2f8ffff94f1d782671539200f258fb4d
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2011-Aug-22 04:09:26 |
| Detected languages |
English - United States
|
| CompanyName | Avision |
| FileDescription | InstallScript Setup Launcher |
| FileVersion | 11.20.19316 |
| InternalName | Setup |
| LegalCopyright | Copyright (C) 2011 Flexera Software, Inc. and/or InstallShield Co. Inc. All Rights Reserved. |
| OriginalFilename | InstallShield Setup.exe |
| ProductName | AD120 |
| ProductVersion | 11.20.19316 |
| Internal Build Number | 108642 |
| ISInternalVersion | 18.0.329 |
| ISInternalDescription | InstallScript Setup Launcher |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to MD5 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource 103 is possibly compressed or encrypted. |
| Info | The PE is digitally signed. |
Signer: Avision INC.
Issuer: Symantec Class 3 SHA256 Code Signing CA |
| Safe | VirusTotal score: 0/68 (Scanned on 2021-09-21 16:48:51) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2011-Aug-22 04:09:26 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x65800 |
| SizeOfInitializedData | 0x5f200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0003E03D (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x67000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xca000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xd5ebd |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| COMCTL32.dll |
#17
|
|---|---|
| VERSION.dll |
GetFileVersionInfoSizeW
GetFileVersionInfoW VerQueryValueW |
| KERNEL32.dll |
GetFileSize
GetPrivateProfileIntW FindResourceExW GetDriveTypeW WriteFile lstrcpynW lstrcmpiW GetFileAttributesW FindClose FindFirstFileW UnmapViewOfFile MapViewOfFile GetSystemInfo VirtualQuery CompareStringA IsBadReadPtr CreateFileMappingW CreateDirectoryW CompareStringW GetCurrentDirectoryW ExpandEnvironmentStringsW SetFileAttributesW FileTimeToLocalFileTime GetFileTime HeapFree HeapAlloc GetProcessHeap TlsAlloc TlsSetValue GetCurrentThreadId GetProcAddress SetFilePointer GetModuleFileNameW lstrcpyW lstrlenW Sleep CloseHandle CreateProcessW RemoveDirectoryW DeleteFileW SetLastError CreateEventW QueryPerformanceFrequency GetSystemTimeAsFileTime ReleaseMutex GetUserDefaultLangID GetSystemDefaultLangID CreateMutexW SetErrorMode LoadLibraryW lstrcatW FreeLibrary GetDiskFreeSpaceW VerLanguageNameW WideCharToMultiByte ReadFile GetTickCount GetCommandLineW ExitThread CreateThread GetExitCodeProcess GetLocaleInfoW GetDateFormatA GetTimeFormatA CreateFileA FreeResource lstrcatA MulDiv lstrcmpiA GetPrivateProfileIntA GetPrivateProfileStringA GetPrivateProfileSectionNamesA GetOEMCP GetACP FlushFileBuffers SetStdHandle LoadLibraryA GetStringTypeW GetStringTypeA IsBadCodePtr IsValidLocale lstrcpyA lstrlenA GetWindowsDirectoryW InterlockedDecrement LocalFree InterlockedIncrement FormatMessageW GetTempPathW GetVersionExW CreateFileW GlobalFree FindResourceW LoadResource SizeofResource GlobalAlloc LockResource GlobalLock GlobalUnlock MultiByteToWideChar GetSystemDirectoryW SetCurrentDirectoryW GetModuleHandleW WaitForSingleObject ExitProcess GetCurrentProcess DuplicateHandle TerminateProcess MoveFileExW GetThreadContext VirtualProtectEx WriteProcessMemory FlushInstructionCache SetThreadContext ResumeThread GetLastError GetCPInfo GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetCommandLineA GetEnvironmentStrings GetEnvironmentStringsW FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetStartupInfoW GetModuleHandleA HeapReAlloc RaiseException RtlUnwind DeleteCriticalSection InterlockedExchange lstrcmpW IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA GetModuleFileNameA SetUnhandledExceptionFilter HeapSize LCMapStringW LCMapStringA TlsGetValue GetTempFileNameW OpenProcess CompareFileTime GetProcessTimes GetLocalTime InitializeCriticalSection GetCurrentProcessId GetVersion LeaveCriticalSection EnterCriticalSection GetCurrentThread VirtualProtect SearchPathW ResetEvent SetEvent QueryPerformanceCounter SystemTimeToFileTime lstrcmpA FindNextFileW |
| USER32.dll |
CharUpperW
WaitForInputIdle DialogBoxIndirectParamW MessageBoxW wsprintfW SetForegroundWindow SetWindowLongW SetWindowTextW SendMessageW GetDlgItem LoadIconW EndDialog MoveWindow SetActiveWindow MapDialogRect SetFocus BeginPaint LoadStringW FillRect EndPaint GetMessageW DefWindowProcW GetWindow SystemParametersInfoW GetSystemMetrics MapWindowPoints GetPropW EnableMenuItem SetPropW RemovePropW GetSysColor LoadImageW GetDC ReleaseDC CreateDialogParamW GetParent GetWindowTextW IsWindowVisible ExitWindowsEx RegisterClassExW InvalidateRect IntersectRect EnumChildWindows GetWindowDC GetDlgItemTextW GetWindowRect UpdateWindow DrawIcon CreateWindowExW wsprintfA GetClassNameW CallWindowProcW DrawFocusRect InflateRect DrawTextW CopyRect CreateDialogIndirectParamW GetDesktopWindow GetClientRect IsWindowEnabled FindWindowExW IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects TranslateMessage DispatchMessageW EnableWindow ShowWindow SendDlgItemMessageW PostMessageW ScreenToClient SetWindowPos IsWindow DestroyWindow GetWindowLongW SetDlgItemTextW |
| GDI32.dll |
SetBkMode
SetTextColor TextOutW RestoreDC SetBkColor CreateSolidBrush UnrealizeObject SelectPalette RealizePalette BitBlt CreateCompatibleDC SelectObject GetDIBColorTable GetSystemPaletteEntries CreatePalette DeleteDC CreateHalftonePalette GetDeviceCaps TranslateCharsetInfo GetObjectW CreateFontIndirectW DeleteObject DeleteMetaFile CreateCompatibleBitmap CreateDCW GetStockObject GetTextExtentPoint32W CreatePatternBrush CreateDIBitmap SetMetaFileBitsEx SetStretchBltMode SelectClipRgn CreateRectRgn SetPixel PatBlt PlayMetaFile StretchBlt CreateBitmap SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx SetMapMode SaveDC |
| ADVAPI32.dll |
RegCreateKeyExW
RegOpenKeyExA RegQueryValueExA OpenThreadToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyW RegEnumKeyW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegEnumValueW RegQueryValueExW RegDeleteValueW InitializeSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RegOpenKeyExW RegCloseKey |
| SHELL32.dll |
ShellExecuteExW
SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation |
| ole32.dll |
CoInitialize
CoUninitialize CoInitializeSecurity |
| OLEAUT32.dll |
VariantChangeType
VariantClear GetErrorInfo SysStringLen SysReAllocStringLen SysAllocString SysFreeString SysAllocStringLen |
| LZ32.dll |
LZOpenFileW
LZCopy LZClose |
| msi.dll |
#88
#137 #141 #169 #8 |
| RPCRT4.dll |
UuidToStringW
RpcStringFreeW UuidCreate |
Delayed Imports
IDR_GIF1
103
10550
10551
10553
10650
10651
1
2
3
4
5
6
7
8
9
10
11
103 (#2)
105
106
107
108
109
119
121
125
126
127
128
129
130
131
132
1000
1001
1008
1026
1034
3003
3004
69
70
71
72
73
76
101
102
103 (#3)
104
105 (#2)
107 (#2)
108 (#2)
113
114
115
116
117
118
119 (#2)
120
126 (#2)
134
135
138
100
112
217
1 (#2)
1 (#3)
String Table contents
| Setup Initialization Error |
| %s |
| %1 Setup is preparing the %2, which will guide you through the program setup process. Please wait. |
| Checking Operating System Version |
| Checking Windows(R) Installer Version |
| Configuring Windows Installer |
| Configuring %s |
| Setup has completed configuring the Windows Installer on your system. The system needs to be restarted in order to continue with the installation. Please click Restart to reboot the system. |
| %s |
| Choose Setup Language |
| Select the language for this installation from the choices below. |
| The installer must restart your system to complete configuring the Windows Installer service. Click Yes to restart now or No if you plan to restart later. |
| This setup will perform an upgrade of '%s'. Do you want to continue? |
| A later version of '%s' is already installed on this machine. The setup cannot continue. |
| OK |
| Cancel |
| Password: |
| Install |
| &Next > |
| Setup has detected an incompatible version of Windows. Please click OK and verify that the target system is running either Windows 95 (or later version), or Windows NT 4.0 Service Pack 6 (or later version), before relaunching the installation |
| Error writing to the temporary location |
| Error extracting %s to the temporary location |
| Error reading setup initialization file |
| Installer not found in %s |
| File %s not found |
| Internal error in Windows Installer |
| Error populating strings. Verify that all strings in Setup.ini are valid. |
| Restart |
| Setup needs %lu KB free disk space in %s. Please free up some space and try again |
| You do not have sufficient privileges to complete this installation for all users of the machine. Log on as administrator and then retry this installation |
| Command line parameters: |
| /L language ID |
| /S Hide intialization dialog. For silent mode use: /S /v/qn. |
| /V parameters to MsiExec.exe |
| Windows(R) Installer %s found. This is an older version of the Windows(R) Installer. Click OK to continue. |
| ANSI code page for %s is not installed on the system and therefore setup cannot run in the selected language. Run the setup and select another language. |
| Setup requires Windows Installer version %s or higher to install the Microsoft .NET Framework version 2.0. Please install the Windows Installer version %s or higher and try again. |
| This setup does not contain the Windows Installer engine (%s) required to run the installation on this operating system. |
| Unable to install %s Scripting Runtime. |
| Unable to create InstallDriver instance, Return code: %d |
| Please specify a location to save the installation package. |
| Unable to extract the file %s. |
| Extracting files. |
| Downloading file %s. |
| An error occurred while downloading the file %s. What would you like to do? |
| hr |
| min |
| sec |
| MB |
| KB |
| /sec |
| Failed to verify signature of file %s. |
| Estimated time remaining: |
| %d %s of %d %s downloaded at %01d.%01d %s%s |
| Preparing to Install... |
| Get help for this installation. |
| Help |
| Unable to save file: %s |
| Failed to complete installation. |
| Invalid command line. |
| /UA<url to InstMsiA.exe> |
| /UW<url to InstMsiW.exe> |
| /UM<url to msi package> |
| /US<url to IsScript.msi> |
| Setup Initialization Error, failed to clone the process. |
| The file %s already exists. Would you like to replace it? |
| Could not verify signature. You need Internet Explorer 3.02 or later with Authenticode update. |
| Setup requires a newer version of WinInet.dll. You may need to install Internet Explorer 3.02 or later. |
| You do not have sufficient privileges to complete this installation. Log on as administrator and then retry this installation |
| Error installing Microsoft(R) .NET Framework, Return Code: %d |
| %s optionally uses the Microsoft (R) .NET %s Framework. Would you like to install it now? |
| Setup has detected an incompatible version of Windows. Please click OK and verify that the target system is running either Windows 95 (or later version), or Windows NT 4.0 Service Pack 3 (or later version), before relaunching the installation |
| %s optionally uses the Visual J# Redistributable Package. Would you like to install it now? |
| (This will also install the .NET Framework.) |
| Setup has detected an incompatible version of Windows. Please click OK and verify that the target system is running Windows 2000 Service Pack 3 (or later version), before relaunching the installation |
| %s requires the following items to be installed on your computer. Click Install to begin installing these requirements. |
| Installing %s |
| Would you like to cancel the setup after %s has finished installing? |
| The files for installation requirement %s could not be found. The installation will now stop. This is probably due to a failed, or canceled download. |
| The installation of %s appears to have failed. Do you want to continue the installation? |
| Succeeded |
| Installing |
| Pending |
| Installed |
| Status |
| Requirement |
| Failed |
| Extracting |
| Downloading |
| Skipped |
| The installation of %s has failed. Setup will now exit. |
| The installation of %s requires a reboot. Click Yes to restart now or No if you plan to restart later. |
| %1 optionally uses %2. Would you like to install it now? |
| Downloading file %2 of %3: %1 |
| This installation lets you install multiple instances of the product. Select the instance you would like to install, and then click Next to continue: |
| &Install a new instance |
| &Maintain or upgrade an existing instance |
| Default |
| Instance ID |
| Product Name |
| Location |
| This installation lets you patch multiple instances of the product. Select an option below to specify how you would like to apply this patch, and then click Next to continue. |
| Patch &all of the existing instances |
| &Patch an existing instance |
| This installation requires Windows Installer version 4.5 or newer. Setup will now exit. |
| Decompressing |
| Version |
| Choose Setup Language |
| Select the language for the installation from the choices below. |
| &OK |
| InstallShield Wizard |
| Cancel |
| &Next > |
| < &Back |
| Do you wish to install %s? |
| Authenticity Verified |
| The identity of this software publisher was verified by %s. |
| Caution: %s affirms this software is safe. You should only continue if you trust %s to make this assertion. |
| &Always trust software published by %s. |
| This software has not been altered since publication by %s. To install %s, click OK. |
| InstallShield |
| Preparing Setup |
| Please wait while the InstallShield Wizard prepares the setup. |
| Finish |
| Transfer rate: |
| Estimated time left: |
| /s |
| %s - InstallShield Wizard |
| Exit Setup |
| Are you sure you want to cancel the setup? |
| &Install a new instance of this application. |
| Existing Installed Instances Detected |
| Select the appropriate application instance to maintain or update. |
| Setup has detected one or more instances of this application already installed on your system. |
| &Maintain or update the instance of this application selected below: |
| Setup has detected one or more instances of this application already installed on your system. You can maintain or update an existing instance or install a completely new instance. |
| Select the instance of the application you want to &maintain or update below: |
| Display Name |
| Install Location |
| %s Setup is preparing the InstallShield Wizard, which will guide you through the rest of the setup process. Please wait. |
| Error Code: |
| Error Information: |
| An error (%s) has occurred while running the setup. |
| Please make sure you have finished any previous setup and closed other applications. If the error still occurs, please contact your vendor: %s. |
| &Detail |
| &Report |
| There is not enough space to initialize the setup. Please free up at least %ld KB on your %s drive before you run the setup. |
| A user with administrator rights installed this application. You need to have similar privileges to modify or uninstall it. |
| Another instance of this setup is already running. Please wait for the other instance to finish and then try again. |
| Security Warning |
| Do you want to run this setup? |
| The origin and integrity of this application could not be verified. You should continue only if you can identify the publisher as someone you trust and are certain this application hasn't been altered since publication. |
| I &do not trust this setup |
| I &understand the security risk and wish to continue |
| The origin and integrity of this application could not be verified because it was not signed by the publisher. You should continue only if you can identify the publisher as someone you trust and are certain this application hasn't been altered since publication. |
| The origin and integrity of this application could not be verified. The certificate used to sign the software has expired or is invalid or untrusted. You should continue only if you can identify the publisher as someone you trust and are certain this application hasn't been altered since publication. |
| The software is corrupted or has been altered since it was published. You should not continue this setup. |
| This setup was created with a BETA VERSION of %s |
| This Setup was created with an EVALUATION VERSION of %s |
| Please enter the password |
| This setup was created with an EVALUATION VERSION of %s, which does not support extraction of the internal MSI file. The full version of InstallShield supports this functionality. For more information, see InstallShield KB article Q200900. |
| This setup was created with an EVALUATION VERSION of %s. Evaluation setups work for only %s days after they were built. Please rebuild the setup to run it again. The setup will now exit. |
| This setup works until %s. The setup will now exit. |
| InstallShield Setup Player V18 |
| The path to the installation contains unsupported characters. Try moving the installation to a location that does not have special characters, and then try relaunching it. |
| This setup requires administrative privileges that appear to be unavailable. Would you like to try again? |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 11.20.19316.0 |
| ProductVersion | 11.20.19316.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | Avision |
| FileDescription | InstallScript Setup Launcher |
| FileVersion (#2) | 11.20.19316 |
| InternalName | Setup |
| LegalCopyright | Copyright (C) 2011 Flexera Software, Inc. and/or InstallShield Co. Inc. All Rights Reserved. |
| OriginalFilename | InstallShield Setup.exe |
| ProductName | AD120 |
| ProductVersion (#2) | 11.20.19316 |
| Internal Build Number | 108642 |
| ISInternalVersion | 18.0.329 |
| ISInternalDescription | InstallScript Setup Launcher |
| Resource LangID | UNKNOWN |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x9c480fd6 |
|---|---|
| Unmarked objects | 0 |
| 12 (7291) | 3 |
| 14 (7299) | 29 |
| C++ objects (8047) | 3 |
| C objects (VS98 SP6 build 8804) | 137 |
| Imports (VS2008 SP1 build 30729) | 2 |
| C objects (9178) | 4 |
| 37 (8755) | 2 |
| Total imports | 380 |
| Imports (9210) | 21 |
| C++ objects (VS98 SP6 build 8804) | 55 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |