260c3d3d511b421a4aa53feab0e554ca
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2008-Oct-14 10:53:12 |
| Detected languages |
English - United Kingdom
English - United States |
| CompanyName | ASUS |
| FileDescription | @VIBE |
| FileVersion | 3.0.0.0 |
| InternalName | @VIBE |
| LegalCopyright | ASUSTeK Computer Inc. |
| LegalTrademarks | ASUSTeK Computer Inc., Copyright © 2 |
| OriginalFilename | ASUS Splash |
| ProductName | @VIBE |
| ProductVersion | 1.0 |
Plugin Output
| Suspicious | PEiD Signature: |
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h) UPX -> www.upx.sourceforge.net UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to SHA256 |
| Suspicious | The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable. Unusual section name found: UPX1 Section UPX1 is both writable and executable. The PE's resources are bigger than it is. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. |
Resource 135 is possibly compressed or encrypted.
Resource 137 is possibly compressed or encrypted. Resource 140 is possibly compressed or encrypted. Resource 151 is possibly compressed or encrypted. Resources amount for 107.659% of the executable. |
| Suspicious | The file contains overlay data. |
797327 bytes of data starting at offset 0x2ff800.
The overlay data has an entropy of 7.99934 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 3/72 (Scanned on 2023-10-05 23:30:37) |
Rising:
Trojan.Generic@AI.100 (RDML:6zDus46EsFhh3sFIaH5gUQ)
VBA32: Worm.Agent Zillya: Worm.Nimda.Win32.377 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2008-Oct-14 10:53:12 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 7.0 |
| SizeOfCode | 0x29f000 |
| SizeOfInitializedData | 0x61000 |
| SizeOfUninitializedData | 0x218000 |
| AddressOfEntryPoint | 0x004B7A70 (Section: UPX1) |
| BaseOfCode | 0x219000 |
| BaseOfData | 0x4b8000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x519000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
UPX0
UPX1
.rsrc
Imports
| KERNEL32.DLL |
LoadLibraryA
GetProcAddress VirtualProtect VirtualAlloc VirtualFree ExitProcess |
|---|---|
| ADVAPI32.dll |
RegFlushKey
|
| COMCTL32.dll |
#17
|
| comdlg32.dll |
PrintDlgW
|
| DDRAW.dll |
DirectDrawCreate
|
| GDI32.dll |
EndDoc
|
| ole32.dll |
CoInitialize
|
| OLEAUT32.dll |
SysStringLen
|
| SHELL32.dll |
DragFinish
|
| USER32.dll |
GetDC
|
| WINMM.dll |
timeGetTime
|
Delayed Imports
135
137
140
1
2
3
4
5
6
143
145
150
151
2003
1 (#2)
107
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 3.0.0.0 |
| ProductVersion | 1.0.0.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United Kingdom |
| CompanyName | ASUS |
| FileDescription | @VIBE |
| FileVersion (#2) | 3.0.0.0 |
| InternalName | @VIBE |
| LegalCopyright | ASUSTeK Computer Inc. |
| LegalTrademarks | ASUSTeK Computer Inc., Copyright © 2 |
| OriginalFilename | ASUS Splash |
| ProductName | @VIBE |
| ProductVersion (#2) | 1.0 |
| Resource LangID | English - United Kingdom |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0xc36f554f |
|---|---|
| Unmarked objects | 0 |
| 105 (2067) | 3 |
| ASM objects (VS2003 (.NET) SP1 build 6030) | 45 |
| C objects (2179) | 7 |
| Imports (2067) | 2 |
| C objects (VS2003 (.NET) SP1 build 6030) | 208 |
| Imports (2179) | 14 |
| Imports (9210) | 4 |
| Total imports | 322 |
| Unmarked objects (#2) | 5 |
| C objects (9178) | 1 |
| C++ objects (VS2003 (.NET) SP1 build 6030) | 119 |
| 94 (VS2003 (.NET) build 3052) | 1 |
| Linker (VS2003 (.NET) SP1 build 6030) | 1 |
Errors
[*] Warning: Section UPX0 has a size of 0!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!