3c46d668dca40015d5462f4c61868e602f42cd255885bbabcdfe3d3bf7868f92

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Apr-05 00:35:34
Detected languages English - United States
Comments This Program is Free!
CompanyName Topersoft.com
FileDescription Launcher for Zapret
LegalCopyright Program by TOPER © 2024-2025
LegalTrademarks TOPERSOFT © 2024-2025
ProductName Launcher for Zapret
FileVersion 2.07
ProductVersion 2.07
InternalName Launcher for Zapret
OriginalFilename Launcher for Zapret.exe

Plugin Output

Info Matching compiler(s): Microsoft Visual Basic 5.0
Microsoft Visual Basic v5.0/v6.0
Microsoft Visual Basic v5.0 - v6.0
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • RunDLL32.EXE
  • RunDll32.exe
  • schtask
 May have dropper capabilities:
  • CurrentControlSet\Services
 Accesses the WMI:
  • root\cimv2
 Contains domain names:
  • Topersoft.com
  • api.opennic.org
  • forum.oszone.net
  • googlevideo.com
  • http://cwer.lib
  • http://flibusta.lib
  • http://forum.oszone.net
  • http://forum.oszone.net/image.php?u
  • http://rustorkacom.lib
  • http://rutor.lib
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/windows/2004/02/mit/task
  • https://api.opennic.org
  • https://api.opennic.org/geoip
  • https://api.opennic.org/geoip/
  • https://p.thenewone.lol
  • https://p.thenewone.lol/domains-export.txt?gbdpi
  • https://p.thenewone.lol/domains-export.txt?zp
  • https://www.opennic.org
  • https://www.opennic.org/
  • microsoft.com
  • opennic.org
  • oszone.net
  • schemas.microsoft.com
  • www.opennic.org
Info The PE is digitally signed. Signer: TOPERSOFT
Issuer: VeriSign Class 3 Code Signing 2009-2 CA
Malicious VirusTotal score: 43/71 (Scanned on 2026-10-10 00:48:49) ALYac: Gen:Variant.Adware.FCA.190
AVG: Win32:MalwareX-gen [Misc]
Arcabit: Trojan.Adware.FCA.190
Avast: Win32:MalwareX-gen [Misc]
Avira: TR/W32.Agent
BitDefender: Gen:Variant.Adware.FCA.190
Bkav: W32.Malware.77B46FA5
CTX: exe.trojan.goodbyedpi
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
Cynet: Malicious (score: 99)
DeepInstinct: MALICIOUS
ESET-NOD32: Win32/GoodbyeDPI_AGen.X potentially unsafe application
Elastic: malicious (high confidence)
Emsisoft: Gen:Variant.Adware.FCA.190 (B)
F-Secure: Trojan.TR/W32.Agent
Fortinet: Riskware/GoodbyeDPI_AGen
GData: Gen:Variant.Adware.FCA.190
Google: Detected
Gridinsoft: Trojan.Win32.Agent.dd!c
K7AntiVirus: Trojan ( 005ddb8b1 )
K7GW: Trojan ( 005ddb8b1 )
Lionic: Trojan.Win32.GoodbyeDPI.4!c
Malwarebytes: Generic.Malware/Suspicious
MaxSecure: Trojan.Malware.74167952.susgen
McAfeeD: ti!3C46D668DCA4
MicroWorld-eScan: Gen:Variant.Adware.FCA.190
Microsoft: Trojan:Win32/Kepavll!rfn
Paloalto: generic.ml
Rising: Trojan.Starter!1.9F6D (CLASSIC)
Sangfor: Adware.Win32.Goodbyedpi.Vd6g
Skyhigh: Artemis!Trojan
Sophos: Mal/Generic-S
Symantec: ML.Attribute.HighConfidence
TrellixENS: Artemis!4F3B4B1A5012
VBA32: BScope.Trojan.Kepavll
VIPRE: Gen:Variant.Adware.FCA.190
Varist: W32/ABTrojan.CKDZ-6329
ViRobot: Trojan.Win.Z.Kepavll.1116896
Webroot: W32.Adware.Gen
Xcitium: ApplicUnwnt@#oszd5wn8tg7v
Yandex: Trojan.Igent.b4rzHl.2
alibabacloud: Trojan:Win/GoodbyeDPI_AGen.X

Hashes

MD5 4f3b4b1a5012e54adc4809011fe935e8 🔍
SHA1 b87bd68349089ac370a2403983fc1b821f443b7a 🔍
SHA256 3c46d668dca40015d5462f4c61868e602f42cd255885bbabcdfe3d3bf7868f92 🔍
SHA3 5c47ae5b92138e05a5b9de56d754167b86f0065b448263913ed3ad8f3ed1f3a4 🔍
SSDeep 24576:rLeXyi3B0m4w1C7kXX3hBzq8LwHvbUA/Fj:1oBrB0p 🔍
Imports Hash 725cb243e0612f5bd0df7e71857a38dd 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xb8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2025-Apr-05 00:35:34
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.7
SizeOfCode 0x104000
SizeOfInitializedData 0xa000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00007B50 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x105000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 2.7
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x112000
SizeOfHeaders 0x1000
Checksum 0x11aa12
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 28d25852676876035e27cdb28d2c78f3 🔍
SHA1 68bed55d20f9fc56061252963234e53cbc5d161d 🔍
SHA256 fbda7dc51d3bef2e64e03957142580e37ebc933977bad14be9fbbe72b92e59d1 🔍
SHA3 4c75a14e56c74a5b9ef7602a5577df245a187359a26373f9c75a2cbfe569214c 🔍
VirtualSize 0x103794
VirtualAddress 0x1000
SizeOfRawData 0x104000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.3787

.data

MD5 620f0b67a91f7f74151bc5be745b7110 🔍
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 🔍
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7 🔍
SHA3 a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563 🔍
VirtualSize 0x3564
VirtualAddress 0x105000
SizeOfRawData 0x1000
PointerToRawData 0x105000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 2cf3df29534004954032cb0be40c5493 🔍
SHA1 91b6d16e6612f8451f12f63a74c7ef3906558e60 🔍
SHA256 0b4723d8dac3b0fba6c6ddd2c8740c494a00dcd3a2663cff5f2f4d87be3da010 🔍
SHA3 2a9aba5e288731bf168dbab5b32435dcd832297012741d07667ab16530abd546 🔍
VirtualSize 0x8620
VirtualAddress 0x109000
SizeOfRawData 0x9000
PointerToRawData 0x106000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.22752

Imports

MSVBVM60.DLL __vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaLineInputStr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
#621
__vbaFreeObjList
#516
_adj_fprem1
__vbaRecAnsiToUni
#519
#626
__vbaResume
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
#553
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
#666
#593
__vbaVarForInit
__vbaExitProc
__vbaOnError
__vbaObjSet
#595
__vbaStrLike
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
#598
__vbaFpR4
#520
__vbaBoolVarNull
__vbaVarTstLt
__vbaFpR8
_CIsin
__vbaVarZero
__vbaVargVarMove
#632
__vbaChkstk
#526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
#529
__vbaGet4
__vbaVarTstEq
#560
__vbaObjVar
__vbaVarLikeVar
__vbaI2I4
#561
DllFunctionCall
__vbaVarLateMemSt
#670
__vbaFpUI1
_adj_fpatan
__vbaLateIdCallLd
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
#600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
#711
__vbaStrToUnicode
#712
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
#607
#714
#608
#716
__vbaFPException
#717
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaFileOpen
#570
__vbaInStr
__vbaNew2
__vbaR8Str
#648
#571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
#100
#579
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
#610
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
#612
__vbaVarCopy
#616
__vbaFpI4
__vbaLateMemCallLd
__vbaRecDestructAnsi
#617
_CIatan
__vbaStrMove
__vbaCastObj
#619
__vbaStrVarCopy
__vbaR8IntI4
#542
#543
_allmul
#544
#545
_CItan
__vbaNextEachCollAd
__vbaFPInt
#547
__vbaVarForNext
_CIexp
#580
__vbaFreeObj
__vbaFreeStr
#581

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.66043
MD5 501b2555599b41cea1672ebfc4adba47 🔍
SHA1 2a51350bfcce2d5cb33df5479c29160fcd2453c5 🔍
SHA256 bdd78a537eef541d9cff225e50ad05706ae1013b967bd31e8e7e9bc4fcfc0da9 🔍
SHA3 b8223c14d51a8c69c2d046f50909ba5c0b3b75e91f28cdbd3e741290aedc7190 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.93341
MD5 1041fbebed9807bc36b4e2c00c22c5ac 🔍
SHA1 31c63c076b607bc46902cd70added98099a3054d 🔍
SHA256 4f034231e64aa28b4d9aa887c419e1d3aec0da266edc3556c960ddb26c237c2d 🔍
SHA3 041a9f826d5bf32dbfc623f1125ec14072ba0db3faab9ff676b9fa51dbe3f097 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.13217
MD5 6362f1eb429fa7f97626bac6a1fe1bad 🔍
SHA1 4ffd0803970dee69f6a198b4eb6fd403dee0db3d 🔍
SHA256 ec164a87f101deb2ff9605d25817b8a999d5e8d664e3823db41e2dd781c512fb 🔍
SHA3 1493808240b05f2d267375130dca2185d63bb4b4a6e3e0c55f5f1f15be7b46d6 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.55181
MD5 ef93c5e53d5ec1bbee56b8067f6bbe24 🔍
SHA1 30338324d4726cc57ec3b8a63c737d8fa7d8e776 🔍
SHA256 d98b0fe957b5ca4ed25bd9ce564aadd5381d3382a801676dc9b31e70cf7d4aa4 🔍
SHA3 f4f7105e3538f3b2179979e88387e88449c7aa9930bb4c5ac474571304945149 🔍

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62308
Detected Filetype Icon file
MD5 7266d550f7fc2a4f9527ac534831ee65 🔍
SHA1 2655a17d14813113c955d1059f4679dcc405c070 🔍
SHA256 822952416183dc59088127325e52faebc96d08a97d76bd9202cc4880de84f48e 🔍
SHA3 0fdf51b4f52294affe8ece587a1ff20f47fe201efed87ab32ecd585ef0b98df0 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x3a4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40742
MD5 bceb76179afe03592ebda80e0593f6a6 🔍
SHA1 d481ffab7f28711836d372d94921bc1d15225740 🔍
SHA256 3f3415af6c4cf7b132b490906c46428feb2b32088c7086f0f8e11bed5ae9f558 🔍
SHA3 240a884745c2c266c74cc28d305f79d5ea04d7fd7b8b946b2a569132d3e88dc8 🔍

1 (#4)

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x39a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.8043
MD5 48e1d03aaec8a6afd72ac622dd07cb54 🔍
SHA1 296491519731a82a94e2f6254bee6b35590ed136 🔍
SHA256 d3a6a49263e7e31fa22763dbd7cbea2a96fad56206315b64847a7a427176a272 🔍
SHA3 96d4715bf972fe15b7b688e62e65e02ed20b5cb05ce2185ce9e4a59b318a9ef3 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.7.0.0
ProductVersion 2.7.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments This Program is Free!
CompanyName Topersoft.com
FileDescription Launcher for Zapret
LegalCopyright Program by TOPER © 2024-2025
LegalTrademarks TOPERSOFT © 2024-2025
ProductName Launcher for Zapret
FileVersion (#2) 2.07
ProductVersion (#2) 2.07
InternalName Launcher for Zapret
OriginalFilename Launcher for Zapret.exe
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x91a515f9
Unmarked objects 0
14 (7299) 1
9 (8041) 8
13 (8169) 1

Errors

Leave a comment

No comments yet.