4391152957e03d55da025f5ddafaaf24
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Nov-14 16:38:43 |
| Detected languages |
English - United States
|
| CompanyName | SUPERAntiSpyware |
| FileDescription | SUPERAntiSpyware Application |
| FileVersion | 10, 0, 0, 1270 |
| InternalName | SUPERAntiSpyware Application |
| LegalCopyright | Copyright (C) 2005-2024 RealDefense LLC |
| LegalTrademarks | SUPERAntiSpyware (tm) |
| OriginalFilename | SUPERAntiSpyware.exe |
| ProductName | SUPERAntiSpyware |
| ProductVersion | 10, 0, 0, 1270 |
Plugin Output
| Suspicious | PEiD Signature: | UPolyX V0.1 -> Delikon |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Suspicious | The PE is packed with mpress |
Unusual section name found: .MPRESS1
Section .MPRESS1 is both writable and executable. Unusual section name found: .MPRESS2 Section .MPRESS2 is both writable and executable. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Has Internet access capabilities:
|
| Suspicious | The PE is possibly a dropper. | Resources amount for 85.8948% of the executable. |
| Safe | VirusTotal score: 0/73 (Scanned on 2024-11-19 17:28:25) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x40 |
| e_cp | 0x1 |
| e_crlc | 0 |
| e_cparhdr | 0x2 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0xb400 |
| e_oeminfo | 0xcd09 |
| e_lfanew | 0x40 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 3 |
| TimeDateStamp | 2024-Nov-14 16:38:43 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x2fb600 |
| SizeOfInitializedData | 0x86e400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000B6E627 (Section: .MPRESS2) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x12cc000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0x896109 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x2000000 |
| SizeofStackCommit | 0x31000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.MPRESS1
.MPRESS2
.rsrc
Imports
| KERNEL32 |
GetModuleHandleA
GetProcAddress |
|---|---|
| USER32.dll |
GetDC
|
| GDI32.dll |
BitBlt
|
| COMDLG32.dll |
GetOpenFileNameW
|
| SHELL32.dll |
#680
|
| ole32.dll |
CoCreateGuid
|
| OLEAUT32.dll |
SafeArrayDestroy
|
| SHLWAPI.dll |
#12
|
| gdiplus.dll |
GdipFree
|
| WINMM.dll |
PlaySoundW
|
| PSAPI.DLL |
GetProcessMemoryInfo
|
| CRYPT32.dll |
CertGetNameStringW
|
| WINTRUST.dll |
WinVerifyTrust
|
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| RPCRT4.dll |
UuidCreate
|
| WSOCK32.dll |
ioctlsocket
|
| WINHTTP.dll |
WinHttpOpen
|
| WININET.dll |
InternetOpenA
|
| COMCTL32.dll |
#17
|
| MSIMG32.dll |
AlphaBlend
|
| NETAPI32.dll |
NetUseEnum
|
| VERSION.dll |
VerQueryValueA
|
| WS2_32.dll |
WSCInstallProvider
|
| UxTheme.dll |
SetWindowTheme
|
| Secur32.dll |
GetUserNameExW
|
Delayed Imports
56
66
2082
2083
2324
2336
2337
2349
2350
2402
1
5
7
8
9
10
13
14
15
16
21
2307
2333
2338
2339
2
3
4
5 (#2)
6
7 (#2)
8 (#2)
9 (#2)
10 (#2)
11
12
13 (#2)
14 (#2)
15 (#2)
16 (#2)
17
18
19
20
21 (#2)
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56 (#2)
57
58
59
60
61
62
63
64
65
66 (#2)
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
CONTEXTMENUTREEVIEW
SYSTRAYMENU
SYSTRAYMENUFREE
536
DLGCONFIRMATION
DLGEVENTLOG
DLGHOMEPAGECHANGED
DLGSENDEMAIL
DLGSENDERRORREPORT
DLGSENDINGREPORT
25 (#2)
26 (#2)
28 (#2)
29 (#2)
30 (#2)
33 (#2)
34 (#2)
36 (#2)
37 (#2)
39 (#2)
40 (#2)
45 (#2)
50 (#2)
51 (#2)
52 (#2)
53 (#2)
55 (#2)
56 (#3)
57 (#2)
58 (#2)
59 (#2)
60 (#2)
61 (#2)
62 (#2)
64 (#2)
65 (#2)
66 (#3)
79 (#2)
80 (#2)
81 (#2)
82 (#2)
83 (#2)
84 (#2)
85 (#2)
2059
2060
2063
2078
2079
2080
2081
2082 (#2)
2083 (#2)
2084
2086
2087
2088
2089
2091
2092
2094
2095
2096
2097
2098
2099
2101
2137
2162
2163
2168
2169
2171
2172
2173
2180
2181
2321
2322
2323
2324 (#2)
2325
2326
2327
2334
2335
2336 (#2)
2337 (#2)
2349 (#2)
2350 (#2)
2402 (#2)
9 (#3)
10 (#3)
11 (#2)
12 (#2)
13 (#3)
14 (#3)
15 (#3)
16 (#3)
17 (#2)
18 (#2)
129 (#2)
1118
ICONAPPLICATION
89 (#2)
111 (#2)
340
341
343
344
345
346
347
348
349
350
351
352
2064
2065
2066
2067
2068
2070
2072
2073
2074
2075
2076
2103
2104
2105
2106
2107
2112
2114
2115
2119
2120
2121
2122
2123
2124
2125
2126
2128
2130
2132
2135
2136
2138
2139
2142
2143
2151
2152
2157
2158
2164
2165
2166
2170
2174
2175
2176
2178
2179
2182
2183
2184
2185
2186
2187
2189
2190
2191
2192
2193
2194
2195
2196
2197
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2331
2332
2335 (#2)
2336 (#3)
2340
2341
2342
2351
2352
2353
2354
2400
2401
1 (#2)
1 (#3)
String Table contents
| Confirm Uninstall |
| Are you sure you wish to uninstall this product? |
| Are you sure you wish to transfer your license? |
| License Transfer |
| Unable to connect to the activation server. Please make sure |
| that %s is allowed to connect through your firewall and try again. |
| License Transfer |
| There was a problem transferring the product license. Please |
| contact our customer service department for assistance. |
| The license was transferred successfully. |
| The registration number you have entered is not valid. Please enter |
| a valid registration number. |
| Product Registration |
| Unable to connect to the activation server. Please make sure |
| that %s is allowed to connect through your firewall and try again. |
| Product Activation |
| The registration code you supplied does not appear to be valid. Please |
| enter a valid registration code. |
| The registration code you supplied has been de-activated and is no longer valid. Please purchase |
| a valid license to receive a new registration code. |
| The number of valid licenses for the registration code you entered has been |
| exceeded. Please contact our support staff. |
| The activation code entered does not appear to be valid. |
| You have not entered or selected any e-mail addresses. Please enter |
| the e-mail addresses of your friends before continuing. |
| You must enter a valid name and e-mail address. This is required so that |
| the recipients of the e-mail know that it is not spam or unsolicited e-mail. |
| You must stop the scan and close the SUPERAntiSpyware main screen before updating. |
| Do you wish to remove all program settings, logs and quarantined items? |
| SUPERAntiSpyware Uninstall |
| Would you like SUPERAntiSpyware to check for the latest rules and definition updates now? (recommended) |
| You will receive a confirmation email with your registration number. Right-click on the Super Ad Blocker icon and select Register/Activate to complete the registration and activate process. |
| Are you sure you wish to allow/trust this item? |
| Are you sure you wish to clear the list? |
| Select E-Mail Addresses |
| Select the e-mail addresses to send your message. |
| Searching for E-Mail Addresses |
| Please wait while the system searches for valid e-mail addressses |
| Enter Name and E-Mail Address |
| Please enter your name and e-mail address and personalize the message |
| Preview and Send E-Mail |
| Preview your e-mail and complete the tell a friend process. |
| Enter Registration Number |
| Enter the product registration number without any spaces or dashes. |
| Product Activation |
| Activate your product over the Internet or enter the number manually. |
| Accessing Program Options |
| You may access the program options by double-clicking the icon by the system clock. |
| E-Mail Notification |
| You may optionally receive e-mail notification about product updates and features. |
| Select Setup Options |
| Select whether you are trying a free trial or have purchased. |
| Select Report Type |
| Select the type of ad you wish to report |
| Enter Optional Information |
| You may optionally enter your e-mail address and description of the problem. |
| Automatic Update Checking |
| Automatically check for program and definition updates |
| Enter additional e-mail addresses |
| Enter any additional e-mail addresses for your friends |
| Sponsored Search Ad Blocking |
| You may optionally block sponsored search ads on web-sites and search engines. |
| SUPERAntiSpyware |
| You must reboot your computer to complete the Super Ad Blocker update before |
| Super Ad Blocker can run. Do you wish to reboot now? |
| Super Ad Blocker is now exiting. |
| Super Ad Blocker system components are corrupt or invalid. Please re-download and |
| install the Super Ad Blocker product. Would you like to download now? |
| There are no updates available. Your product is up to date. |
| There is an update available. Would you like to download and install the update? |
| Sponsored Ad Blocker |
| You must reboot your computer to complete the Super Ad Blocker update before |
| Sponsored Ad Blocker can run. Do you wish to reboot now? |
| Sponsored Ad Blocker system components are corrupt or invalid. Please re-download |
| and install the Sponsored Ad Blocker product. Would you like to download now? |
| Sponsored Ad Blocker is now exiting. |
| SUPERAntiSpyware Professional X |
| You must include a valid e-mail address so we can assist you. |
| You must include a description of the problem so we can assist you. |
| Please provide a valid e-mail address so we may contact you for |
| additional information, or resolution regarding the report. |
| Help stop the spread of Spyware and Viruses |
| Submitting a system diagnostic report helps our research lab identify harmful software immediately. |
| SUPERAntiSpyware Scanner |
| Please select the drive(s) to scan and your scanning options. Click Next to begin scanning. |
| SUPERAntiSpyware is currently scanning your system |
| Please be patient while your system is scanned for potentially harmful software applications |
| SUPERAntiSpyware Main Menu |
| Scan your computer for harmful software, configure advanced scanning options, manage quarantined items, and schedule scanning at a specified time. |
| SUPERAntiSpyware has detected the following items on your computer |
| You may elect to quarantine and remove an application or leave it on your computer. Quarantined and removed applications can always be restored to your computer at any time. |
| SUPERAntiSpyware is now quarantining and removing the potentially harmful software detected on your system. |
| Please wait while the potentially harmful software is quarantined and removed from your system. |
| Please provide a valid e-mail address so we may contact you for |
| additional information, or resolution regarding the report. |
| Please provide some information regarding why you believe this item |
| is a FALSE POSITIVE and SHOULD NOT be detected. |
| Are you sure you wish to reset all settings to their default values? |
| All program options have been reset to their default values. |
| This will take effect the next time you restart SUPERAntiSpyware |
| Repairs can have a serious effect on your system. |
| They should only be performed if you are experiencing the specific issue for that repair. |
| Are you sure you wish to perform the selected repair? |
| You must restart your system to complete the changes. Do you wish to restart now? |
| Do you wish to remove (delete) the restored items from the Quarantine? |
| Are you sure you wish to remove this item from the quarantine? |
| Database definitions are up to date. |
| There was an error trying to retrieve definitions. Make sure your firewall |
| is not blocking SUPERANTISPYWARE.EXE from accessing the Internet. |
| You must select a location to scan. |
| SUPERAntiSpyware will now close all Internet browsers before scanning. Do you wish to close the browsers and continue? |
| Scanning is complete. No harmful software was detected! |
| Scanning is not complete, are you sure you wish to abort the scan? |
| Scanning is not complete, do you wish to continue without completing the scan? |
| Are you sure you wish to cancel? Detected items have not been removed. |
| There were no harmful items detected on your computer. |
| There are no items selected to quarantine and remove. Click OK to return to the main menu. |
| Are you sure you wish to trust/allow this item? |
| You must reboot to complete the removal of the harmful software detected. Reboot now? |
| Your system is still infected, you must reboot to complete the removal process. |
| Quarantine and Removal Complete. Click the Finish button to return to the main menu. |
| The quarantining and removal process is not complete. This process cannot be canceled. |
| The quarantining and removal process is not complete. This process cannot be canceled. |
| Are you sure you wish to remove all items from the list? |
| The folder is already in the list. |
| Are you sure you wish to delete the selected log file(s)? |
| The update must be done from an account with Administrator privileges. |
| Are you sure you wish to remove all items from the list? |
| SUPERAntiSpyware - Migrating Quarantine and Logs |
| SUPERAntiSpyware Scan Log |
| Generated %02d/%02d/%04d at %02d:%02d %s |
| Application Version : %s |
| Core Rules Database Version : %d |
| Trace Rules Database Version: %d |
| Total Scan Time : %s |
| Scan type : Quick Scan |
| Scan type : Complete Scan |
| Scan type : Custom Scan |
| Memory items scanned : %d |
| Memory items detected : %d |
| Registry items scanned : %d |
| Registry items detected : %d |
| File items scanned : %d |
| File items detected : %d |
| Scan type : Critical Point Scan |
| Operating System Information |
| Message Base |
| Are you sure you wish to exit? |
| !Unable to validate application files. |
| This may be due to a virus or Internet hijack. |
| Program performance could be impacted. |
| !SUPERAntiSpyware application files are invalid. |
| Please re-install as soon as possible. |
| Would you like to see a description of the updates that have been installed? |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 10.0.0.1270 |
| ProductVersion | 10.0.0.1270 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | SUPERAntiSpyware |
| FileDescription | SUPERAntiSpyware Application |
| FileVersion (#2) | 10, 0, 0, 1270 |
| InternalName | SUPERAntiSpyware Application |
| LegalCopyright | Copyright (C) 2005-2024 RealDefense LLC |
| LegalTrademarks | SUPERAntiSpyware (tm) |
| OriginalFilename | SUPERAntiSpyware.exe |
| ProductName | SUPERAntiSpyware |
| ProductVersion (#2) | 10, 0, 0, 1270 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: Could not read the name of the DLL to be delay-loaded!
[!] Error: Could not reach the TLS callback table.
[*] Warning: Could not read a WIN_CERTIFICATE's header.