3d49f8ce766923bb8bc9c885e2c8cbd1abe040a00bc24cb976d4c7415c0f6485

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2010-Jan-06 01:50:34
Debug artifacts d:\John\My Documents\Visual Studio 2008\Projects\PensColor\obj\Debug\PensColor.pdb
FileDescription PensColor
FileVersion 1.0.0.0
InternalName PensColor.exe
LegalCopyright Copyright © 2010
OriginalFilename PensColor.exe
ProductName PensColor
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ 8.0
.NET executable -> Microsoft
Suspicious Unusual section name found: .sdata
Section .reloc is both writable and executable.
Suspicious The PE is possibly a dropper. Resources amount for 83.4078% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 0e01c6987e80b70b30e00e6f3a767c93
SHA1 aafb1a6dc2fe018ccbf1edaf23700801db864f74
SHA256 3d49f8ce766923bb8bc9c885e2c8cbd1abe040a00bc24cb976d4c7415c0f6485
SHA3 a0fcf4ca2c029a993725868fa8c48ced4a9b764be000d972757badb520a98246
SSDeep 1536:xj5/E7kE/jJgeiikFY0vFmLWfPzCYPRI84V30F8MeucLq8IrqHNasg9l34adZK:x5/E/jWVLFYQmSRPY30/8qhyab4ad
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2010-Jan-06 01:50:34
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x7200
SizeOfInitializedData 0x27a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000907E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0xa000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x36000
SizeOfHeaders 0x400
Checksum 0x316bc
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 14b6d78a45db86d918463ea885319c0a
SHA1 562680762bfbb0d3e4e679051cdab7561392a2b0
SHA256 3e518b0c1c4e78ae009fbf9761a57f1ff3b274ba11572d545f1320cc18de86a2
SHA3 7d8128ab9cd6069702d5b57c15cf78b129258624db0b022d10e72332c25dd0ca
VirtualSize 0x7084
VirtualAddress 0x2000
SizeOfRawData 0x7200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.47742

.sdata

MD5 aa131f87f976be62f6af8291b216e1e9
SHA1 e9095e1ee6d2d4b1d3dca48c66b770a8a512fb70
SHA256 ee2548762e81f0cd83f8cfc12a31cd0c5bd2168aa2da3370ecc377883e265014
SHA3 ad32b52d5de0217d016985be830f4304fa04ea4b7a17b2878c2daaafca82c758
VirtualSize 0x87
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.95408

.rsrc

MD5 f4f8492df2a49cf1ed97c91ae04e11bc
SHA1 f57e55dfbc2eab85a99cd4987e59e7d0db91c17f
SHA256 2c1a1724969271acd748708fcfcfd4db35a4943b34cf227151700702a4ade1c1
SHA3 e96700046ffe963f8e1b22ae1d70b51ad10ce500dcf802046064041a0c6c01fb
VirtualSize 0x27590
VirtualAddress 0xc000
SizeOfRawData 0x27600
PointerToRawData 0x7800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.0969

.reloc

MD5 56983732e2a63c5409119d259bbc180b
SHA1 d8dd13b8c8092196d267843aa6279e7ae60bd1f3
SHA256 a64097be1cd7ae7e7ba3c82da583de2e8db6528ea5b96005b8639f3149d3d838
SHA3 cdb74fb6f1a3aa276bde3a959f7a64c8dd33e37f0052c40f4aad297d934824eb
VirtualSize 0x16ca
VirtualAddress 0x34000
SizeOfRawData 0x200
PointerToRawData 0x2ee00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.40739
MD5 d44953c2fd2fa431f72b18dfa89d6fcd
SHA1 4310e84364ea7a1152e84032813271626deb67fa
SHA256 0992452a348ddba931a343f617d850bfa02f302ee43393b6df745406baefe6cc
SHA3 14ceb207694bb1f9109c353bb6963a0346a354356cb41b638a65f40ced1d8ce8

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.16745
MD5 1bd5278e56d24860a1667eec1fb07965
SHA1 d63ea49cdfbf15488c36f92bf6d560b4283e5ba1
SHA256 e76dbeeb2757fda69ecc5c2219cc6e5e0d6d7b6cd7607c809d5c169e402cd27e
SHA3 2a9ce77ed54183baf0e9c037fd6d5f802a0c761d795a77fcf90c99143f3b3201

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.10906
MD5 8db4b9ada1cb8f87b6ac6ca6f8347ba5
SHA1 e9fd078de90ef1ef86f3330bbd5b69d1a79c4e41
SHA256 398b5f4bf8baf369cd3b6333564ce48b06d051ef6169efa31c3f535b0073d73b
SHA3 d18a1502d2b112fb049f917cf3ebeda6b461334a12e6cf821299eb0c743925df

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.04974
MD5 476b25d9152bfde5f8622715188aa0b7
SHA1 323e66f3a2c6804063d138721b8d45d86be3432a
SHA256 76e53f6d34c4ed3a7d971a86d59a31ccb3b819fb36289b41ecaa0407df355583
SHA3 267e875cce80d7e8b65569718333c9afe0d2bfff81e4e1211743d05362b533c9

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.01329
MD5 d010ffdeae9b24a36fcd16eea1cabe6c
SHA1 93242dd11dfc1d4e94af1749fb27c0fc765754fc
SHA256 fc3a4adfad89bd8707c815db0a3d2438525c35ceb917756a03c227898264f3e2
SHA3 cd2eaf0e6c1545e8c214b1bfeca5b28ea3db2ff525c64ecb71512b7285d4d114

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.04417
MD5 63811c0da83b4703afed5ab01179c64d
SHA1 54cebb5f000fdacb0505d3510fa014ec0f189570
SHA256 67a910b625d0baf408bcd17b5922c869cc71f455bfb7fd49813e6a82a176654f
SHA3 5a719354c8964737e7d3e109e57a8e51b46fcc5809e11a8be0da38464ffcf189

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.07133
MD5 c4d30b31b0ecba9cab296f8dd336aef2
SHA1 95d2eeaacb62e6715003075fbcf7f99c14ec3b22
SHA256 13672eaa6bc8e2779cd8d42e0994d38131ab2451e6efd2a15858b90a98dd1de5
SHA3 95cae2f2bd762be1961871d6bd108828448c313e3a8aa053263f3dae212ff4e1

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03706
Detected Filetype Icon file
MD5 c2394e6ded182029c99479f26222072a
SHA1 d4dbbaddde4122b9015851468f37871d11f3206c
SHA256 815dfb6fbc0274dd97c14f7796a986f576996eac50906db6f11929f46383732f
SHA3 67be160e59beb7038474c2f3fe3b752a2a23b1a50e1f705092ff754f7b115ad8

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x2b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25464
MD5 a6ad46e57e84c10f14f2946754201681
SHA1 524b8332e83b9359fcef3acf36a9066339063f1e
SHA256 705927ed69741d4773ba41bb470c6cf9b61c127d6ca521c610be829306e9c1ed
SHA3 505a3b6b4ea352d948216510003a55593faea1483dc74c2f9bf74b9845dee69d

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
SHA3 93cbaf236d2d3870c1052716416ddf1c34f21532e56dd70144e9a01efcd0ce34

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
FileDescription PensColor
FileVersion (#2) 1.0.0.0
InternalName PensColor.exe
LegalCopyright Copyright © 2010
OriginalFilename PensColor.exe
ProductName PensColor
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2010-Jan-06 01:50:34
Version 0.0
SizeofData 107
AddressOfRawData 0xa01c
PointerToRawData 0x761c
Referenced File d:\John\My Documents\Visual Studio 2008\Projects\PensColor\obj\Debug\PensColor.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.