39ab4b442716dbc39eb566c3f8bb3d62

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2011-Jul-11 12:26:40
Debug artifacts C:\Users\Leo\Desktop\Visual Basic\Minecraft Skin Stealer New\Minecraft Skin Stealer New\obj\x86\Release\Minecraft Skin Stealer New.pdb
CompanyName Microsoft
FileDescription Minecraft Skin Stealer
FileVersion 1.0.0.0
InternalName Minecraft Skin Stealer New.exe
LegalCopyright Copyright © Microsoft 2011
OriginalFilename Minecraft Skin Stealer New.exe
ProductName Minecraft Skin Stealer
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Info Interesting strings found in the binary: Contains domain names:
  • amazonaws.com
  • http://s3.amazonaws.com
  • http://s3.amazonaws.com/MinecraftSkins/
  • http://www.minecraft.net
  • http://www.minecraft.net/skin/remote.jsp?url
  • http://www.moddb.com
  • http://www.moddb.com/games/minecraft/downloads/minecraft-skin-stealerdownloader
  • minecraft.net
  • moddb.com
  • s3.amazonaws.com
  • www.minecraft.net
  • www.moddb.com
Suspicious Unusual section name found: .sdata
Malicious VirusTotal score: 3/67 (Scanned on 2019-04-14 12:04:30) TrendMicro-HouseCall: HKTL_STEAL
Antiy-AVL: Trojan/Win32.Unknown
Rising: Malware.Undefined!8.C (CLOUD)

Hashes

MD5 39ab4b442716dbc39eb566c3f8bb3d62
SHA1 ba54ee691d58814f6ee1ec46f67791ed0ef3bcaa
SHA256 e141d06723406d6b2a6212500b31026ceb5b4821c838ec8815cf54b47a8e6064
SHA3 c92a51fdc602cbeb411628a23dbb703a7840d0044d64bff1046598c6cabc8724
SSDeep 384:bWvwtokwMFwq6uv7EYF7EY1vAvJsAwAM2zwAM2zwAM2YU4q7BeyQejLf45PQfp0:vlvAvdHHzX7jRXAH+qCrxvAv
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2011-Jul-11 12:26:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x1de00
SizeOfInitializedData 0x19200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001FCBE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x20000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x3e000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4cedb43a03e3c8de52aedcf683c90a91
SHA1 13bfb9b6d4f102e32d67d9251282f2af5be37c4b
SHA256 55d8147cfab4ab2548a199aaadfabdf5068b39163a6190053102dfad805ba08c
SHA3 d912dcbc5f11019962551e3e087020c418c9d8bcd7fe145a6f3b2282b1570e4c
VirtualSize 0x1dcc4
VirtualAddress 0x2000
SizeOfRawData 0x1de00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.97124

.sdata

MD5 d31120b4984bf47d4f4c76a02f9b4e4c
SHA1 8e8532c8dae2b5052e3abbf4c1357180d8b81aa9
SHA256 9b0a9ac607ad4d5f6a31309512938bcb21b8e09d45649579dfde02656a10c9c6
SHA3 e8f885d25978f1674e58bb5244995bd9aee4ae298727779f69b88b402d5a57d1
VirtualSize 0xbb
VirtualAddress 0x20000
SizeOfRawData 0x200
PointerToRawData 0x1e200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.55706

.rsrc

MD5 f30877c1fb78d65e0a364654d9e5e829
SHA1 e54438f9e9699b7c3632ff858345ca53d4eff498
SHA256 2432325fe1aea2240375b0282817097781b7ee301e3a3b2dfb87bd37da5cab97
SHA3 fa42d52fae815dba72e3c69607b89f9977946d76fa2b70c27ef99e3c7481a729
VirtualSize 0x18cb0
VirtualAddress 0x22000
SizeOfRawData 0x18e00
PointerToRawData 0x1e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.51987

.reloc

MD5 345601d0207a6e02e8b64833ada4913e
SHA1 78a6b45b4de2842fe23f453d600c8a1eccf37f9b
SHA256 147c8decb56d782a1d7e75fa6614b8ae98bad5c97ebed3173f3724b5caa8e094
SHA3 48e4497272b50688085e5be4fd33ff2229dea6edbb9aacceb022cf66a74f24c9
VirtualSize 0xc
VirtualAddress 0x3c000
SizeOfRawData 0x200
PointerToRawData 0x37200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.32137
MD5 6c52dd9eb4eb8e2717a29d1d9ce6f881
SHA1 8f4ed722418f8fbfd6302bbb9552e59bf15ee434
SHA256 7fd5dbbe4004d7e279de3e919f4d9ae4e45889e5b64e356d09bb5ec3f86ff34c
SHA3 dad7df4e1c07a00c48fcd903110d6ecf543098438dbe1f4c3dd835aae8247e1f

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.42718
MD5 f8034c539798333c22de6af2d3db4e8a
SHA1 625b3e164ac5d8cf2c9cdc9d29a53014fe7caed2
SHA256 b43efd45bddd061178d7414d2c49bf9ad74a31a135c613bd49864cd6883eb12e
SHA3 426091532cc99481aaa49334f782dcb97da0f41b971d06eae1de10914d4d82d9

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.6816
MD5 3574ebe6a5ce6cd46ed86cd32b6d56e7
SHA1 f4e40e229cc958506caa6d3339325a03f93df5ac
SHA256 b981c4198ff9797ec0407d2f35799b5cbe2886af74c4d4685b6110938441e2ac
SHA3 7957d506d436d1fd20bc1d63dd84f409e1d0708177653620e0d1ef52fcaee0d1

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.42577
MD5 f548d6cbb07e524cd141cafe848b210c
SHA1 4a5ee87200a8bfd9223f46bca429e7995e195a32
SHA256 791f659dbc582fa787e44ab3161d76ccb6f96413e05efc98d8e5f0fe14ed7c8e
SHA3 30ce754560c45892a47fc61e964f521e8c3640da8d658c2a3ab6c2c67234caaa

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.42596
MD5 a0791efbba6f5b21d85d77a332b4f8fa
SHA1 c78489ecdc7b810f2bf14b040447921ea4dae81e
SHA256 0f38ba906d596e801df32de1af8e9ed34ee0685fbfc81634b43d484b29f2b21b
SHA3 9ef77e875fd58781f4aa506a926d6519c717a47ddcc4681dc4d9127111495356

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.86004
Detected Filetype Icon file
MD5 eebc3c4d6747f0eee70b02c21919e58a
SHA1 9d2145db136050f5602041ca094db336a369e3f3
SHA256 0c1c7e641c92c257480e9065e9d7628cf39ad01e9bc321e37641cd86bf23d8ec
SHA3 84c59f3d3397d8b9c41efea48bce3353eee4872fbab07957e4f04a8c84920b7f

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x378
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29769
MD5 73f78a7cc112f028d3513b824f32f6c7
SHA1 f566b59afd0cfe07e35563d1cc0bf1d246751c24
SHA256 aabeb516f7902afef994385a77336f28b99bdcb1bac0bb379383ae9b0938d1ef
SHA3 4af5267dfa01761a53a14b90741e1523861c06b1d086708799c0b8e00d72d005

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
SHA3 93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName Microsoft
FileDescription Minecraft Skin Stealer
FileVersion (#2) 1.0.0.0
InternalName Minecraft Skin Stealer New.exe
LegalCopyright Copyright © Microsoft 2011
OriginalFilename Minecraft Skin Stealer New.exe
ProductName Minecraft Skin Stealer
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2011-Jul-11 12:26:40
Version 0.0
SizeofData 159
AddressOfRawData 0x2001c
PointerToRawData 0x1e21c
Referenced File C:\Users\Leo\Desktop\Visual Basic\Minecraft Skin Stealer New\Minecraft Skin Stealer New\obj\x86\Release\Minecraft Skin Stealer New.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

<-- -->