25 00:39:40) Cylance: Unsafe
F-Prot: W32/A-b966fcd6!Eldorado
Cyren: W32/A-b966fcd6!Eldorado

Hashes

MD5 1b7659064551c22617ba40af5d337d81
SHA1 6d3127ff26182451774c282ebab9f6758e737da4
SHA256 3118b02168a7e132dd4fad945a11ba711d2c01433181ffd3c4de42096a76eaa8
SHA3 12f32c62b861d7a0dd1d6078b6298bd7a582126326f9f704a7297d20d38dcace
SSDeep 6144:r6rou3C70MC26ftiI1Y5mroaFtMymcZ805xOanL+FY5keUufuuZr9Q2GohhThlN:+rou3Cg26fT5bPxN+FhufB/QfGvN
Imports Hash cb557df42863a3baaa9f9dea23e495d1

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x53600
SizeOfInitializedData 0xea00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00054450 (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0x55000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x69000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 73a2f38c27a2bdd56b9f05c4f65defef
SHA1 d16b4dab2124924f8c227bf3e6325e840980f6b0
SHA256 357ba7416eec13a7ff66d15236651f3384cdd6431bd50de24c2e3f14b561c4f2
SHA3 67c5ad6aeeacb77f74e02b3f15531fcd3c788217c32b42833578b22a40ed6e70
VirtualSize 0x53498
VirtualAddress 0x1000
SizeOfRawData 0x53600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.51305

DATA

MD5 faf995daf37d2a70b909a1fa9078033f
SHA1 af3fb1714b9b119cada7e26f1ab1a392868c672d
SHA256 5fcda843d610fa3b59bc1ba38899ed06ff73027b8a88b9691c6257151ffd7620
SHA3 2a07bc7498fb0d8a097d7869dc7bfbe9706a97529243e918ecee6ee828d385bd
VirtualSize 0x11c8
VirtualAddress 0x55000
SizeOfRawData 0x1200
PointerToRawData 0x53a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.14358

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xc05
VirtualAddress 0x57000
SizeOfRawData 0
PointerToRawData 0x54c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 7d227aec50dee103ae75dff5d37e4a9b
SHA1 4a67fb949c612e798d14f3f9f7aee729de2f2547
SHA256 6817eaa3fadccf796522fb251db4d21420f8e54695b6dcd22514ff92783c7d9b
SHA3 aae051b5c5d241608e13825ee1c1f1b0c245731e9033d403578a1e0033d1856b
VirtualSize 0x2106
VirtualAddress 0x58000
SizeOfRawData 0x2200
PointerToRawData 0x54c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.96252

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x10
VirtualAddress 0x5b000
SizeOfRawData 0
PointerToRawData 0x56e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 cd3a36866c0300d95fd9b3562cca8856
SHA1 4808adaf1dcdf797b21fdfb6d93e5200818a9dbe
SHA256 dd6b0ba21dbb3ba6ce57aced3e97e2af40dfa8a29a00c98066b0d38924d0d101
SHA3 a6a5236c3055cc9ae914161812a9eb11fbaaa63dec1a533bb85b7bc9087a8d3c
VirtualSize 0x18
VirtualAddress 0x5c000
SizeOfRawData 0x200
PointerToRawData 0x56e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 0.200582

.reloc

MD5 bc7f62307e2c254fc93497cc5d0747d8
SHA1 6f017be74ba65f41056278495499ea1e2abe54ee
SHA256 7d1e2057ecd2eecfba0bec262d88179620b559bd6768d70854377193dfa748b6
SHA3 b3244cf0062f4eac0ce30e995a72eca55e7131eda6902b815f3eaa09bdf3798b
VirtualSize 0x5fc4
VirtualAddress 0x5d000
SizeOfRawData 0x6000
PointerToRawData 0x57000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 6.66866

.rsrc

MD5 18ef0fe4c509ca749a7332432d9e0b58
SHA1 7d0a827292d55931b66d6cc9dd52a2a67bdcf294
SHA256 99d4ee250385bbfdc28b00f85a8ec9e27b0752a7a6c02851efa87a8d312abe01
SHA3 daa3a28138ac3d5c944906161a5a5e5fe23521152330809e2b6a8ff28198fc7e
VirtualSize 0x5400
VirtualAddress 0x63000
SizeOfRawData 0x5400
PointerToRawData 0x5d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 4.25482

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll (#3) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
version.dll VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32.dll UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
user32.dll (#2) GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
kernel32.dll (#4) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
oleaut32.dll (#2) SysFreeString
SysReAllocStringLen
SysAllocStringLen
comctl32.dll ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

Delayed Imports

1

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.6633
MD5 ff4e5862f26ea666373e5fab2bddfb11
SHA1 cfa13c0ab30f1bbd566900dee3631902f9b6451c
SHA256 b8e6fc93d423931acbddae3c27dd3c4eb2a394005d746951a971cb700e0ee510
SHA3 91dae12a9f43c5443e0661091a336f882fa1482f75fa9a57c9298d1d70c8ae69

2

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.80231
MD5 2e87b3c111e3073a841775c1f8ec5a90
SHA1 20292304fa2ef1bfdc4a1000e90a1c16d4765a96
SHA256 ce19ace18e87b572e6912306776226af5b8e63959c61cde70a8ff05b3bbdcc41
SHA3 9527f09e739c2064835800a7e5c317cb422bdd7237f00fca079a1c62f58a2612

3

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.00046
MD5 a04c3c368cb37c07bd5f63e7e6841ebd
SHA1 699300bceaa1256818c43fecfc8cad93a59156b2
SHA256 ee1c9c194199c320c893b367602ccc7ee7270bd4395d029f727e097634f47f8c
SHA3 58722e3138aad1382e284c1605ecd665ced536de4906749ac8d6e11252cc9558

4

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.56318
MD5 9929115b21c2c59348058d4190392e75
SHA1 626fba1825d572ea441d36363307c9935de3c565
SHA256 9d9edf87ca203ecc60b246cc783d54218dd0ce77d3a025d0bafc580995a4abd8
SHA3 fea156e872544252c625076a6bf3baa733ee5b3d5399716e156734af7a841369

5

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.6949
MD5 f321ad13d1c3f35a05d67773b4bc27d6
SHA1 30aded8525417e2531d5eb88bf2f868172945baa
SHA256 99676c52310db365580965ea646ece86c62951bfd97ec0aae9f738a202a90593
SHA3 04c839da98a8c50a36697076af5bc6d527560a69153b2f718f065908fd4fe3ad

6

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.62527
MD5 5ca217e52bdc6f23b43c7b6a23171e6e
SHA1 d99dc22ec1b655a42c475431cc3259742d0957a4
SHA256 11726dcf1eebe23a1df5eb0ee2af39196b702eddd69083d646e4475335130b28
SHA3 b358d8a5b0f400dd2671956ec45486ae1035556837b5289df5f418fe69348b3f

7

Type RT_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.91604
MD5 6be7031995bb891cb8a787b9052f6069
SHA1 487eb59fd083cf4df02ce59d9b079755077ba1b5
SHA256 6f938aab0a03120de4ef8b27aff6ba5146226c92a056a6f04e5ec8d513ce5f9d
SHA3 0f1c6c0378a3646c9fbf3678bbeeccf929d32192f02d1ea9d6ba0be5c769e6ab

BBABORT

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.92079
MD5 c987e709cafd3a191333610e4c44914d
SHA1 901e4db5d379a222dd416776633ca9738db32e14
SHA256 c0ede68a98bd2bc58c78564dfb42f1640dc29766d3ab2782ab8b5ed28c6fd414
SHA3 7b14efd89b642988834daf08c97db5bb847f941d75f44a3915e3e5dca2510c53
Preview

BBALL

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1e4
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.16995
MD5 f8a9b4a8f4097cea6a482026484c4d12
SHA1 2057a63edce2cbb165512bfad326728cf1053d60
SHA256 46cfc44afa8ab31ae3da35fa8346e4c085c441659d9992b09fc8ad517f2b289a
SHA3 f3852a8bcb1b38f498231cca2b0427af6c4c52886f92f980968d40fd8e8c5337
Preview

BBCANCEL

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.92079
MD5 c987e709cafd3a191333610e4c44914d
SHA1 901e4db5d379a222dd416776633ca9738db32e14
SHA256 c0ede68a98bd2bc58c78564dfb42f1640dc29766d3ab2782ab8b5ed28c6fd414
SHA3 7b14efd89b642988834daf08c97db5bb847f941d75f44a3915e3e5dca2510c53
Preview

BBCLOSE

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.68492
MD5 6c2fba077bd332b3a48d6b5e43fe4a22
SHA1 e7d12e9fd5659881742773884db8ca537765dc81
SHA256 f8e1696801fe89b88936ac4226cea03bfa5aa345aa33ca982822ae7fbc6557e2
SHA3 39193ea4b2ffb32f16c75ca88ca20465a374cd928aac9b4b3ba5739bbb6222de
Preview

BBHELP

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.88085
MD5 1021657335ba4838db07f5231723df3b
SHA1 68f04f6ecbf628029e4e0061392029edec2b0e43
SHA256 cb7421b5c6af74c3159c361f3bb78bba8a488d8979d1250e106fa96cbf928789
SHA3 888ed4f8473561552d848c3d6624e2331c4ec7795bc5001237cb752b96e4929c
Preview

BBIGNORE

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.29718
MD5 098b5f6c87471f5a83a4e55a6a036d6c
SHA1 e16d9186ffa72cc3e373cdf8e40f9e570f0082e7
SHA256 41f05a4df5f42d92b879493d51941de342d36460fe15c0f3b63b2b706b928fef
SHA3 7939e94342a45e6742dbf7c93f5b42fb861ac81b1fe5e8e04e49c0421338b2cf
Preview

BBNO

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.58804
MD5 8832519641f28981f87e1b3006896eef
SHA1 916eaafcf9ffb12bfd6338419bdd22764778ebbd
SHA256 81265e63c89ee5c2e5126452e22f84e9be9452449f3e5959ab6d346cb58b2bde
SHA3 39743ce838b215420cbb732e107e4c45f63384dcdd5b830d15097fa06cf32cc2
Preview

BBOK

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.67459
MD5 4b349737af0b7e5a5308dff7b93b274b
SHA1 b3d36a94fa9a57ad7a68a3b30be92947e811e760
SHA256 6b97877cdd547e6ba6467f86055f1fc7b06660b034439f0da4c137538ef14a83
SHA3 b9e9646067eae58ad9aded92130651d090a92771bae94676003e9aba47f77cd6
Preview

BBRETRY

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.53344
MD5 7daf7522622a4fe823701fd2ff6f4996
SHA1 89f40bad3052afafbd71e80c07b928ec1aa7f4e5
SHA256 c925e4a8cbf6d42dbb1220a510614df725558f8d843338982bab8c4e020f6429
SHA3 95aa592de7b91edb5889cf5f9a7b042d3b6f6910bbd657ba85632f0d0ed557fb
Preview

BBYES

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0x1d0
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.67459
MD5 4b349737af0b7e5a5308dff7b93b274b
SHA1 b3d36a94fa9a57ad7a68a3b30be92947e811e760
SHA256 6b97877cdd547e6ba6467f86055f1fc7b06660b034439f0da4c137538ef14a83
SHA3 b9e9646067eae58ad9aded92130651d090a92771bae94676003e9aba47f77cd6
Preview

PREVIEWGLYPH

Type RT_BITMAP
Language UNKNOWN
Codepage UNKNOWN
Size 0xe8
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.85172
MD5 48276e8432af5a23af78e1d23de8ef5a
SHA1 12fb57606d03e3fe28263e3e9e96b4eedc79aef7
SHA256 78507a772de646626b196a743cee75b298a68c33a0fd482842071519d59037b2
SHA3 1cf31d53c7ea5dbe90181cb2db39ce6cd21484f5495b0af59f5c6164d9b3d3d0
Preview

1 (#2)

Type RT_ICON
Language Greek - Greece
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.04894
MD5 7a53579157989fc454e65d64609c47c1
SHA1 8a8502c7f867b7865944734396e47e58ad9953af
SHA256 cbff2314ad4dfb6a271894d991feb0c7ca198a8d8e698ebca83eb29708ff4edb
SHA3 0158d9a80811b6576c44e6acacbe64c6a28c8f116974b64572f84e7f774d4350

DLGTEMPLATE

Type RT_DIALOG
Language UNKNOWN
Codepage UNKNOWN
Size 0x52
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.5627
MD5 db949b51eec31f37281a7fa424a3e158
SHA1 f61214ce31a91d174e77f12c90f18ddd4e265a1d
SHA256 771f64afb45a9edc8c4f6c5b2039f9b32623cea53bf0cab5bf1f371cc5d1abe4
SHA3 4a2bc09771734352d594a48fe2249ca0697c471d80a4001f60c6d86c46b6319e

4081

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x190
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.2916
MD5 eaaab7b5da2c63c8ea250ee647aa5847
SHA1 f635004e41269d0f389e4e50d08dd0ac4e4a80b9
SHA256 2f5ef294c0be01993445cf1704f10e5c02b5777894f8f67d667fe59bee29fe4a
SHA3 fefefc6c36648de60c2740a38d69ebb883cbfb965f263947cd7ec936a78f894a

4082

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ec
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.26036
MD5 6bdf26833b860ca7c2bbb4b27b629bef
SHA1 e964126c64166c8f17af324172bfd89ff370fd73
SHA256 696286cc8f56db772be8618da6e3dbe6b70f64a694983c23dda36921a18054da
SHA3 f9f3210e4cec6268d4d8f645c8261434ecd616f75df1151f9989d7e728d3f81f

4083

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xec
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.10183
MD5 cac5a2b91d43f6db9be39a830eec51e0
SHA1 12edba5d739adc3b759c774c9ab50b1420f29cbc
SHA256 a439ccc4d688076392c4c3eb6dbc602694213c2a5dc318da04c4a63a93a22b2a
SHA3 cd8ce2d09938f4571c39a327f789c268a93fce2834d515dbf19cf844a22e9a96

4084

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x320
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.21614
MD5 001f04de9fbab77419c0fc370e3a9595
SHA1 99910b9f70411e69e508bf2f8bc3280747d3af9a
SHA256 8719c6617d5bda25c67c1f7318b35849dcb39a6944ab676ff2ca0d23bd5fca73
SHA3 316dfb8699d1c64b1d5aa68990476e13a4e3b53df5c9315107c841d8bd49928f

4085

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xbc
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.0117
MD5 e28cb84c09eb4150bef62f8d0ee7e400
SHA1 75281167a50c34d7bfef3a509c872e14dad2c500
SHA256 49af5aa2b95c25004d5f8aeacc2b502bca1caa6da00971408d259a1a01aa137a
SHA3 39b842241f622062d3325bca97d771f5b2a255a37ebfc98f8f3966b27edd1142

4086

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x10c
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.09515
MD5 9b3d49b76928058948b8a38acf02a6a3
SHA1 a4967e0d0d0a755d8bbfbf8f093bb37df7ac1afa
SHA256 c750be00ea678f4813f57ae28e8bb10ef03112167de67d05006c30c988cf25ad
SHA3 0f4a61bac6467e0551078ba87dd52e631f93e8e49aebf93165140cd2bf09b5d6

4087

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x1c4
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.1989
MD5 5b28ec394d65f9d7968320eb7dca9ad1
SHA1 b940d1410afbc6533eaa3e7df588a7fbfebbd971
SHA256 b1f68d798ab965547a8c819b5adbca8b7f743369dd9c8b41688f23709c49e41b
SHA3 567fd17672588b6a26ecd5bc649c24a10ab6c1dc5e79ab343e567eccf8e92377

4088

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x450
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.22976
MD5 0995b52ee8bc0032d55d9c92445f01e4
SHA1 5e3180a3ee4b47635bc3e1eccbdcc2ccc7a9372a
SHA256 4afbb5651cfbf5aea00419cd6ba9ad8906ec6e0e9a1fb12221440d5e0f65bd73
SHA3 77b8c88c716a8afdc7777b584da087ec94136831eee8c09dbae41e3585315647

4089

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x35c
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.16776
MD5 e432064870dbef8e56d76812bff5f80b
SHA1 b1526fdf5de84982b102b5d75c1ef6d66a2c9d3a
SHA256 2f10b0606bfea16f4ed63fce9620bf77e01cc0bd1240e1ba43d58a68d180b12d
SHA3 3db0266b08cd4c750b4a3b059f758d454e1f7d1432516fb6817c549dcd6b941e

4090

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3e8
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.24134
MD5 a4014d691bd664f03f435c316005d79a
SHA1 4e8e6d962735f35bf17d8d08d2ff397b1d09f313
SHA256 e3545d8fe699de2fb1537d4fcff27e44889764416796b8bbf2f71fe5dc0b4d99
SHA3 3790597cbc65fac8a19bfb885e9206eba1d0564d07396429a9e244c539eec41f

4091

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x234
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.23259
MD5 7b38e1bb059dea4e02e5c73de705d534
SHA1 0e71cf9c4bd929a62c797fcfd05ab5a8f0075f53
SHA256 8087b6f485dbc8b45ceed7b1120d0ca0567e5633c8dfe94041f3cac6e209b8ac
SHA3 f242b22a74cdb5f540d3e767718049848242d92ad40c9337a5fe1536134ca0f7

4092

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xec
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.00616
MD5 505601e39da20179c44757c61913506f
SHA1 3c7aa95a57958a91a6a3a935ca2795e23c0806b0
SHA256 26afa355a3a2ddfa48dc66f4b1a36a6427d76fc7c4879a257331e0a1549ea3b9
SHA3 a24ca7bef52b1347e73baa14a697c49fc6288ab0bbe27127d614353f94abda7f

4093

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x1b4
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.22288
MD5 94e38149f6746e50defbee69e6ac66d5
SHA1 0ee30870d2370d102ce42297e452db2bf832f8fb
SHA256 490f9355796a96874ad9d123678a906478fd8ba86c0ceee9482acf059f5c9ddc
SHA3 85d1ba2fd405140d7b43808a9e4cd3ab625bde616f16dc3303c303b958f1abc4

4094

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3e4
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.19757
MD5 7f154c4a7c1431f947c407ff9986a3df
SHA1 879f7f510cad14359c9e86bc53df8c7ee9474a3a
SHA256 1842ebf764d5843e9f737302e07352e000131e0d2da2e199030ec644dd96de86
SHA3 f4760c799a2ee1b20e7e695460f1aa84b053d3fe25c30fb4105088ff49518ac5

4095

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x358
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.26686
MD5 c6e1c672551e7c63ab32b6add73e872c
SHA1 a5c91d81d59c48082f4bd5996e4d3e92c5bb0651
SHA256 7b186924e5438e52e53f29035df7a4f31dd67f35fd1eb5473cba5405048df6e1
SHA3 41103a62580594e313e153225d749efd4037f8153603d53ec1be98c77cbe89b1

4096

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2b4
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 3.18591
MD5 fe522eba644ae5f88eb858b4cb3a5829
SHA1 61656d4304b98eb2715ee0c24e5b60009f1a278b
SHA256 ce28bb03eda08a374750ce5be8f32f5739cfed85bf3b6d667be80938fd92615b
SHA3 55193077c744d8c6053726c9f617bb72428265da1e3b006434ca6997b39ec067

DVCLAL

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x10
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 4
MD5 d8090aba7197fbf9c7e2631c750965a8
SHA1 04f73efb0801b18f6984b14cd057fb56519cd31b
SHA256 88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610
SHA3 a5a67ad8166061d38fc75cfb2c227911de631166c6531a6664cd49cfb207e8bb

PACKAGEINFO

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x264
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 5.27966
MD5 95febb1bbf4c0ff97988909eb75ee051
SHA1 6038b5a3c97cbfc00e08babe0705411a9eba3947
SHA256 6fd1ba176138ee6f705b1f6a1dbfdd757bf2fb12c075ea6c978f088aebee58a8
SHA3 b1c7e12da86e0bc5d543ed3633ede7acaafa1d550df0f9281728a43219127e0d

TFORM1

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x214
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 5.51102
MD5 4f8567d86d4bc4eb882974fc2c7e9268
SHA1 f96c8bab38c4191058b419c658262e4e7f4ca0a0
SHA256 f524e77d8532a2ebcadea4ecfc02208dd7d4eb735772e2174b57459d0573bbd3
SHA3 fb0ad37463c348d9578699318ab64e07255ad4db36141b4c61873c9a81c415c4

32761

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 1.83876
Detected Filetype Cursor file
MD5 a2baa01ccdea3190e4998a54dbc202a4
SHA1 e8217df98038141ab4e449cb979b1c3bbea12da3
SHA256 c53efa8085835ba129c1909beaff8a67b45f50837707f22dfff0f24d8cd26710
SHA3 8874564c406835306368adf5e869422e1bb97109b97c1499caa8af219990e8dc
Preview

32762

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 1.91924
Detected Filetype Cursor file
MD5 aff0f5e372bd49ceb9f615b9a04c97df
SHA1 e3205724d7ee695f027ab5ea8d8e1a453aaad0dd
SHA256 b07e022f8ef0a8e5fd3f56986b2e5bf06df07054e9ea9177996b0a6c27d74d7c
SHA3 9cb042121a5269b80d18c3c5a94c0e453890686aedade960097752377dfa9712
Preview

32763

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.01924
Detected Filetype Cursor file
MD5 48e064acaba0088aa097b52394887587
SHA1 310b283d52aa218e77c0c08db694c970378b481d
SHA256 43f40dd5140804309a4c901ec3c85b54481316e67a6fe18beb9d5c0ce3a42c3a
SHA3 38753084b0ada40269914e80dbacf7656dc94764048bd5dff649b08b700f3ed5
Preview

32764

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.01924
Detected Filetype Cursor file
MD5 1ae28d964ba1a2b1b73cd813a32d4b40
SHA1 8883cd93b8ef7c15928177de37711f95f9e4cd22
SHA256 ff47a48c11c234903a7d625cb8b62101909f735ad84266c98dd4834549452c39
SHA3 a85dadd416ce2d22aa291c0794c45766a0613b853c6e3b884a2b05fc791427b8
Preview

32765

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.01924
Detected Filetype Cursor file
MD5 0893f6ba80d82936ebe7a8216546cd9a
SHA1 0754cbdf56c53de9ed7fbd47859d20b788c6f056
SHA256 a0adcedb82b57089f64e2857f97cefd6cf25f4d27eefc6648bda83fd5fef66bb
SHA3 ce6148ade08ef9b829f83cb13b4c650d9d4a7012bfd1ab697a7870a05f4104f8
Preview

32766

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.01924
Detected Filetype Cursor file
MD5 dcaa3c032fe97281b125d0d8f677c219
SHA1 58fe36409f932549e2f101515abee7a40cf47b2c
SHA256 6e1e7738a1b6373d8829f817915822ef415a1727bb5bb7cfe809e31b3c143ac5
SHA3 02ef292e1b4a70e439e362af6b4fa213e3816ade45222b78dabab712b6afba54
Preview

32767

Type RT_GROUP_CURSOR
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.01924
Detected Filetype Cursor file
MD5 a95c7c78d0a0b30b87e3c4976e473508
SHA1 b19f3999f1b302a2d28977cb18a3416c918d486c
SHA256 326c048595bbc72e3f989cb3b95fbf09dc83739ced3cb13eb6f03336f95d74f1
SHA3 8157b4e6afa7ed2e2ffc174d655bec9fb81db609e4c5864faa5ead931ff60689
Preview

MAINICON

Type RT_GROUP_ICON
Language Greek - Greece
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2008-Mar-08 23:14:46
Entropy 2.16096
Detected Filetype Icon file
MD5 42cf62b780813706e75fb9f2b2e8c258
SHA1 a022d5c1cfdd8aace0089f3e72f2eedd41bda464
SHA256 a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf
SHA3 0aafc8e3d8b6bde595537da4ffe0efc5fe53f01dafe336a2a5828b6a71283d3c

String Table contents

Inactive Caption Text
Info Background
Info Text
Menu Background
Menu Text
None
Scroll Bar
3D Dark Shadow
3D Light
Window Background
Window Frame
Window Text
No help keyword specified.
Medium Gray
Active Border
Active Caption
Application Workspace
Background
Button Face
Button Highlight
Button Shadow
Button Text
Caption Text
Default
Gray Text
Highlight Background
Highlight Text
Inactive Border
Inactive Caption
Olive
Navy
Purple
Teal
Gray
Silver
Red
Lime
Yellow
Blue
Fuchsia
Aqua
White
Money Green
Sky Blue
Cream
Ctrl+
Alt+
Clipboard does not support Icons
Cannot open clipboard
Menu '%s' is already being used by another form
Docked control must have a name
Error removing control from dock tree
- Dock zone not found
- Dock zone has no control
Unable to find a Table of Contents
No help found for %s
No context-sensitive help installed
No topic-based help system installed
Black
Maroon
Green
BkSp
Tab
Esc
Enter
Space
PgUp
PgDn
End
Home
Left
Up
Right
Down
Ins
Del
Shift+
Bitmaps
Warning
Error
Information
Confirm
&Yes
&No
OK
Cancel
&Help
&Abort
&Retry
&Ignore
&All
N&o to All
Yes to &All
Cannot create form. No MDI forms are currently active
A control cannot have itself as its parent
OK
Cancel
&Yes
&No
&Help
&Close
&Ignore
&Retry
Abort
&All
Cannot drag a form
Metafiles
Enhanced Metafiles
Icons
Invalid ImageList
Invalid ImageList Index
Failed to read ImageList data from stream
Failed to write ImageList data to stream
Error creating window device context
Error creating window class
Cannot focus a disabled or invisible window
Control '%s' has no parent window
Cannot hide an MDI Child Form
Cannot change Visible in OnShow or OnHide
Cannot make a visible window modal
Menu index out of range
Menu inserted twice
Sub-menu is not in menu
Not enough timers available
GroupIndex cannot be less than a previous menu item's GroupIndex
Stream read error
Property is read-only
Resource %s not found
%s.Seek not implemented
Operation not allowed on sorted list
%s not in a class registration group
Property %s does not exist
Stream write error
Bitmap image is not valid
Icon image is not valid
Metafile is not valid
Cannot change the size of an icon
Unsupported clipboard format
Out of system resources
Canvas does not allow drawing
Invalid image size
Class %s not found
A class named %s already exists
List does not allow duplicates ($0%x)
A component named %s already exists
String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format
''%s'' is not a valid component name
Invalid property path
Invalid property value
List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)
Out of memory while expanding memory stream
Error reading %s%s%s: %s
Wed
Thu
Fri
Sat
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range
Can't write to a read-only resource stream
CheckSynchronize called from thread $%x, which is NOT the main thread
Dec
January
February
March
April
May
June
July
August
September
October
November
December
Sun
Mon
Tue
%s (%s, line %d)
Abstract Error
Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
%s
A call to an OS function failed
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation
Invalid variant operation (%s%.8x)
%s
Could not convert variant of type (%s) into type (%s)
Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
Floating point underflow
Invalid pointer operation
Invalid class typecast
Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction
Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'
Variant method calls not supported
Read
Write
Error creating variant or safe array
'%s' is not a valid integer value
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow
Invalid floating point operation
Floating point division by zero
Floating point overflow

Version Info

TLS Callbacks

StartAddressOfRawData 0x45b000
EndAddressOfRawData 0x45b010
AddressOfIndex 0x45509c
AddressOfCallbacks 0x45c010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section BSS has a size of 0! [*] Warning: Section .tls has a size of 0!