Manalyze report for 2c686e215335241728e777ca71e520f8

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2016-Jul-25 00:55:41
Detected languages	English - United States

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: http://nsis.sf.net http://nsis.sf.net/NSIS_Error nsis.sf.net`
Suspicious	The PE is an NSIS installer	`Unusual section name found: .ndata`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExA` `Can access the registry: RegDeleteKeyA RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA` `Possibly launches other programs: CreateProcessA ShellExecuteA` `Can create temporary files: GetTempPathA CreateFileA` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Changes object ACLs: SetFileSecurityA` `Can shut the system down or lock the screen: ExitWindowsEx`
Info	The PE is digitally signed.	`Signer: Arne Koenig` `Issuer: GlobalSign CodeSigning CA - SHA256 - G3`
Suspicious	VirusTotal score: 1/68 (Scanned on 2021-04-18 00:00:26)	`GData: Win32.Adware.Narn.D`

Hashes

MD5	`2c686e215335241728e777ca71e520f8`
SHA1	`7a5373aeb878abfe5e3cf9b5c78ad15a588951ea`
SHA256	`5a6f4a7df4c5ee680671e08b4df865eac202af8b6965963d80afc960fe749166`
SHA3	`2b087eec4af178bbc0d5bd47cffa5fbaf8cbcb0d0a2d2657b6c17a1f797ac8f7`
SSDeep	`6144:uC22MhQ1iQEIKShqZjdx9JGGKYi2MMRt8rHVINIV:dMDVXSYxx9VKY3MML8r1IN`
Imports Hash	`b78ecf47c0a3e24a6f4af114e2d1f5de`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xd8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`5`
TimeDateStamp	2016-Jul-25 00:55:41
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x5e00`
SizeOfInitializedData	`0x1ce00`
SizeOfUninitializedData	`0x400`
AddressOfEntryPoint	`0x000030D9 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x7000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`6.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x5d000`
SizeOfHeaders	`0x400`
Checksum	`0x65d3d`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`905b5e59c06f35acf133c0788daacce5`
SHA1	`d6d99944aeef497ae241306685a98cf3dea36c21`
SHA256	`e9672d7b1b6492b645cc1a03fbc0024ba64a029c43cde5aaf1b00d8e53f04472`
SHA3	`1cdd1e6f709f7e56e58b627049a6faac16ab58e4baba8c291ac613f2d5295592`
VirtualSize	`0x5c5b`
VirtualAddress	`0x1000`
SizeOfRawData	`0x5e00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.41146`

.rdata

MD5	`43fab6a80651bd97af8f34ecf44cd8ac`
SHA1	`3f410d5ef19fc0a538580d7c8f1a8e156732f806`
SHA256	`0f2399d5d8788f074ed741d6453f2059390ddec97a8f115526c82ab43982dff9`
SHA3	`190ab25556cacdf90f861c6d60b9cc99decb6eb385301999e0a0122f58bec4d6`
VirtualSize	`0x1246`
VirtualAddress	`0x7000`
SizeOfRawData	`0x1400`
PointerToRawData	`0x6200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.00503`

.data

MD5	`00798d060e552892531c88ed1710ae2c`
SHA1	`a5e662812320a13d00c235facb26314b45523de5`
SHA256	`e9e0d1e1be3fe6995feb5dc67fa2585c9adacc40fcc93d790698d8467db1dfa6`
SHA3	`4df974f07232ee4448c72729e16768d1c18bcc81016c855dc5616f90a18c9c33`
VirtualSize	`0x1a7f8`
VirtualAddress	`0x9000`
SizeOfRawData	`0x400`
PointerToRawData	`0x7600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.1084`

.ndata

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x9000`
VirtualAddress	`0x24000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.rsrc

MD5	`17537a706d9c9b49bf8f1c34df9487d7`
SHA1	`4d9b6daf61684f7ae88762aafe691c4c6c31e446`
SHA256	`e8c779503c3266fb60a1a4633846b01b1653d098eba95eafdc26d4a2e756003e`
SHA3	`c6cd3a2c52571b23cfa71e75bc4affffa3c8568f9abd01e6a20cae4378fe5e00`
VirtualSize	`0x2f528`
VirtualAddress	`0x2d000`
SizeOfRawData	`0x2f600`
PointerToRawData	`0x7a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.83401`

Imports

KERNEL32.dll	`SetEnvironmentVariableA` `Sleep` `GetTickCount` `GetFileSize` `GetModuleFileNameA` `GetCurrentProcess` `CopyFileA` `GetFileAttributesA` `SetFileAttributesA` `GetWindowsDirectoryA` `GetTempPathA` `GetCommandLineA` `lstrlenA` `GetVersion` `SetErrorMode` `lstrcpynA` `ExitProcess` `GetFullPathNameA` `GlobalLock` `CreateThread` `GetLastError` `CreateDirectoryA` `CreateProcessA` `RemoveDirectoryA` `CreateFileA` `GetTempFileNameA` `ReadFile` `WriteFile` `lstrcpyA` `MoveFileExA` `lstrcatA` `GetSystemDirectoryA` `GetProcAddress` `CloseHandle` `SetCurrentDirectoryA` `MoveFileA` `CompareFileTime` `GetShortPathNameA` `SearchPathA` `lstrcmpiA` `SetFileTime` `lstrcmpA` `ExpandEnvironmentStringsA` `GlobalUnlock` `GetDiskFreeSpaceA` `GlobalFree` `FindFirstFileA` `FindNextFileA` `DeleteFileA` `SetFilePointer` `GetPrivateProfileStringA` `FindClose` `MultiByteToWideChar` `FreeLibrary` `MulDiv` `WritePrivateProfileStringA` `LoadLibraryExA` `GetModuleHandleA` `GetExitCodeProcess` `WaitForSingleObject` `GlobalAlloc`
USER32.dll	`ScreenToClient` `GetSystemMenu` `SetClassLongA` `IsWindowEnabled` `SetWindowPos` `GetSysColor` `GetWindowLongA` `SetCursor` `LoadCursorA` `CheckDlgButton` `GetMessagePos` `LoadBitmapA` `CallWindowProcA` `IsWindowVisible` `CloseClipboard` `SetClipboardData` `EmptyClipboard` `PostQuitMessage` `GetWindowRect` `EnableMenuItem` `CreatePopupMenu` `GetSystemMetrics` `SetDlgItemTextA` `GetDlgItemTextA` `MessageBoxIndirectA` `CharPrevA` `DispatchMessageA` `PeekMessageA` `ReleaseDC` `EnableWindow` `InvalidateRect` `SendMessageA` `DefWindowProcA` `BeginPaint` `GetClientRect` `FillRect` `DrawTextA` `EndDialog` `RegisterClassA` `SystemParametersInfoA` `CreateWindowExA` `GetClassInfoA` `DialogBoxParamA` `CharNextA` `ExitWindowsEx` `GetDC` `CreateDialogParamA` `SetTimer` `GetDlgItem` `SetWindowLongA` `SetForegroundWindow` `LoadImageA` `IsWindow` `SendMessageTimeoutA` `FindWindowExA` `OpenClipboard` `TrackPopupMenu` `AppendMenuA` `EndPaint` `DestroyWindow` `wsprintfA` `ShowWindow` `SetWindowTextA`
GDI32.dll	`SelectObject` `SetBkMode` `CreateFontIndirectA` `SetTextColor` `DeleteObject` `GetDeviceCaps` `CreateBrushIndirect` `SetBkColor`
SHELL32.dll	`SHGetSpecialFolderLocation` `SHGetPathFromIDListA` `SHBrowseForFolderA` `SHGetFileInfoA` `ShellExecuteA` `SHFileOperationA`
ADVAPI32.dll	`RegDeleteKeyA` `SetFileSecurityA` `OpenProcessToken` `LookupPrivilegeValueA` `AdjustTokenPrivileges` `RegOpenKeyExA` `RegEnumValueA` `RegDeleteValueA` `RegCloseKey` `RegCreateKeyExA` `RegSetValueExA` `RegQueryValueExA` `RegEnumKeyA`
COMCTL32.dll	`ImageList_Create` `ImageList_AddMasked` `ImageList_Destroy` `#17`
ole32.dll	`OleUninitialize` `OleInitialize` `CoTaskMemFree` `CoCreateInstance`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10828`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.03776`
MD5	`6c2dbd3ed16f07a5666ea53f0c6e23d5`
SHA1	`a8bd6d974b11a853c3f3a35dc319df52c01e62ac`
SHA256	`89f1c1ecf8ee56ef646416817460f241d87957ec79aa0ff6872a95f93e6ff72e`
SHA3	`12a9cf0c0707f8ef706b87a697aa8b0e65d3e931ab2557d098e0312d1443aed9`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x94a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.26696`
MD5	`9682abd77009c532848eba1977a48970`
SHA1	`3bf6b6ead04ca904c913a06c215d6d3b7afe5cbe`
SHA256	`86514e7e3179034af659e54b296d1d688cd0dcb63938e3e9a7b1057c378a7f96`
SHA3	`5612dbbb5ca300e44be97b75320e53723234bfc3cda6dc40ee46c188d995cb0c`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x71b3`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.97712`
Detected Filetype	PNG graphic file
MD5	`475db48bf4940cb8623d8df7d5c85f87`
SHA1	`533584cc80d35a57c6676a2f8c57fe3475a5ae52`
SHA256	`47e139bf5cd26ac40a64bc503834ff6ab94cc645a8c84daec758d1aea373f071`
SHA3	`5a586286048bd75e384e51859a439fde070f7814ac9de5062c1bfe31f4d8808f`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5488`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.14136`
MD5	`dc0ab0f6e6f2341725aa751b30e2e49e`
SHA1	`e30bc196db5bd9a2deae1ce94608a43d41ed5f69`
SHA256	`caafdd61ab716c67d6cee29bbe313ae83edf3663f916bc5e10e6a89e151037c3`
SHA3	`e7f0aa18b7885db5f5ba13c38b05cd8a0bb087211ca28821cf2744a735c2d4e2`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.21564`
MD5	`a3e4ce5d0b69e17e13ddd998f43f13ae`
SHA1	`c1f10d0e877bb9031e1badc73f39fc44508f2955`
SHA256	`4fe663c982fa053d3c7d809cb1a4a32686997a6bb4e7f231c92d52f807e58303`
SHA3	`3fed1fa833ae90f4aae02f73dd8d0b85fbc9a809e402cc71fa7d7036c5db547e`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.20293`
MD5	`acd135c1a7c10c6db0f73086f1f18460`
SHA1	`7016d01343a652ddb2d6a8b51586aa1aba81c3f5`
SHA256	`ec02452752a43e938f2ec43fc546330be79766a6412fb9995715d6d4466c7a6d`
SHA3	`719563a529548d43d39625316587ba781e552fc73168d873dd7338279a6187a5`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.13679`
MD5	`810dd9409b0410f43501a9751bcddb49`
SHA1	`38f92db091cf294f8a7be6e17eb4b8f83989e0c8`
SHA256	`d4fee90068ae8b7908c3c3f34b5f99cba1f76fb4dc4f1d2604e358a3fcb945ca`
SHA3	`e41dfd938a8e5e02d358f12920ad6da376021872bae81c0a96d21678218ddc65`

8

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.29494`
MD5	`4a1e3a49d0a49134e2a897a154676bcc`
SHA1	`98a54547bd69761397acb0656ac7d9885715b1a1`
SHA256	`6ceed3173024387d73dcda576f4a79b5f65a452ebc9011ef8f73023709629c18`
SHA3	`0d2ea03a8455f130ff7ae33764c47912df5156974e41d204dbdaf596ea48c82b`

9

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.32488`
MD5	`b4aac2bb244297b8fb69698568b711e9`
SHA1	`dc351090a7b2979eb594174e96087c6b997d2b0f`
SHA256	`e8c178d93cbfaad0c405801626f08f5b6a9a34edbe2b145a571a936f50f9e331`
SHA3	`0d6ac9884203e3438891ed27174ee14f5e1a9e73c2579cbb2483517b1144d880`

105

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x202`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.73893`
MD5	`386770584473e271f23dced36427f4ff`
SHA1	`d14ce95f784b35e4e3ebee535476ebcd3e380c19`
SHA256	`425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014`
SHA3	`db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662`

106

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xf8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.91148`
MD5	`fa83652660409e90e0db9731ad2adb17`
SHA1	`0a8f0af67723c87fe26ccf676b8e19ec6357b4dc`
SHA256	`4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4`
SHA3	`5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b`

111

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xee`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.89887`
MD5	`663040d6315b1d6ce8c0334d182ed8fc`
SHA1	`ebcfff801a12fb8ad1200a4526fca8bd2c3e96cf`
SHA256	`cb3c86cbcb579244a6f819f9c1807a7e89b6e600982ec6ea0841fcdcb16a9efd`
SHA3	`6a25a2cb16aeb17693f10e8aaa0245c701701db571b458fde7830291a4a01cfc`

103

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x84`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.03466`
Detected Filetype	Icon file
MD5	`96626fe247ecc17e9ec87d85ba950f6b`
SHA1	`3b56d20353fee0edd36f89f96984c457232ff54e`
SHA256	`8196f4fbab8fa19771f15d55ab342d8b5a279a68cbf51362f582b43d2f10e24d`
SHA3	`ea712f384de037b60e469fcb4464a3e2958d13a0905810b736f2651065d61680`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x422`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.29536`
MD5	`6316629b383441227b9980f972a7d95d`
SHA1	`f203cf4128c2ea4d84bad7e261a12313ce40080d`
SHA256	`5f18717d4e05a61e3ef935bd8f9da8b9e5f2505f53e81446fc4786c5e4f35670`
SHA3	`1858497f658a31809c589a7d20ddafa1f304b2297e5997c3cb528bb4e7fea4b4`

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xd246d0e9`
Unmarked objects	`0`
C objects (VS2003 (.NET) build 4035)	`2`
Total imports	`159`
Imports (VS2003 (.NET) build 4035)	`15`
48 (9044)	`10`
Resource objects (VS98 SP6 cvtres build 1736)	`1`

Errors

[*] Warning: Section .ndata has a size of 0!