4690e097b9ff043b7895b2847e1ece53

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Dec-05 22:50:52
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ 6.0 DLL
Microsoft Visual C++
Microsoft Visual C++ v6.0
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • LoadLibraryExA
  • GetProcAddress
Can access the registry:
  • RegQueryValueExA
  • RegSetValueExA
  • RegEnumKeyA
  • RegEnumValueA
  • RegOpenKeyExA
  • RegDeleteKeyA
  • RegDeleteValueA
  • RegCloseKey
  • RegCreateKeyExA
Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
Can create temporary files:
  • CreateFileA
  • GetTempPathA
Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: CEWE Stiftung & Co KGaA
Issuer: Symantec Class 3 SHA256 Code Signing CA
Safe VirusTotal score: 0/67 (Scanned on 2019-03-18 22:04:02) All the AVs think this file is safe.

Hashes

MD5 4690e097b9ff043b7895b2847e1ece53
SHA1 4236f3ac289f79e26625619b2faa764864573788
SHA256 a5cce6b22f70ff134f3d052b3e23a5d022b27a5ab719982609224f2d96a2ea1d
SHA3 8a568e5b39d6c056b78215fffd85cbe0696bdda40e42bcb9a6b3961dc968d561
SSDeep 24576:IlTFgtLkflWpjMzfNaQ3pjc3xY0gWSjBlARFgzq:IlTFgtLkfAALUnaleFgzq
Imports Hash f2eb8d789695eff25c68c44db80d0898

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2009-Dec-05 22:50:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x5e00
SizeOfInitializedData 0x28400
SizeOfUninitializedData 0x400
AddressOfEntryPoint 0x000030FA (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x7000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xa7000
SizeOfHeaders 0x400
Checksum 0x197325
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 856b32eb77dfd6fb67f21d6543272da5
SHA1 6597c511c2ee72f68f5246460f0683dae16dcade
SHA256 c6c2b4f41d6598b94106de36b422dd84534fd9a11d84b2b6a47b3be49524c750
SHA3 649e621f7eb7edb175d8285b7c35de1209efc88af5abb31f95bab19076fff3b4
VirtualSize 0x5c4c
VirtualAddress 0x1000
SizeOfRawData 0x5e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.44011

.rdata

MD5 dc77f8a1e6985a4361c55642680ddb4f
SHA1 3d397ee25b2dd83ab741c67375880151cae94ed8
SHA256 576cdd5bc72421d008c86f056d0727c54cc8b3ec0961e5d0462af48278543d51
SHA3 d419a2c597e2f7a8a19b7c5c2090a93c78625e69629ff7d66a5359bfd614a8f4
VirtualSize 0x129c
VirtualAddress 0x7000
SizeOfRawData 0x1400
PointerToRawData 0x6200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.04684

.data

MD5 7922d4ce117d7d5b3ac2cffe4b0b5e4f
SHA1 4e56bb1994226ae0285c7adee470777262de2c99
SHA256 97773fd68ac3aebb9795c59dc00c5dbc0c992ce0c3c2ef90bfff27eb1cd72b3d
SHA3 2a1aceed5a92a7ab4f568335758aa6da79df1e2fe50997652ea0f52f0813bead
VirtualSize 0x25c58
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.801

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x12000
VirtualAddress 0x2f000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 863d12627555af8bf8ac6689e20e47e6
SHA1 798ab7281d2c153a03274e429e15da083243f99a
SHA256 b4d4dc8153de52405863ed8339904ebf9c8ed332995c538bf4b0265ec5c193a1
SHA3 bebcca59a92451359b313cd9fba7f60929e5f61f0dd4d145592fee1f4c9e2f2b
VirtualSize 0x65568
VirtualAddress 0x41000
SizeOfRawData 0x65600
PointerToRawData 0x7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.74536

Imports

KERNEL32.dll CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
USER32.dll EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
GDI32.dll SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
SHELL32.dll SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
ADVAPI32.dll RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
COMCTL32.dll ImageList_AddMasked
ImageList_Destroy
#17
ImageList_Create
ole32.dll CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
VERSION.dll GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.61713
MD5 4c2dc73ae9bd0476da85a6001bd411dc
SHA1 b52425c11a7dd380ba50c5fb136481833cfb2cdb
SHA256 b51c8d1a2b56509ddd0d445dc1fa0d1b2cee0ae06c02db827183503248def979
SHA3 b61030cc1b165d47bb786a93036ec30dfb395b3c36bc94eaf69f9eac55fc1ae8

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x12428
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.76582
MD5 d3e59805ba286f2336d6206c32a13411
SHA1 2c7e2d92230e20debd472f916fc68ed0aefeb79a
SHA256 08fd4b5d81b527d43549d3be78f01600dfb65ce7b74b80598a72a11dd78e6fdd
SHA3 371ea9c21f462c42bbc8bad0dc3e10430abe4a38a9f61cefd1f1877649aa9577

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa068
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.75245
MD5 57a470e53aba666cd8805c03d9ea2583
SHA1 e8c9aa3ebcb8d1fd1ba16b5a5f49ef2681a41104
SHA256 779b6c439f62623014486c256178f99166649d403df5fb12abbafee5762f9ba8
SHA3 d9299e9f3480a3168603fc434679a2586dfbe4c13ccca4bd86b53ef677fc3fa0

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.06473
MD5 ab3cd5f814dd94f3de00f40a04e2c018
SHA1 3475296e39a191f386b4838be22eb727ebfb5ba7
SHA256 02819a9e82a2f57300ab3c9fe2072d1f310f3bd20d67939a76ba2a290fb8a9e3
SHA3 00c44659746a53d1d7910b67f09f2b6e1765c5ca1bcdcce732d494d24f0dc39c

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.11164
MD5 eb9d75d31d98c9ada6ea727d80074b30
SHA1 89f957c82b83946b8dbb45d8e31ee784831abbca
SHA256 33e79c934eb447ded16c36f3037b1ac064123baa0b506d0f93728eefefb855ad
SHA3 e287fc9bb236c4c6301ca1176cf958b04103aaec35acd2c2932fc1074f5f3149

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.50666
MD5 b9d6415ab5ac3bfe92de1648c1d77d18
SHA1 cf0d3f25295ef0723ced1578ef2bc908235b5963
SHA256 eda78cc1d023ac77462172fbc707ea4d023c83fc33bebe366898054ea5145aea
SHA3 64d420262976024ac7505904f3dddf72d4adf3281b53a2c4c91827806713bbcf

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.86809
MD5 fb9be0d58e58d94e30e1fe629a01458f
SHA1 519dd1ce2845b8a44cb2bf4490bf8c39ed2d45c5
SHA256 914f0a6d93412b5db8f5068870fa0838ea759cb5cea44a6823dc075813c395d3
SHA3 39294c89069d721424844c0bf88635ae40349921921a9483f282a90a9ab3cdac

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08091
MD5 33d3921a261ded3c891e641af8d89bdf
SHA1 b230daf9d9486eb3636ccdbefc6c194a8aaf988d
SHA256 69bf7153d5e35bbddf8af0d5134c484cde052082bcbfa753bd13f60f55664c92
SHA3 9b075467b29612e1c5777c9d18b58a23da2400a6e629f865137449d0eca57c6f

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.05667
MD5 b04781f41814fc7315af04c468bc5ca3
SHA1 0f1dc353af6c1b6619553a43de56b93a033123ad
SHA256 e92ac7e2e98a5f2671da40686db5f24059729a71087d8110fb306eecf8d7c5bb
SHA3 28bc4521e2bb7c6dda00bd374bb77fb72c64a04333f4492405cd3c0360ea177d

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.36179
MD5 87ea515db69b4af06bc4c33f9c3c5ca9
SHA1 ded4b3083db4499b31efcfe0b3351d9e9240f15e
SHA256 996783857857447e7165a34370fcc19b3088edbaee7943d767201f4d20ee9e5f
SHA3 1a26c816d95c300da2e257022018d3ba9a73b1aee0f439392c12d58457a0f2b2

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.41438
MD5 1965abf0eddb4aeaa75293f8357fc5ce
SHA1 cc1b32608099c9ade377a4184a944bd2ef550bb6
SHA256 846ef8362a841f6f98c87905a873e3356fc903f270248e8de91b6e298db5df57
SHA3 44b1d6e7c2616c2272c203648bffdd8a0c48aa36ecc80e8e54841290e25fb6d6

12

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.54724
MD5 d337c80fcdef374c8cb4062409183925
SHA1 2cd81b9a63392d7696eadeca0ee443d6be0e3718
SHA256 3ebaa7b68f4b3302d58a2f90553dcae61aea4fa2c91c1a5c64ec1c2e89b62c03
SHA3 3f72a6e3730f8068e1d85284f633b88c5e0133a4578f55dcd78eec579239b940

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.55905
MD5 cd4209a1d900c4fa2c88f84e3777b6ed
SHA1 072b224e4c5e1221a49def99cf95e95edf281d2e
SHA256 489be547c1ed301ab97545cc68ad7e822b7c2cdc30d5675071df2cd57418da12
SHA3 884c6d6c85cc5eeff6261bd09b78d1eb375592435eb47bd18bc71470cabbea04

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x114
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.45135
MD5 39bcdd503de9fa01d395d9d4308cb4c2
SHA1 0795db6de7c18995848efd1a3a0e2c875d11aa53
SHA256 a3377a3d56ba36b0f61dbea1e2cf226a8db66845ea4c510efb12773819b3f1f4
SHA3 fa33ce945dc32e34618dbbf6804346544973b9d2e1d289d604783cfafd211418

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1f4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.60287
MD5 0dc92dfc599a7624cc9f06f39be48cb6
SHA1 d40c9f2226919a7598a96594176d045fd5468269
SHA256 1f06395b642b7e97a3cf78206c14d8df17cb4853d4d00b32e22788affc25d485
SHA3 74f4173817a8eed207b1447317549b4d642dfe086a6894b87e45489fc16a6cf7

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.79317
MD5 18f7d4bb562c2b2c256ff2c83fef9a2b
SHA1 51883701c57ccd657eb88d718082e26d664aa43d
SHA256 e53ce420088cdc9897863daaa4c76ed00a84440156c32f99319ea2da1bdbb195
SHA3 1c048556115dcf8984561d70300363ef44f597be1a3048c9f3d2118c070305d2

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x94
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.3453
MD5 3e0be128981aac12620fc51072d3a5d4
SHA1 ad06bf2e8528844068e8d3ef6c769c34b899791c
SHA256 5850f4efe17f527dd190d2bf9b94d85b832a0bca8053aa3a85d59832799c329c
SHA3 bfb93e638588c641fdaeb9cc6c946ab738e81eeede8bb0d74530eb0d6578fa65

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xe2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.83684
MD5 53b54ccfb627c9a042d065da90754588
SHA1 907a4441d253b30d943031922b0a67f70564286c
SHA256 796c9cbd0c7f9a56c8f0902f16af5f0aeaad42870b85a0e91408e1ffd4ae0f58
SHA3 f64b5fec15abbf4124634c0d9163c8ddcfdd3f6e6b16bdea935f8de6ed76835f

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91442
Detected Filetype Icon file
MD5 db84927911e3041b8306c7b2c27f30da
SHA1 a9290ca9470d867703e39be51ecf2baf41b74c99
SHA256 d18d17ddf2c14c8391a6699a40bf8e7102b6802c3390fc1d9760ab98520e3813
SHA3 ba0c5132aa6d4ffd1a1d1aee5dd2c57c67d0b280f4c44102d25ca4f34ce52403

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x3be
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.21482
MD5 18a65b0356650472e36d75deef2173b5
SHA1 ad8ae2a67c7258efa638901ff609cc6561b96b4f
SHA256 cb24fe30879e7b0870fb61f7c16bdb8c4fa9a2a8c2d945bd3ea8dd889e93c0ff
SHA3 55079671a0ec8905dde3e77ac6ab2a0ab33bc1d621f43b49f67d3539c1fd0723

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x69ead975
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 155
Imports (VS2003 (.NET) build 4035) 17
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
<-- -->