42df3cca6e1b38b5fa0cfe08523b57afaba1be51ae0313e36ca93496bff30561

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Apr-21 14:34:15
Detected languages English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • h5Zpz.fr
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Can access the registry:
  • RegCloseKey
  • RegCreateKeyExW
  • RegDeleteKeyW
  • RegDeleteValueW
  • RegEnumKeyW
  • RegEnumValueW
  • RegOpenKeyExW
  • RegQueryValueExW
  • RegSetValueExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 23698955 bytes of data starting at offset 0x19e00.
The overlay data has an entropy of 7.99736 and is possibly compressed or encrypted.
Overlay data amounts for 99.5548% of the executable.
Suspicious VirusTotal score: 1/68 (Scanned on 2026-08-17 02:47:14) Trapmine: malicious.high.ml.score

Hashes

MD5 e8b0bc836830f6ca22a5ce9ef52745e0 🔍
SHA1 61fd53f97901b3ae61817f62f88bfd98a31dcbc2 🔍
SHA256 42df3cca6e1b38b5fa0cfe08523b57afaba1be51ae0313e36ca93496bff30561 🔍
SHA3 6cc7ba75583ae7d43fa58e8b81d6878a3d0bd661f96f0076de5851fd1ef4c42c 🔍
SSDeep 393216:YjKxeMnvqZdQoiy6afQlseNxI3Tc63AI/YUaQ5LKvyilMaiO6Ujd5LwimzOy0oD0:K2nvqZdQfy6LyF/YUaQwRlMJYd2imKH 🔍
Imports Hash a46ac714274c7f150eaa703de6d7fb57 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2026-Apr-21 14:34:15
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0xa000
SizeOfInitializedData 0xc800
SizeOfUninitializedData 0x48400
AddressOfEntryPoint 0x00004B86 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xb000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x104000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 71061f35f7041b125379b026780c43a1 🔍
SHA1 f8009c53389cc88a8ebd0eb82860bdd67f541c58 🔍
SHA256 540b26c47287814814dace6c5b73e2e8a2caa94da920bceb0e7e731312ca2184 🔍
SHA3 7a10972b152cd0146fc82c12175836d690700f9baa96ff031ef8cd1ae06f43b6 🔍
VirtualSize 0x9fc8
VirtualAddress 0x1000
SizeOfRawData 0xa000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.07903

.data

MD5 64dd2b2e40e9c9ec48fbd1289c5c326d 🔍
SHA1 f4174af76b8752db278709a137c7d24dbca7d814 🔍
SHA256 5a5aaa7ba975d1bdb302785c3306a56b0c01a9a10d582109f6a203de0ccd4c84 🔍
SHA3 29d6060fe0c61816e5bccab70390fb555d11d88b2f1cf992b8ad637c7fea6c50 🔍
VirtualSize 0x108
VirtualAddress 0xb000
SizeOfRawData 0x200
PointerToRawData 0xa400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.56671

.rdata

MD5 4c9c6aadee64740fc856bde35dcc4777 🔍
SHA1 c8c495b2e4b04978dfb734f2de5dffd9874ed071 🔍
SHA256 c856fd39b5a72fa4a7287e2d76adc3dfb75670afe6dabf91a0c7e356db147e26 🔍
SHA3 bd081925adcdd43a01a655da99e065b0a240a10b80c3900f2f217d7593298efc 🔍
VirtualSize 0x9b80
VirtualAddress 0xc000
SizeOfRawData 0x9c00
PointerToRawData 0xa600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.83566

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x48360
VirtualAddress 0x16000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 bdccc342d357c9c9d4097058e3be6eb7 🔍
SHA1 cf04a37a9e231721bf2ba6a5faf6eead8d842a02 🔍
SHA256 6212cc2c5c6e6497a180d16f7f9b5d57bafbad9771705dd906cbf557c9d64334 🔍
SHA3 3a6f001afdb8f9a3dc2107451816d283c4abf22cf43a2a2846eaa070ac7a9a60 🔍
VirtualSize 0x1428
VirtualAddress 0x5f000
SizeOfRawData 0x1600
PointerToRawData 0x14200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.18338

.ndata

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x9e000
VirtualAddress 0x61000
SizeOfRawData 0x200
PointerToRawData 0x15800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 1cfa5dc32c8de89f0d44bae37148d6b8 🔍
SHA1 048d822b21b72c2ea036cda73beac522728e5348 🔍
SHA256 035c536baa7c438e8d3e9964157da02d7fdf4ca7f125c01db09285a25e4d7883 🔍
SHA3 0717af756cb2ea05f0609e934fc442aba5fa789f1f0646be0249803d09ae433e 🔍
VirtualSize 0x43a0
VirtualAddress 0xff000
SizeOfRawData 0x4400
PointerToRawData 0x15a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.96699

Imports

ADVAPI32.dll AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
COMCTL32.DLL ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls
GDI32.dll CreateBrushIndirect
CreateFontIndirectW
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor
KERNEL32.dll CloseHandle
CompareFileTime
CopyFileW
CreateDirectoryW
CreateFileW
CreateProcessW
CreateThread
DeleteFileW
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetDiskFreeSpaceW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetShortPathNameW
GetSystemDirectoryW
GetTempFileNameW
GetTempPathW
GetTickCount
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryExW
MoveFileExW
MoveFileW
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryW
SearchPathW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetErrorMode
SetFileAttributesW
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
lstrcatW
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyA
lstrcpynW
lstrlenA
lstrlenW
ole32.dll CoCreateInstance
CoTaskMemFree
IIDFromString
OleInitialize
OleUninitialize
SHELL32.dll SHBrowseForFolderW
SHFileOperationW
SHGetFileInfoW
SHGetPathFromIDListW
ShellExecuteExW
USER32.dll AppendMenuW
BeginPaint
CallWindowProcW
CharNextA
CharNextW
CharPrevW
CheckDlgButton
CloseClipboard
CreateDialogParamW
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExW
GetAsyncKeyState
GetClassInfoW
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextW
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongW
GetWindowRect
InvalidateRect
IsDlgButtonChecked
IsWindow
IsWindowEnabled
IsWindowVisible
LoadCursorW
LoadImageW
MessageBoxIndirectW
OpenClipboard
PeekMessageW
PostQuitMessage
RegisterClassW
ReleaseDC
ScreenToClient
SendMessageTimeoutW
SendMessageW
SetClassLongW
SetClipboardData
SetCursor
SetDlgItemTextW
SetForegroundWindow
SetTimer
SetWindowLongW
SetWindowPos
SetWindowTextW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
wsprintfA
wsprintfW
wvsprintfW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.26612
MD5 0ec0a0948a526b9c7eebe39bb02b6b0b 🔍
SHA1 867b304f20fd74abeb5c30515837f1c41cd3bf8f 🔍
SHA256 d442adb90ba296c7e617d2f58d6fa6f308bcd8ef65e5e9c66db4dd27f93fcfbe 🔍
SHA3 5bc458755a2ca5c7475620389d9b6b67952973c4366c6777d45c969b8bc67cd4 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.9993
MD5 6b224e01af48ec8e4c17a59d9534e885 🔍
SHA1 de787d2a1e840618ba2c7eb69d28f6966c404d1d 🔍
SHA256 50279c9885b490e74b49ac0273940b6e0891b62fc9ffb5c52e35422a694f248b 🔍
SHA3 71b543301bccda64ba61a27873c952890233e0cbec10e0b59245fc303bcfadbc 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.24459
MD5 ca82d899b1d402941b5c92ed9028cd95 🔍
SHA1 fb329ec4455d5caf1753305debcc14ab6ebb9015 🔍
SHA256 9da1013c864092e49c2676b3ba68a0d4513457d77d251730ed73cc5f4a4813b1 🔍
SHA3 768277223731ffdcb799e50961d0afccf23bbae54118d53b834617ccbd0c5cd9 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.01502
MD5 05e60fd47096a729dda2aaa4ab05ebc7 🔍
SHA1 de8ec9b484fa4f565b14f55503c9cd95231b633b 🔍
SHA256 61f762babde9942f43ee97154b8734efeed0632a6ea778dc395793ae3e3e7507 🔍
SHA3 f8ba0d4a91389414904cc66226099f27f482055e90ba449e2396193f139713d8 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.16057
MD5 d9ee3a2962251a241bce41b0524cfc0e 🔍
SHA1 2ba919aaa7237367a158e4b95385ab1ee07643d8 🔍
SHA256 69e6579a37fcaec037634e7fecbfc6a26093ea81dc4bd555d8a12187d2cd0866 🔍
SHA3 a1699668464f7edf9a748dfc264f9d30e3c69a228be0a18cade30c14aa6c77ba 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34146
MD5 53482d364aa2d4ae7ca05199dad7651a 🔍
SHA1 ccb213408acc7f5ddb94753e6410be23aab5cedd 🔍
SHA256 ff06189b43a5c1d6cc5d1b7cbf6ab56b1157ec52807945d652274a211462cba5 🔍
SHA3 60659e39ef3f267c267093f8bc4c87ed61eea4ef96ac0f583184f580844573e5 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04232
MD5 636ad42555a835e3a94209043df4a45a 🔍
SHA1 c878613bda5cba6cb5769846e60229890c5df248 🔍
SHA256 491e52ded039ec6684277e6f1f820e288763ae6d20e682bcfffb6cee4518ac23 🔍
SHA3 4b79e60727e0f7be7495c59fb949e22bd753cff6e145e4694257a21a7b5dba8c 🔍

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x144
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.62375
MD5 1d958df872e65e9a04f929c89155e3f3 🔍
SHA1 5fff638c5caa7a6f598bfbafd8d8e7fe4f5764cd 🔍
SHA256 e6065cad9c0f4a4c7ec1de33c05b192b04cb96ad6cfb0e2ae0188fcaea6ea7c3 🔍
SHA3 b29b01b665ef63d2e0f362ce3bf145b41d860ddb989398de87df16d48ac8483b 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x23e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72007
MD5 4e06b9c226906d7d31f90453697d36c0 🔍
SHA1 5d9a8b5dd5fe583227a0ab81fba83d98c4eb5452 🔍
SHA256 4b8679b0520596391355fd3b18c8b5979337aaa321c322f951fde6c053a6d845 🔍
SHA3 c3546d405a8722220c4e5652e54350941e3f2cadc30fdfc258fe377d9fef6354 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x104
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.84976
MD5 b756cf50afdc5a248bf9f3ff865177a6 🔍
SHA1 267b0f95a9f852b7af09e5d909a3febc24ca3ccb 🔍
SHA256 c47426270cabd4199bbff8e4fc363265990a8a935c023a8c7d6597a0378e5f5f 🔍
SHA3 1fb62d573cc8b6fdf137fd2c44249ba4f1c6d687bd878a786a395448d6069438 🔍

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa 🔍
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843 🔍
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023 🔍
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.85529
MD5 f90fecb69f0cde5d64f508884dcb0404 🔍
SHA1 4baf5e55965823176fa6910a5ec9fdca077995f9 🔍
SHA256 45ac0526fc85b64bcbb69ca682b0ca4d866a5e42709deaed11ce79395fec63d7 🔍
SHA3 8e5819e3997885152c58d0ec124c1b14288188081f3719777d414d72f5b13e5a 🔍

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.6691
Detected Filetype Icon file
MD5 e624f041c921d299a6da3a8c5f48f989 🔍
SHA1 ffa07c86ac3dac45398ee07b26610dfb5c99d8ea 🔍
SHA256 fed46e06346fb8f64b14c18408a82caf955929ac0e65151630539dc5bd194584 🔍
SHA3 b51d47dbe9cbe18b1f520275504256022a827f919672b081943ae45cd4ff44c9 🔍

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x42c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.3082
MD5 7d3d93999e9371f0814aa5cbe4e50d64 🔍
SHA1 0d0ffd75bcd581a245f737dace662a2d3823f50f 🔍
SHA256 29fb2af0d219880c6c35178607a4d910361e62f2cba0fc4fd633c4405bbd3441 🔍
SHA3 009df1e0a284f8eb1f6c38af13b6c5b452fc59bc1d2a54e6ab65f7e8af8355fe 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
Leave a comment

No comments yet.