3706b20574f1aff6f103b9ba085f54c95e78ae70a26f90baa59aa212b08480b4

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2014-Mar-20 00:06:07
Detected languages English - United States
CompanyName CNET Download.com
FileDescription CNET Download.com
FileVersion 5, 4, 0, 188
InternalName CNET Download.com
LegalCopyright Copyright (C) 2013
OriginalFilename CNET Download.exe
ProductName CNET Download.com
ProductVersion 5, 4, 0, 188

Plugin Output

Suspicious PEiD Signature: UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX -> www.upx.sourceforge.net
UPX Protector v1.0x (2)
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
Info Interesting strings found in the binary: Contains domain names:
  • Download.com
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • ShellExecuteA
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Leverages the raw socket API to access the Internet:
  • send
Info The PE's resources present abnormal characteristics. Resource 5000 is possibly compressed or encrypted.
Resource TEMPLATE1 is possibly compressed or encrypted.
Resource TEMPLATE10 is possibly compressed or encrypted.
Resource TEMPLATE11 is possibly compressed or encrypted.
Resource TEMPLATE12 is possibly compressed or encrypted.
Resource TEMPLATE2 is possibly compressed or encrypted.
Resource TEMPLATE3 is possibly compressed or encrypted.
Resource TEMPLATE4 is possibly compressed or encrypted.
Resource TEMPLATE5 is possibly compressed or encrypted.
Resource TEMPLATE6 is possibly compressed or encrypted.
Resource TEMPLATE7 is possibly compressed or encrypted.
Resource TEMPLATE8 is possibly compressed or encrypted.
Resource TEMPLATE9 is possibly compressed or encrypted.
Resource IDB_CHECKMRK is possibly compressed or encrypted.
Resource 9 is possibly compressed or encrypted.
Resource 13 is possibly compressed or encrypted.
Info The PE is digitally signed. Signer: CBS Interactive
Issuer: VeriSign Class 3 Code Signing 2010 CA
Malicious VirusTotal score: 31/70 (Scanned on 2026-07-11 17:35:01) Alibaba: AdWare:Win32/CNETInstaller.2ad04137
Antiy-AVL: GrayWare[AdWare]/Win32.DownloadWare
Bkav: W32.Malware.C10443EE
CAT-QuickHeal: PUA.Cbsinterac.Gen
CTX: exe.adware.downware
CrowdStrike: win/grayware_confidence_100% (W)
Cylance: Unsafe
DrWeb: Adware.Downware.20747
ESET-NOD32: Win32/CNETInstaller.B potentially unwanted application
Elastic: malicious (moderate confidence)
Emsisoft: Application.AdLoad (A)
Fortinet: Adware/DownloadWare
GData: Win32.Application.Agent.6TFDA9
Google: Detected
Gridinsoft: PUP.Win32.Downloader.vl!c
Ikarus: PUA.CNETInstaller
Jiangmin: AdWare.DownloadWare.ev
Kaspersky: not-a-virus:AdWare.Win32.DownloadWare.vsv
Lionic: Adware.Win32.DownloadWare.2!c
Malwarebytes: PUP.Optional.BundleInstaller
MaxSecure: Trojan.Malware.6983565.susgen
Microsoft: PUADlManager:Win32/InstallCore
NANO-Antivirus: Riskware.Win32.Adw.eaytvp
Rising: Adware.DownloadWare!8.933 (CLOUD)
SUPERAntiSpyware: Adware.DownloadWare/Variant
Trapmine: malicious.moderate.ml.score
VBA32: BScope.Adware.DownloadWare
Varist: W32/S-85d83256!Eldorado
ViRobot: Adware.Downware.929416
VirIT: Adware.Win32.Downware.DTD
Webroot: W32.Adware.Installcore

Hashes

MD5 122e0fe0bd52d264ffb874e538114473
SHA1 19876b0c21073ce7ac4725124851fc36b7ea7301
SHA256 3706b20574f1aff6f103b9ba085f54c95e78ae70a26f90baa59aa212b08480b4
SHA3 7d23f0d0188e844f1c27b1a160ff1246466755a44bdba54285012e703794aeec
SSDeep 24576:tGiUKDDpPJ+/rX1aUZ0xlNwqg+wJROS6Fk:tGiUSdR+4Nx/wFB3OPF
Imports Hash 79a39d591fa5f8a503daba1ac8de118d

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2014-Mar-20 00:06:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 9.0
SizeOfCode 0xde000
SizeOfInitializedData 0x5000
SizeOfUninitializedData 0x147000
AddressOfEntryPoint 0x00225010 (Section: UPX1)
BaseOfCode 0x148000
BaseOfData 0x226000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.0
ImageVersion 0.0
SubsystemVersion 5.0
Win32VersionValue 0
SizeOfImage 0x22b000
SizeOfHeaders 0x1000
Checksum 0xe30bc
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x147000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 54af03e84c6eccc398248b059cf5e759
SHA1 1621b695695790ba1a32e9670e4ca75cff4442f7
SHA256 a151ecefedc114795c5da13e12cd9861e834689d53af761062a4ae878dc79079
SHA3 4c7d66241551ba142a0c714898f821851c3a24ce6229e7b7bc4805b5868be80a
VirtualSize 0xde000
VirtualAddress 0x148000
SizeOfRawData 0xdd400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.93345

.rsrc

MD5 e8f2ba25e928b30dce2702280f057a0f
SHA1 631662766cc739bdb4fb0d636f5f34c543b4bcc4
SHA256 5bf9a31a074d828b1aca2c6b04333b224a5d05f530fbdc0453bbcfe04e440143
SHA3 11a58a8d211c34d31a13bd111db82d3766a0a0351bce7b964c6a144ae4f67a13
VirtualSize 0x5000
VirtualAddress 0x226000
SizeOfRawData 0x4800
PointerToRawData 0xdd800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.91772

Imports

KERNEL32.DLL LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
ADVAPI32.dll FreeSid
GDI32.dll LPtoDP
gdiplus.dll GdipFree
ole32.dll OleInitialize
OLEAUT32.dll SysStringLen
RPCRT4.dll UuidCreate
SHELL32.dll ShellExecuteA
SHLWAPI.dll PathFileExistsW
USER32.dll GetDC
VERSION.dll VerQueryValueW
WS2_32.dll send

Delayed Imports

5000

Type GIF
Language English - United States
Codepage Latin 1 / Western European
Size 0x423a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.91544
MD5 12bdd9751c34874ca9819281138e719b
SHA1 0af5f52f6ddb0ea6aeee5069d099aff0469778b6
SHA256 2694f2308088206561e80d0bbec51b75fb627546f250825ed6ef0efa642d81bf
SHA3 788d3c6d14af92cbf8acd28e20f46678b7fbfa72a7da79a372932fd46e94ee6d

TEMPLATE1

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x566
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.65949
MD5 a6271fc2269788db3b93542ce4388ec3
SHA1 51fe57f01133b8f14a7514f169f101bab25e507f
SHA256 bcb332f031770a63dbde70188198d1d1d550935981de7d7b9b0d5a680a734baa
SHA3 6a8a7a11f2c535212252ca3f533265de44c43d68059308026b5a1f208fc2f4c4

TEMPLATE10

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x658
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.73626
MD5 6a033dfeeeec07a4d94809c34c1a15d0
SHA1 4ee600e857981b8b7360cefc2e127376e3728722
SHA256 6d80007bfe97d49947f916667ff86ae64251d08309d0bdf4cb211c624f47c99f
SHA3 0cb0824f4d653733e1ebaf8525bdc4e7b3893212eef945f22f355b47ed3d9227

TEMPLATE11

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x5e0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.74206
MD5 9bb27d06c67f769e4907a98c0645978a
SHA1 001da8e24fd0c758a3c2ae546bcb0971d7865ac0
SHA256 9d62a50e0cdf289705852e01e8168e630ae2e0540ea6461b8c2b51572f41d480
SHA3 36caf919837eb6bae22d5a6a4ce40dd2f1a42d82786356dc871b4e04f4b3d9eb

TEMPLATE12

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x712
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.39294
MD5 eb53698382d27837eea346642c3a3471
SHA1 9c18be3cd60bcb24db01f5b8c0c632f02cc22f82
SHA256 97236abd40b0f86eb478efe6669acdb6de4ace5aef6ca4ec6f68825b377a4030
SHA3 e1faad5b2e64a0dd8e8aec8c6c3f1ec5ad41a0732b806319d6020d9afea77254

TEMPLATE2

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x34a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.44563
MD5 e5d6d8124094b46143c7d503b64b45e5
SHA1 c17a743328c390cf1e59c6ccb9cae2d37427179c
SHA256 2a0b1d3dfdb7d30ffc9d6022d1475286705d5e16038e0103790f9ea9f11ab01a
SHA3 71c2d6f469a21afb6e6a06843edfa26126e3804857c72ceb745d31f18b08c27e

TEMPLATE3

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x3fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.28594
MD5 816132675da52fd8dca14d3de4b84c9d
SHA1 5f53717ace32bb893756b28e33889ad223db0b56
SHA256 f95868d1041bf93226f7b1e357d534f331832f4ddc5c93b4444d1df0c557d949
SHA3 3ef27d7bddcd0a789b23a7e426d88fcf06a3a608591f4f3e0e1aec17e3ee900b

TEMPLATE4

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x4f0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.37942
MD5 998205a20c81c41c4cfddcb1f639ce76
SHA1 35dedf6a625d0a07fd498e69c441d4c321ed525f
SHA256 4aa1f47710621174b7ca9e34e7e9853f8ab588abfe85f6eaa25221b0ff91c750
SHA3 153437a9874121930c28e29cb854ad329844419b5847562ef20213a92610e19b

TEMPLATE5

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x33d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.23227
MD5 7f473c5351a83cf9cfcd7d04f709e015
SHA1 99389f18db61b47ee88cfadd7f980749e85dad9a
SHA256 9213a7df5119b71ba54cbefbc3bc1a3a4e8cbdc3e9cb07db9e5bb20601390540
SHA3 710b61a9b6915523395de0f0efabe213c7f8979b7f9a1bb75c3d2c79f6dcd828

TEMPLATE6

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x47e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.59079
MD5 3fdf87225ea380f570a3e638a4613271
SHA1 98995157a10b724f5feaf41670ef4641c19496d7
SHA256 6b65dbce737f76cba5a28d08b45d0c70dd93de9573d9e08ce3ee43f4f7f35cb4
SHA3 be5b86dd94e6c212725cccbc1c96920776898b9674cd7fe6b9ad22ffdc0fd460

TEMPLATE7

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x34a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.65202
MD5 68af3c6c01e9b7ae2024c3513baac0d8
SHA1 b63160c91b7b4274d571d8cd14371dcc4d7bfae2
SHA256 90d221db7ea96146af839bd9e211f1fcb7b26756ad7011a18e1d095c79aa8ee0
SHA3 9998430a999817ac6067573e7441b0232af268e2bada507b8deda7a8be09fa1b

TEMPLATE8

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x4f3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.71011
MD5 095a8551f0e43f4a727718b2af61c4b1
SHA1 d17029dc5709a90fbd733e5dc133e7590c26f7be
SHA256 107eb4c5e6b15268d1d6d1bb9a2c941afe1738997328b02107a152bfce1a28c8
SHA3 ef0b92074061744ef78976edbdfde7d689a979d66566c25801805b2044701539

TEMPLATE9

Type OFFERTMPLT
Language English - United States
Codepage Latin 1 / Western European
Size 0x47f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.70959
MD5 56cb3afa4b2979d432809bd70d7f1820
SHA1 0c2dd05e2426fc36ae30ab94661ddc143a24c061
SHA256 25f5148e8f3db72ac9a060cd2042453a3524a314de6d2fa9307df71a10805bb8
SHA3 a8cef13e7e824db5f318a9bc4e4fb5926e2e346bfb7ac802a2baf0b5899c8e57

IDB_CHECKMRK

Type RT_BITMAP
Language English - United States
Codepage Latin 1 / Western European
Size 0xc28
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.72728
MD5 36fc72d8ee1dc5be720a0c1d6776cf41
SHA1 ec65c5b418cf799b5ebe291746619dd413b67c63
SHA256 ee37c8f3972f3d52be26f6c4f09061b82252f21d16b9312f5f9702483b43efe4
SHA3 2ca25cd6e4446e29efa07dbfc284d0fa528a611d962e6c0035f6ae4e7dc823e8
Preview

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x2668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.55303
MD5 75da8a0e7143eb1ff98152633ea77a90
SHA1 342d01079566f354530898557f2200bae80a1343
SHA256 36d4e30c918903fba5ec5a4862d1e602d5f6419531b6a4687c17f2f94c2d8172
SHA3 bc27197c2ae7e621173987a02f4c2a0b74e61a613ba579573432870376b6757a

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x1128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.06836
MD5 ed4bb538551ddae3e91a0950e9034c89
SHA1 05844b7c84867bf2f04e1878d894d9378329bd91
SHA256 be1174cf442560de6affe8efa49dedf21ff10bd0f78bb0d27fb96af7fd6fb233
SHA3 8b78b62dcb7cf8368c9226142f599b2a337e99030f1248411199981092f3fc2a

107

Type RT_MENU
Language English - United States
Codepage Latin 1 / Western European
Size 0x20
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.1875
MD5 82347ef29493866eb4bbf29b97b6a268
SHA1 f2adb88ce1d467d679fbd615152bc1aaa0237101
SHA256 1adc11f4ce50beea522bc3927753a92ea9733984170abd493213bdfc759b1b6b
SHA3 ad9ab00913e940ed1c8f64a52490102693a34863b1de8037b3c90168dbf04a89

103

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x148
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.65936
MD5 f81c593c4c12fb147661231d8a61c434
SHA1 06363cd2bd2641adafa5304b9e6c946a43a4f318
SHA256 c78cea7f5d6455aa0e6993231a9515f012a86e529a6e71ff1290bc3308166506
SHA3 3e4a332888b7138a70d4387b35ac325639f6a667abf06fa29b1d361509244593

7

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x1c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.87247
MD5 3370fca98a273636f0b128c9c36faeaf
SHA1 ff69b6986acaeda135aaf52d5acd43e9fa4b4b33
SHA256 1b05010211b952ce95ebd06f9d739c7acffa2305b8c1cb503895614f1c778437
SHA3 ba53a77b13a53af4812600baebbab52958984b8b9c1fa674047727d937fa9886

8

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x280
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.91046
MD5 3e8791806416deeab8e9dcecdc49ba1e
SHA1 0342a21380f498735cf67cc94ccd1cfa42fe6ae7
SHA256 905b94ec8861adb0604f789c9c62c61ea5ff3cb945c849949bd1a9086a4c8bd8
SHA3 f6cb512887f492178003e794b30f0b3e09ceb883a6cbe7292188f0875f7a929b

9

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x276
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.2139
MD5 8ef0bcb3b5c49f2ac6f17728a44e6323
SHA1 8d66df0f33f96101e9de61f62cde9698953c6d79
SHA256 aba82ce77f57526645711b3edefc9d5a5159513eb0f24bd4f289473b5db110e9
SHA3 0267dfe4fb29a54dd8dacd313eb25c343025233dbf1f9496f5ddd1100ed24623

10

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0xf4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.76142
MD5 ae66a6ae177512073ad0d617d282035a
SHA1 bba88de97c147fa820132bb6dbd249fa76b7758c
SHA256 e6e1ed038d30211a7f418e2f8e30e32d096e18594f61e48fa7098a067a22b18c
SHA3 1c608c04daf2da1335d3708a3c03761c751858fe12fed216a6e1b44cdcb1f97a

11

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x3a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.51988
MD5 61a7d8ecbd7e4b9778ff7b5eee2b264e
SHA1 534e4235b1514dae300574e2401ca67bc730cb90
SHA256 e1f6b0622f06e345c097fa65c7c7e901a7e5d684cdc8e01709962ba3fb95405a
SHA3 0875054785cfe3499e9e55ca4fb9f51f57ab1939950b5b601588184bfcd2c3a1

12

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x5e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.31252
MD5 1f05580a5b98ebe3b34d7a63872a9ee6
SHA1 e71230c51a72462137375bd65dd869343a497151
SHA256 5656080af19be3ff18df970d834c988f3ee044d1383fff2bb9020457eccce159
SHA3 c4338da211a1c5babc1e983b324c65e432a2078b7879f6a43a3c05d18e815fc3

13

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x2c6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.5709
MD5 e462362cc2efe2822842acc39f442089
SHA1 1572bd1c72ca900bd6ad89a7c8cbc0eba6aae1c0
SHA256 997d64788c7c76cfdc23491cb9a6c90ce53441c92c15251164c2377d3ebdc0e1
SHA3 1d07e79395a58dc8376858c9c6621cd77671c2304542a5672799ce703377e67d

109

Type RT_ACCELERATOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x10
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.875
MD5 8dc649ce30da620b03f52dc2132c3f66
SHA1 8c006b4a6100a8872e5322eabfc56c5feae602d5
SHA256 c504453de74a85382db4f3de852158a344ed8b8da23e540558cacc6505febadd
SHA3 b490dfd3e0dbaf78399f6bf546d573e45ae1237b2fedd22d48e2985df60043e6

107 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.29162
Detected Filetype Icon file
MD5 81f7cebc95feab3a14210c41675c801f
SHA1 fa9cd219816a490c661924bfc1250edac9f51f57
SHA256 b04ae94900f78a6d2345e94e41a7174b6110073bce52976156bcc08f6294eb44
SHA3 fe0c52115dce34abc930bfa1c0d548eb5ea825596961c1d93334415a278ad6ec

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x308
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43735
MD5 30c93b449625405577c62244e8aff3d1
SHA1 f6eaa56f27ae21be4d6c588fe233c998b6231ed9
SHA256 b8555c5ce6a14e8735c0c804e9f79c9243d44ec74a86598845bec560f631c495
SHA3 b9aa98f5201ec16f76af798613c513d30e7fc4a5e787d48c20fbade9acdf4ac5

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x279
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.10579
MD5 e1af2260732328bf3ae42258faf1a12d
SHA1 9d8058140270921489e6be6db7f4e0af2b89993f
SHA256 4fe270a8fcc62d715dbae1fd0e2f78ce8a068121113873c710d4ff6cda29756d
SHA3 0f364508ae8f4cc97142e5cdd41ebc4acb8cc25fe5881cc1760b6299a3621930

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 5.4.0.188
ProductVersion 5.4.0.188
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName CNET Download.com
FileDescription CNET Download.com
FileVersion (#2) 5, 4, 0, 188
InternalName CNET Download.com
LegalCopyright Copyright (C) 2013
OriginalFilename CNET Download.exe
ProductName CNET Download.com
ProductVersion (#2) 5, 4, 0, 188
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x5f0180
SEHandlerTable 0x5d9430
SEHandlerCount 386

RICH Header

XOR Key 0x409b4809
Unmarked objects 0
150 (20413) 10
ASM objects (VS2008 build 21022) 43
C++ objects (VS2008 build 21022) 78
C objects (VS2012 build 50727 / VS2005 build 50727) 7
C objects (VS2008 build 21022) 255
C++ objects (VS2012 build 50727 / VS2005 build 50727) 1
C++ objects (VS2008 SP1 build 30729) 13
Imports (VS2012 build 50727 / VS2005 build 50727) 25
Total imports 318
138 (VS2008 build 21022) 86
Exports (VS2008 build 21022) 1
Linker (VS2008 build 21022) 1
Resource objects (VS2008 build 21022) 1

Errors

[*] Warning: IMAGE_EXPORT_DIRECTORY field Characteristics is reserved and should be 0! [!] Error: Could not read the exported DLL name. [*] Warning: Section UPX0 has a size of 0! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8! [*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
Leave a comment

No comments yet.