2637c4a35b2eb6ffef22afea5dbf2321

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2018-Dec-20 01:53:07
Detected languages English - Australia
English - United States
French - France

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Microsoft Visual C++ v5.0/v6.0 (MFC)
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Can access the registry:
  • RegSetValueExA
  • RegCloseKey
  • RegOpenKeyExA
  • RegCreateKeyExA
Uses functions commonly found in keyloggers:
  • CallNextHookEx
  • GetForegroundWindow
Can take screenshots:
  • GetDC
  • BitBlt
  • CreateCompatibleDC
Info The PE's resources present abnormal characteristics. Resource 129 is possibly compressed or encrypted.
Info The PE is digitally signed. Signer: Changing Information Technology Inc.
Issuer: Symantec Class 3 SHA256 Code Signing CA
Malicious VirusTotal score: 12/72 (Scanned on 2019-04-17 08:11:27) McAfee: Artemis!2637C4A35B2E
Paloalto: generic.ml
Kaspersky: Trojan.Win32.PLEAD.n
Endgame: malicious (moderate confidence)
McAfee-GW-Edition: Artemis
FireEye: Generic.mg.2637c4a35b2eb6ff
Microsoft: Trojan:Win32/Azden.B!cl
ZoneAlarm: Trojan.Win32.PLEAD.n
VBA32: BScope.Trojan-Dropper.Injector
ESET-NOD32: Win32/Plead.AC
CrowdStrike: win/malicious_confidence_60% (D)
Qihoo-360: Trojan.Generic

Hashes

MD5 2637c4a35b2eb6ffef22afea5dbf2321
SHA1 1f52281f5811a4c971d4bc0dfbe1c8489c109ebe
SHA256 c2c062ff84a18ad02e92dea0d6e12cafa66ff167ea8d02663fc9aae44de7f4e0
SHA3 a0c6a68da2d3e7079a0d72d811214c48121ff2450df0df6a17b0ceefa89fa09b
SSDeep 3072:cTabanp0Q6GnqQmCzylluvT/5f5QAMYlhqppZRvOty6Da:cTOk0Q6GnjzvBPEpZRvOtU
Imports Hash 69d02dc9653c93ce3ed899973336cb40

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2018-Dec-20 01:53:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x19000
SizeOfInitializedData 0x1f000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000713A (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x1a000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x39000
SizeOfHeaders 0x1000
Checksum 0x3f41a
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f36e468c9172318c82ed0558242230f9
SHA1 027801948a18fcb5d1dc808de0fba00545f38f1c
SHA256 6f77f7b854a0508c2f8b67a4dbc2682cc267762a81a010459e2c89167abcf5d6
SHA3 117643c1fb09d380ad13b2b4ec94ce63f919661165b02d890042e1850167b57a
VirtualSize 0x18566
VirtualAddress 0x1000
SizeOfRawData 0x19000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45486

.rdata

MD5 05f7802ddb0d30a85750530e6c1feace
SHA1 5f61cc29fec16ad90fa01c1ba48d8f379ee0a281
SHA256 30d122eebbde8fc29dc96d4608e005232de899bc6e58ca54842a16a4dccd7116
SHA3 f5bd18fdf20a61f6bb4bdd78f805158817014784aa789390c9a32815d2bd5c4b
VirtualSize 0x5244
VirtualAddress 0x1a000
SizeOfRawData 0x6000
PointerToRawData 0x1a000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.29908

.data

MD5 df0945c59e8fb9d3aa63c41af349726c
SHA1 61567316ff1b139a1f71a7c203edea1042d3ecad
SHA256 68a1ff92493e1ca1a65cdce3b0001cb533a3f13d728c566d5c01f04c4826b3d5
SHA3 affdb9edb77e942b442434f3272a78b85fe052a96ee6c420a0720f6a5ac72a83
VirtualSize 0x7728
VirtualAddress 0x20000
SizeOfRawData 0x4000
PointerToRawData 0x20000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.29325

.rsrc

MD5 725d04d016629228e30ce06639aa9451
SHA1 3a91f8958611e41a647382aad61c769dbfa249c9
SHA256 638a58fd01c0e4d8c08c752336752f138c2355b7623b64055a9c4aaf6cd02eb5
SHA3 0656f2671e1aacbc20a4d66be658426d3598f419caadd4a041f7afd24963b882
VirtualSize 0x10838
VirtualAddress 0x28000
SizeOfRawData 0x11000
PointerToRawData 0x24000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.47028

Imports

KERNEL32.dll HeapReAlloc
HeapAlloc
HeapFree
RtlUnwind
GetStartupInfoA
GetCommandLineA
RaiseException
TerminateProcess
HeapSize
GetACP
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetProfileStringA
FlushFileBuffers
SetFilePointer
WriteFile
SetErrorMode
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalFree
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SizeofResource
GlobalFlags
lstrcpynA
CloseHandle
GetModuleFileNameA
GlobalAlloc
lstrcmpA
GetCurrentThread
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
lstrlenA
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
MulDiv
GetProcAddress
SetLastError
GlobalLock
GlobalUnlock
GlobalFree
LockResource
FindResourceA
LoadResource
OutputDebugStringW
GetCurrentProcess
GetModuleHandleA
GetTickCount
GetCurrentProcessId
GetLastError
FreeEnvironmentStringsA
USER32.dll AdjustWindowRectEx
SetFocus
GetFocus
DispatchMessageA
PeekMessageA
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
PostMessageA
IsDialogMessageA
SetWindowTextA
ShowWindow
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
PostQuitMessage
SetCursor
ValidateRect
TranslateMessage
GetMessageA
GetClassNameA
LoadCursorA
GetSysColorBrush
DestroyMenu
LoadStringA
IsWindowVisible
GetTopWindow
MessageBoxA
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
SetForegroundWindow
GetWindow
SetWindowLongA
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetParent
GetWindowLongA
GetDlgItem
IsWindowEnabled
IsIconic
GetClientRect
DrawIcon
LoadIconA
EnableWindow
DrawIconEx
InflateRect
GetSysColor
FillRect
GetDC
SetWindowRgn
InvalidateRect
GetSystemMetrics
GetWindowRect
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
EnumChildWindows
SetWindowPos
GetCursorPos
GetForegroundWindow
ScreenToClient
ReleaseCapture
SetTimer
PtInRect
SendMessageA
CopyRect
RegisterClassA
KillTimer
SetCapture
ClientToScreen
IsWindowUnicode
CharNextA
DefDlgProcA
DrawFocusRect
GetClassLongA
GDI32.dll RestoreDC
SelectObject
GetStockObject
SetBkColor
SetBkMode
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
IntersectClipRect
MoveToEx
LineTo
SaveDC
DeleteObject
GetDeviceCaps
CreatePen
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
CreateBitmap
DeleteDC
Polyline
PlgBlt
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetTextExtentPoint32A
CreatePolygonRgn
CreateDIBitmap
PatBlt
GetTextExtentPointA
PtInRegion
WINSPOOL.DRV DocumentPropertiesA
ClosePrinter
OpenPrinterA
ADVAPI32.dll RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
COMCTL32.dll #17

Delayed Imports

129

Type BMH
Language English - Australia
Codepage UNKNOWN
Size 0xb9a4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.996
MD5 695cea78ff738559fe235a0b3a1e15cb
SHA1 b8ab4266eb6dcabbae45f8e2c5ecc0c7cd18ea62
SHA256 b9d1417a6d5d24b863f204e1f83a3abae852854f9b9f875e06f4b4c40ca8aba1
SHA3 fc2be388fb1b2abb79d76f3eef059c0a587eb5e6ecc3cca4d276169878fcb89c

2

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.02695
MD5 cab67e9ca149fb79ab4473998412b951
SHA1 2e793d35537bfb5d3f042ed0626d3b119d50519a
SHA256 fbeb3be87e80cb8e1d2af3d8140796c1bb80c6c7056f60897088ff9e355c3867
SHA3 0e72f5537421764effb2ed98e536358bb7e86eed7b0936e606e8d45559685684

3

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.74274
MD5 9fa8a914823ac7e5370652146901f4f1
SHA1 eb3224109abb341b6e464d2606fdbed1a7160bc6
SHA256 f64ccc0582bc7c66af8b40049e485e8e241335261ec95ace909293ba50b2e4a3
SHA3 bb348af06514e27cd1fa21ad524dfd037edcd3b36ef4cc6ab24c4a8ec38995ff

26567

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x5e4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.09838
MD5 055505a1940f27993d40e136bc915615
SHA1 f6223d2c97df05fa6b6ca54b47c92438777eae79
SHA256 a9bb58f43df34b3dc05b79015210b5a1ca84f8ff97555cf7344ef8bb662e1a6d
SHA3 cf77404babde2509159cac5542bdbc409a869e1633222f15e62ccb39bb8ad59b
Preview

30994

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0xb8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.23666
MD5 8cf65be17e506ff24c2177078f88b56e
SHA1 3e397dc7597caeb844df0ea760b64231c8ce3dbf
SHA256 e7c0005285d1ab59732d5f99f77a9bdd6342b01cf44437ebd7a07611a227e272
SHA3 7da4c7aab356574679f0f9107740f01647864c846c04f699deef67577fd6aded
Preview

30995

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x16c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.20022
MD5 a2153b6134d93fd17964b36be4821db4
SHA1 43d43980d7e6c1f080cc3eca82d84dc2ab8241b1
SHA256 4406c7739acdebe7be0510fb2cf7043ebec1f3dfd4fd876e1b6d0eb29fa79a14
SHA3 c6bfd5b740368d3cc00322a1d1ed6905cefec2b5a411b2100444a37e72f79fe6
Preview

30996

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x144
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.87621
MD5 5a9c81cdbf480cf01daa71ba0e233c5f
SHA1 28e04c01584654e1974347d1baa462b2784e9c47
SHA256 abdf36bde89a26349f5741c17c235dacea88d441d8662ba16a598dc50c3c4864
SHA3 99dec83590ac444359a5a6f8924dae5615d93f4df527e10a8a61319ce3a5beaf
Preview

1

Type RT_ICON
Language French - France
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.86053
MD5 58569bf940e7c2e34d6939de4a943ec5
SHA1 b8fdaa74e8c9c0913209e438b537354d972416a9
SHA256 852e3e952e4ebcf4be8ecedf7e37895fd8a3f52f1411b23ae6f9a9159fc2c383
SHA3 6622358805b196f749417a0bf087919ba8283f0e9cc00a4da67f3ea3908c5ed9

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x15c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04982
MD5 d748e760ab4772c16fec8a488a6c157e
SHA1 cac8ca558fff6115a9339d67a795ccbf7d33b090
SHA256 59de39b0735487f24c4eee2724d3b20178b45f0c8e4fac9aab035ab7e5586f3e
SHA3 5f73e61d5aff66371a7d83354c294170a0404e9c0f5938e4b822dd076f99d248

30721

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xe8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06676
MD5 ad7b15160c8bf80910606d417f40fef5
SHA1 9752acb8e012635c4356f7f2a20191d656b53faf
SHA256 6e113fd8e9f3156ae68251c6076beb9b59fe29e589d06398e7019802521f69d3
SHA3 50c74f1eeba91cb4ecc237c0b18cd2f6c0e2b6064e8d13ce1a779160c03b5d48

3841

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x64
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62471
MD5 78032ee117bfd647574d5ab795cef827
SHA1 1460d8716dcdf32b7375ec48135d548656d0c7a5
SHA256 126e7d1b6528efe82f8ec2b14bb48d06687deb24b93fb96ecd8d47ad3b1a133c
SHA3 3937fb03950e0e89e44c20a4be9d007487c4808dc5dd9b40b5b0498fecff32fc

3842

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x2a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.960953
MD5 0131ce1c2237957b6926d5097b0af63d
SHA1 2ce37b98065cc4de92e99eb0777e0e1159102068
SHA256 05e0d5787611ed4f643733e3e6e62d00f426422b5d3e443ceebac22e9d294bc4
SHA3 9ee7bcb02f48332a4fac72465297312ef9c765b03edf2ab24a4b3de0840bda6c

3843

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x14a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04939
MD5 7076fb3ae32a748de6a3418a66192a8e
SHA1 dde3419cf897be2f5511a3daffc195ef132afcd2
SHA256 45e62b458c61b6cbdda7b5e9d11f5a6df837cf398c16a6257cd3b970a4ba051f
SHA3 f570484090cc667aaba4c771246cf979c70ef084b24fd08874b2ebfc95a53d95

3857

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x4e2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26139
MD5 a9e50c9388d7cdac902c23acec7aa23c
SHA1 d54e8c937a904c58112c0fd868012f1808bc7def
SHA256 d036e1af5639fb867f5035330e81788bbc24eff762610e3f6bba5d78903a845a
SHA3 d6269db5a679dd9690f84a835d71985ba4651061b49478a4df8690ece671a473

3858

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x2a2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.99242
MD5 baaa947d6b05abd2548055fa7716fef3
SHA1 4ab0c053f47617c11883897e52ecda97f99ed49d
SHA256 1bf3b476c90b4d69ffacf814700ff58d3745713ee100baa8d6a5f6c64862d4d4
SHA3 8d872e55129a7d342578ba0fdc42f71b15e6e764872b5b50458c5632f43137b4

3859

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x2dc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16997
MD5 8e2ac8a2e85ae2a4a7d1b1fec0c30687
SHA1 e8ad7766b7c342e2721e21c0d7f0c222ee8720e9
SHA256 c1bc5318a82ea1a1809618040026851947f6aa5171d904a9e60966f4551ca1a3
SHA3 b12ff47988f4fe62a2460361df0144ad3366d59e0ffa2b6f38b3469d7b24fc79

3865

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.63903
MD5 5fbbd2a5f564e043553889eec9147920
SHA1 2ddafabdf2bf5b62090419f07f731c4d02f0d987
SHA256 1b8660b0c53b94f3e029de58e56d08c8097a080244e9dc65d4155a9b603820d8
SHA3 1a90cf149f1fc5cfa9cd3f82f9a079ec48c7f7ce76dc4be601e538ae5c052ab9

3866

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0xde
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.87807
MD5 a0838b75a6ffc345212d18178663bb7d
SHA1 a90a0eccdf4cc4c50f430195695a3b65adefe5e8
SHA256 31bff9afbf08a8869318cd946a1d73a4425afefc5693c6e06671bde1e86de1dc
SHA3 ad576d2bedb8e173fb207310f244bee3ad8c898a2101cb67da930fadf80ec7d0

3867

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x4c4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23259
MD5 f2cb4a170c1677e5a01e7be62eb9cb0d
SHA1 2dd9a30c267d734a1b6da203ac4ddf4512ce30bf
SHA256 36db380991291cac5c99e42332efda20210f63985544d95e8fa6ef85bf2bdf8e
SHA3 2a1b4ca5a692c8deed0fef985b009b14ce015981e2b6bcf1469bba5700456504

3868

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x264
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.09466
MD5 22bc73fe721ab70d0af71b166577d914
SHA1 3f6f9d5eacc66775e33fa6644ffcb06e141b8955
SHA256 7f51554313c6765ba649783a942064cdfe6f5a70248a6f56840f71969f87ced0
SHA3 a37cc4b7ff7538179044beda7e177e62d1691994b518d2151622c975b5f282ef

3869

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x2c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.07875
MD5 4b18eed800e2806db8e0aacb95fd54f2
SHA1 8b09634f818d6823f6466717f3863cbb466d97c1
SHA256 0714c554acd308b38c3d6319f7e470f76a16d712f696545eacac2bdc725dfb95
SHA3 067dea0fda55e331beab407da1e0e79a9d71fe8a8d0c965384d459ce0a8d499a

30977

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.17349
Detected Filetype Cursor file
MD5 82087004b160772173284c3dae85be2f
SHA1 a3c1f9340fc37dff751efbe6673b5e9ef3e4a8b1
SHA256 e6bef05177430dd0710b2878ea9028fb4cd23b7dd9e6066a7dce3934c8e05124
SHA3 09d33054c8076b56ab90b399acf5383351b59ba9db1cac26820c9b60cc9532d0
Preview

128

Type RT_GROUP_ICON
Language French - France
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.91924
Detected Filetype Icon file
MD5 6da8e7d5ae1d5d15e0230a67a7c16c6d
SHA1 678db52cbe5d617c33c6269bfd4b6d8d1a17f956
SHA256 6eb54801f91b6d8effccbfaefe6b2d7705a274a75940e6226e24e0d4ec58c396
SHA3 994fc217c7b8bc8008ac262ff58044403206de6eceafd424d4640ecad395eb2f

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x5c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.10967
MD5 9d3136ea95ce5492ea01d2afcb0992b7
SHA1 5d476d9f838032b7142a7740deb91e30c8c5cdff
SHA256 e4c8b52b3ad346523ac6f7ae83bce5ac901fcd90ae3de634b19b380d2d42960b
SHA3 34da73409eab1f0f278bb3e9aa76c0c1ff0fb0bbd49e9faf505e835fe782b37c

String Table contents

Open
Save As
All Files (*.*)
Untitled
&Hide
No error message is available.
An unsupported operation was attempted.
A required resource was unavailable.
Out of memory.
An unknown error has occurred.
Invalid filename.
Failed to open document.
Failed to save document.
Save changes to %1?
Failed to create empty document.
The file is too large to open.
Could not start print job.
Failed to launch help.
Internal application error.
Command failed.
Insufficient memory to perform operation.
System registry entries have been removed and the INI file (if any) was deleted.
Not all of the system registry entries (or INI file) were removed.
This program requires the file %s, which was not found on this system.
This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Please enter an integer.
Please enter a number.
Please enter an integer between %1 and %2.
Please enter a number between %1 and %2.
Please enter no more than %1 characters.
Please select a button.
Please enter an integer between 0 and 255.
Please enter a positive integer.
Please enter a date and/or time.
Please enter a currency.
Unexpected file format.
%1
Cannot find this file.
Please verify that the correct path and file name are given.
Destination disk drive is full.
Unable to read from %1, it is opened by someone else.
Unable to write to %1, it is read-only or opened by someone else.
An unexpected error occurred while reading %1.
An unexpected error occurred while writing %1.
Unable to read write-only property.
Unable to write read-only property.
Unable to load mail system support.
Mail system DLL is invalid.
Send Mail failed to send message.
No error occurred.
An unknown error occurred while accessing %1.
%1 was not found.
%1 contains an invalid path.
%1 could not be opened because there are too many open files.
Access to %1 was denied.
An invalid file handle was associated with %1.
%1 could not be removed because it is the current directory.
%1 could not be created because the directory is full.
Seek failed on %1
A hardware I/O error was reported while accessing %1.
A sharing violation occurred while accessing %1.
A locking violation occurred while accessing %1.
Disk full while accessing %1.
An attempt was made to access %1 past its end.
No error occurred.
An unknown error occurred while accessing %1.
An attempt was made to write to the reading %1.
An attempt was made to access %1 past its end.
An attempt was made to read from the writing %1.
%1 has a bad format.
%1 contained an unexpected object.
%1 contains an incorrect schema.
pixels

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xa27382a9
Unmarked objects 0
Unmarked objects (#2) 1
C objects (2190) 3
Imports (2179) 17
Total imports 404
14 (7299) 25
C objects (VS98 SP6 build 8804) 97
Resource objects (VS98 SP6 cvtres build 1736) 1
C++ objects (VS98 SP6 build 8804) 63

Errors

[!] Error: StringFileInfo expected, read instead. [!] Error: StringFileInfo expected, read instead. [*] Warning: Could not parse a VERSION_INFO resource!
<-- -->