| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2023-Aug-15 12:30:24 |
| Detected languages |
English - United States
|
| CompanyName | Don HO don.h@free.fr |
| FileDescription | WinGup for Notepad++ |
| FileVersion | 5.26 |
| InternalName | gup.exe |
| LegalCopyright | Copyright 2018 by Don HO |
| OriginalFilename | gup.exe |
| ProductName | WinGup for Notepad++ |
| ProductVersion | 5.26 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to SHA256 Uses known Mersenne Twister constants |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Notepad\+\+
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| Safe | VirusTotal score: 0/72 (Scanned on 2026-04-09 06:29:19) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 7 |
| TimeDateStamp | 2023-Aug-15 12:30:24 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x99600 |
| SizeOfInitializedData | 0x32400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000003F2E0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xd1000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xcf525 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| libcurl.dll |
curl_easy_setopt
curl_easy_cleanup curl_easy_init curl_easy_perform |
|---|---|
| COMCTL32.dll |
InitCommonControlsEx
|
| SHLWAPI.dll |
PathFileExistsA
PathFindExtensionW PathIsDirectoryW PathFileExistsW PathFindFileNameW PathRemoveFileSpecW |
| KERNEL32.dll |
HeapReAlloc
CreateFileW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW CreateDirectoryW lstrlenW GetCurrentThreadId Sleep OutputDebugStringW DeleteFileW CreateThread lstrcpyW lstrcmpW MulDiv MoveFileW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore InitializeCriticalSection SetEndOfFile CreateEventW GetLastError SetEvent CloseHandle ResetEvent CreateSemaphoreW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleOutputCP FlushFileBuffers GetFileSizeEx HeapAlloc HeapFree GetFileType WaitForSingleObject ReadConsoleW GetConsoleMode SetFilePointerEx InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar WideCharToMultiByte InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetExitCodeThread WriteConsoleW InitializeCriticalSectionEx EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetStringTypeW CompareStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind ReadFile ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile |
| USER32.dll |
CallNextHookEx
EndDialog SetWindowTextW SetDlgItemTextW CreateWindowExW MessageBoxA UnhookWindowsHookEx SetWindowsHookExW GetDlgItemInt SystemParametersInfoW SetDlgItemInt DialogBoxParamW LoadImageW ReleaseDC MessageBoxW SendMessageW SetWindowPos GetDC GetWindowRect FindWindowExW GetDlgItemTextW |
| GDI32.dll |
GetDeviceCaps
|
| SHELL32.dll |
SHGetFolderPathW
ShellExecuteW SHFileOperationW |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 5.2.6.0 |
| ProductVersion | 5.2.6.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Don HO don.h@free.fr |
| FileDescription | WinGup for Notepad++ |
| FileVersion (#2) | 5.26 |
| InternalName | gup.exe |
| LegalCopyright | Copyright 2018 by Don HO |
| OriginalFilename | gup.exe |
| ProductName | WinGup for Notepad++ |
| ProductVersion (#2) | 5.26 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Aug-15 12:30:24 |
| Version | 0.0 |
| SizeofData | 1008 |
| AddressOfRawData | 0xb7114 |
| PointerToRawData | 0xb5b14 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2023-Aug-15 12:30:24 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
| StartAddressOfRawData | 0x1400b7528 |
|---|---|
| EndAddressOfRawData | 0x1400b7530 |
| AddressOfIndex | 0x1400c48a0 |
| AddressOfCallbacks | 0x14009b630 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1400c1010 |
| XOR Key | 0x6f5b14ab |
|---|---|
| Unmarked objects | 0 |
| ASM objects (30795) | 10 |
| C++ objects (30795) | 190 |
| C objects (30795) | 18 |
| 253 (VS2022 Update 4 (17.4.2) compiler 31935) | 1 |
| C++ objects (VS2022 Update 4 (17.4.2) compiler 31935) | 89 |
| C objects (VS2022 Update 4 (17.4.2) compiler 31935) | 16 |
| ASM objects (VS2022 Update 4 (17.4.2) compiler 31935) | 10 |
| Imports (30795) | 12 |
| Imports (VS2019 Update 10 (16.10.0-1) compiler 30037) | 3 |
| Total imports | 188 |
| C++ objects (LTCG) (VS2022 Update 5 (17.5.4) compiler 32217) | 35 |
| Resource objects (VS2022 Update 5 (17.5.4) compiler 32217) | 1 |
| 151 | 1 |
| Linker (VS2022 Update 5 (17.5.4) compiler 32217) | 1 |
No comments yet.