47d964171efcf6898474a3e2c5158ed282953a594202aea1c46c7e67b825bb84

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-Aug-01 00:33:52
Detected languages English - United States
CompanyName CheshireCat
FileDescription Bandicam Portable
FileVersion 4.0.0.0
LegalCopyright © CheshireCat
ProductName Bandicam Portable
ProductVersion 4.0.0.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Can access the registry:
  • RegCreateKeyExW
  • RegOpenKeyExW
  • RegEnumValueW
  • RegDeleteKeyW
  • RegDeleteValueW
  • RegCloseKey
  • RegSetValueExW
  • RegQueryValueExW
  • RegEnumKeyW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Changes object ACLs:
  • SetFileSecurityW
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Malicious The file contains overlay data. 180865 bytes of data starting at offset 0x1d200.
The file contains a 7-Zip compressed file after the PE data.
Suspicious VirusTotal score: 1/64 (Scanned on 2026-08-18 07:07:50) APEX: Malicious

Hashes

MD5 a5787e48dfd9253c070d8b064df06719 🔍
SHA1 292c5a0071fb6dfa41460370193c330efa95a5da 🔍
SHA256 47d964171efcf6898474a3e2c5158ed282953a594202aea1c46c7e67b825bb84 🔍
SHA3 81378621638adebaa81b7aae396069b44c62ec375d31f9d89aebdf2c62e4b083 🔍
SSDeep 3072:cs77w1OlWUt1u98hBbXWoGoZpct53dN3CzGiZef9bjR8LbV4xKem1l6mg99Ctg2N:dmOPi8hxWo+3duGiEf9Xu3V44099eW36 🔍
Imports Hash b34f154ec913d2d2c435cbd644e91687 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2017-Aug-01 00:33:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6400
SizeOfInitializedData 0x22a00
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x0000333D (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x5a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b2dd5d917f94d75528a11411abe5681c 🔍
SHA1 dca5cbb0cc1595681bdd02f759c2717a25e2e71c 🔍
SHA256 5d5d7b8f798de66f756656a03ffb44a5bec3fd7cbad255ab9d1b1cec8ab3cce6 🔍
SHA3 f0c2bff38583d737605d0ec70c17a29756201ee99acf7cdfbcf388684ba32400 🔍
VirtualSize 0x626d
VirtualAddress 0x1000
SizeOfRawData 0x6400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.42313

.rdata

MD5 2914bac53cd4485c9822093463e4eea6 🔍
SHA1 613e9f1f18c58313b0e05bb3681015060648e0f2 🔍
SHA256 6492a4a1379c33d7e8cba30c286b60df2b43e95e426c02ad5549e93c815cb4f3 🔍
SHA3 b5f69e6a137adb1b259f22aeb61a84d23d891dde99c1b57d64cbc8c0b264da01 🔍
VirtualSize 0x138e
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.14645

.data

MD5 c46c24ddc9bf88a6774bd207204164b9 🔍
SHA1 e0f49b481b8c596bd7c1903db7aa6cb58f7e9315 🔍
SHA256 fc51a5d377820a4afd1cdc2f6a9628f14b6beb1e3c63466a07a031dd55081789 🔍
SHA3 3d8029516fab6a3b8a760596ed9d9955562116dc457a630e71fff14a3c77e4e7 🔍
VirtualSize 0x20318
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x7c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.90653

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1a000
VirtualAddress 0x2b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 0d8f8f01ddbcf5bc37bddcc4f44d3785 🔍
SHA1 96720513ee01af7254b6b2df556fa8dabb050925 🔍
SHA256 85a2d435a5e02f234fdaf2f2603849614912f4a6e07294c4e7beb6b079e6d669 🔍
SHA3 36700196ced97eac9d7aedd7dc02d6dc509513eb096dcc0f09dd303652d3b2c2 🔍
VirtualSize 0x14ec0
VirtualAddress 0x45000
SizeOfRawData 0x15000
PointerToRawData 0x8200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.13557

Imports

KERNEL32.dll SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
USER32.dll GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
GDI32.dll SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
SHELL32.dll SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ADVAPI32.dll AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
COMCTL32.dll ImageList_Create
ImageList_AddMasked
ImageList_Destroy
#17
ole32.dll OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.74621
MD5 717eb4e50c0fb8dc472e0758f13a98d9 🔍
SHA1 e1dd9df952e0f0cb36fe52bc079d540e8c8a5e82 🔍
SHA256 087a1ab87c96908a79f6d83cb55d99abc67344e845ec86e2d3e83ed5ce7acc42 🔍
SHA3 e896bac6e552ab051cbfc8bc38b2f695160da44ef84355ba710f7e4188652722 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31004
MD5 ab5c74320bb9f6705c431a7b3050e4c7 🔍
SHA1 f5faba4ebfecb02070be44f7538250db83c16fd2 🔍
SHA256 67823d294929306a7fa6c3334462ba9d9c1abcf03ae7d735b87966657171ad5c 🔍
SHA3 3bb6c118a435e3c3a21c2542ca9234f3ad76b8d669bfc2b769d124adcdea17eb 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.31069
MD5 bdf80daa2c18d15f8a75ae25003ece6d 🔍
SHA1 ad69246739ccd9c3c2ec2c15b484849470f83d4a 🔍
SHA256 1ac47cfb50cbebd0021bf4cb37b6705517c229d44b009be69676fe373e7cd59f 🔍
SHA3 d840d64e9a9e606f94cee814502c9a56f1d499a5e5ba57bb3bd9ca9b98fd4cb2 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.02118
MD5 b8500002ef1a00c8f72fb881e4381247 🔍
SHA1 c923c4198417c318d0b33b2fb203dabc400a05ea 🔍
SHA256 c79cfdced6ec73f57c12b2363a6ab52ab1ad41d25f44bcd1a056fde7d49a2675 🔍
SHA3 5889f08dc7877c052c58644bead0d4e034fe3eedabfa7cf717c0d701e2df01d6 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x100
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66174
MD5 3409f314895161597f3c395cc5f65525 🔍
SHA1 1a99d016d65e567f24449d9362afb6ac44006d0b 🔍
SHA256 fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96 🔍
SHA3 b3b19241cc6454389e45833e50b742ae1927a5f161017350a99f2cbc66914f26 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x11c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.88094
MD5 2d12c45dc2c029044aaff357141cb900 🔍
SHA1 083db861ab3c7db23c6257878296e73a89a74b8b 🔍
SHA256 69897c784f1491eb3024b0d52c2897196a2e245974497fda1915db5fefcf8729 🔍
SHA3 349b5d605c9c3efe5e0c4e2faa12dd21022fc5f9b053f2cbf4e2a6b8bc656442 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x60
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.48825
MD5 6be4e1387d369cf86e68eacbdd0e81dd 🔍
SHA1 351970fe2681b9b35b5d59ad052011ed96a96e17 🔍
SHA256 85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0 🔍
SHA3 45e552e173141e06d113209b6cc915042ad0b4d5531464b8dbe5637029f489cb 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.65982
Detected Filetype Icon file
MD5 6fa39a5f6db3ad3489ae7c80de34d0af 🔍
SHA1 461e0c84813d6c2f9e33b08cb928a69d5f3e97cf 🔍
SHA256 d58d7d4bbc58f023d4bb203dd967e15f6681460612b02ad935e7ff3979dc6102 🔍
SHA3 5b2e3150d50439424a0da2167805f6606a0d1cabed9ce800c5e259a72a21d091 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x248
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2273
MD5 388b5da06cc7da36bd6db3f19cdeea98 🔍
SHA1 8e1e73c776b80c4ea022e90b681cc964b15c3d7a 🔍
SHA256 b1edb5773b7c29733ee0618c7ebe82b1367f22380aedd79a9aac4772b7ae7b6d 🔍
SHA3 ff2e641811c5dc22f538b44dd13ac24d3114903a38251c02fc6ad58b1a8e68b5 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x46a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.30695
MD5 cdd6818ad66d90546ed29bf0da5673ca 🔍
SHA1 83a01df9b6bfdeb7b4dc9f534617167f583c3414 🔍
SHA256 4d8369e3f7aa26cb32d5fe848e4ebf0a0c3fa790a05f051197c7522f751e8489 🔍
SHA3 d23b99fd183fa35d95c1eb1194891e9a054bf537e2936a8ca23a1a1c6bde4d4a 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 4.0.0.0
ProductVersion 4.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName CheshireCat
FileDescription Bandicam Portable
FileVersion (#2) 4.0.0.0
LegalCopyright © CheshireCat
ProductName Bandicam Portable
ProductVersion (#2) 4.0.0.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd26650e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 165
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.