4bf28f0b6a5b20681a1378a0d8afe694
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2007-May-25 14:27:07 |
| Detected languages |
English - United Kingdom
|
| FileVersion | 3, 2, 4, 9 |
| CompiledScript | AutoIt v3 Script : 3, 2, 4, 9 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 7.1
Microsoft Visual C++ 6.0 - 8.0 MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Is an AutoIT compiled script:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses known Mersenne Twister constants |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
3113 bytes of data starting at offset 0x68c00.
The overlay data has an entropy of 7.94183 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 5/68 (Scanned on 2024-10-01 19:58:54) |
Cylance:
Unsafe
Elastic: malicious (high confidence) FireEye: Generic.mg.4bf28f0b6a5b2068 Kingsoft: malware.kb.a.987 Trapmine: malicious.moderate.ml.score |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2007-May-25 14:27:07 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 7.0 |
| SizeOfCode | 0x57400 |
| SizeOfInitializedData | 0x2c800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0004BE98 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x59000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x86000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| KERNEL32.DLL |
QueryPerformanceCounter
QueryPerformanceFrequency UnmapViewOfFile OpenProcess CreateFileMappingW MapViewOfFile WriteProcessMemory ReadProcessMemory SetFilePointer TerminateProcess WaitForSingleObject SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW FindNextFileW lstrcmpiW MoveFileW CopyFileW GetLastError CreateDirectoryW RemoveDirectoryW SetSystemPowerState FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetLocalTime MultiByteToWideChar WideCharToMultiByte CompareStringW InterlockedIncrement InterlockedDecrement FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetModuleHandleW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW DeviceIoControl SetFileAttributesW GetShortPathNameW GetEnvironmentVariableW SetEnvironmentVariableW SetProcessWorkingSetSize GlobalMemoryStatus Beep GetComputerNameW GetWindowsDirectoryW GetSystemDirectoryW GetTempPathW GetCurrentProcessId CreatePipe DuplicateHandle GetStdHandle SetPriorityClass WriteFile GetFileType PeekNamedPipe SetLastError GetTempPathA GetTempFileNameA DeleteFileA CopyFileA CreateFileA GetModuleHandleA ExitProcess HeapFree HeapAlloc GetStartupInfoW GetVersionExA TlsAlloc TlsFree TlsSetValue TlsGetValue DeleteCriticalSection HeapReAlloc HeapSize VirtualProtect VirtualAlloc VirtualQuery HeapDestroy HeapCreate VirtualFree UnhandledExceptionFilter SetHandleCount GetStartupInfoA SetStdHandle GetSystemInfo GetCurrentProcess GetVersionExW GlobalFindAtomW LoadLibraryW LoadLibraryExW GlobalFree GlobalUnlock ReadFile GlobalLock GlobalAlloc GetFileSize CreateFileW CloseHandle CreateProcessW GetCurrentThreadId Sleep GetProcAddress LoadLibraryA FlushFileBuffers LCMapStringA LCMapStringW FreeLibrary GetModuleFileNameW GetFullPathNameW SetCurrentDirectoryW GetCurrentDirectoryW ExitThread CreateThread ResumeThread EnterCriticalSection LeaveCriticalSection RaiseException GetTimeZoneInformation GetModuleFileNameA FreeEnvironmentStringsA GetSystemTimeAsFileTime GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW GetCPInfo GetLocaleInfoA GetStringTypeA GetStringTypeW RtlUnwind GetACP GetOEMCP InitializeCriticalSection GetTickCount InterlockedExchange SetEndOfFile CompareStringA SetErrorMode SetEnvironmentVariableA |
|---|---|
| ADVAPI32.dll |
RegEnumValueW
RegDeleteValueW RegDeleteKeyW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW RegEnumKeyExW CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegQueryValueExW RegOpenKeyExW |
| COMCTL32.dll |
ImageList_Remove
ImageList_Destroy ImageList_EndDrag ImageList_DragLeave ImageList_DragMove ImageList_DragEnter ImageList_BeginDrag ImageList_SetDragCursorImage ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx |
| comdlg32.dll |
GetSaveFileNameW
GetOpenFileNameW |
| GDI32.dll |
PolyBezierTo
ExtCreatePen StrokeAndFillPath StrokePath EndPath SetPixel CloseFigure LineTo AngleArc MoveToEx GetTextExtentPoint32W CreateDIBSection BitBlt GetDIBits CreateCompatibleBitmap CreateDCW GetTextFaceW Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW DeleteDC CreateCompatibleDC CreateFontW GetDeviceCaps GetStockObject SetBkMode GetPixel RoundRect SetBkColor SelectObject CreatePen CreateSolidBrush DeleteObject SetTextColor |
| MPR.dll |
WNetUseConnectionW
WNetGetConnectionW WNetAddConnection2W WNetCancelConnection2W |
| ole32.dll |
CreateStreamOnHGlobal
OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoInitialize CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree IIDFromString StringFromIID CLSIDFromString OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket StringFromCLSID OleUninitialize |
| OLEAUT32.dll |
LoadRegTypeLib
SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayAllocData SafeArrayAllocDescriptorEx SysAllocString SafeArrayUnaccessData SafeArrayAccessData VarR4FromDec VariantTimeToSystemTime VariantClear VariantCopy VariantInit OleLoadPicture GetActiveObject |
| SHELL32.dll |
SHBrowseForFolderW
SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc Shell_NotifyIconW ExtractIconExW DragFinish DragQueryFileW DragQueryPoint ShellExecuteW ShellExecuteExW |
| USER32.dll |
UnregisterHotKey
PeekMessageW TranslateMessage DispatchMessageW GetMessageW CharLowerBuffW CharUpperW OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseClipboard CountClipboardFormats EmptyClipboard SetClipboardData GetCursor RegisterHotKey GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed FlashWindow GetWindowTextLengthW SetMenuDefaultItem SetMenu CreateMenu DeleteMenu DestroyMenu DrawMenuBar SetMenuItemInfoW GetDC SetWindowPos SetWindowLongW RedrawWindow wsprintfW CharNextW IsMenu GetActiveWindow LockWindowUpdate CreateIconFromResourceEx DestroyWindow SetClassLongW AdjustWindowRectEx SetRect SystemParametersInfoW GetSystemMetrics ReleaseDC GetWindowDC SetCursor MessageBeep VkKeyScanA FillRect SubtractRect FrameRect DrawTextW DrawFocusRect InflateRect GetSysColor CheckMenuRadioItem GetMenuItemID GetMenuItemCount GetMenuItemInfoW SetWindowTextW ReleaseCapture SetCapture ClientToScreen GetKeyState WindowFromPoint GetClientRect TrackPopupMenuEx GetCursorPos IsDialogMessageW EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow ScreenToClient InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput SendMessageTimeoutW GetFocus mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows CreateIcon SetForegroundWindow IsIconic FindWindowW SetKeyboardState GetKeyboardState LoadImageW keybd_event GetWindowTextW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW GetKeyboardLayoutNameA MessageBoxW LoadStringW DialogBoxParamW EndDialog SendDlgItemMessageW GetMenu CopyRect IsChild GetWindow GetNextDlgTabItem GetClassWord GetDlgItem PtInRect OffsetRect LoadCursorW GetSysColorBrush GetForegroundWindow DestroyIcon EndPaint BeginPaint InsertMenuItemW DrawFrameControl CopyImage GetAsyncKeyState |
| VERSION.dll |
GetFileVersionInfoSizeW
GetFileVersionInfoW VerQueryValueW |
| WINMM.dll |
waveOutSetVolume
timeGetTime mciSendStringW |
| WSOCK32.dll |
__WSAFDIsSet
recv send socket connect closesocket bind select accept htons sendto recvfrom ntohs WSAGetLastError ioctlsocket WSACleanup inet_addr gethostbyname WSAStartup gethostname listen |
Delayed Imports
1
4
5
166
1000
7
8
9
10
11
12
161
164
169
1 (#2)
1 (#3)
String Table contents
| (Paused) |
| AutoIt Error |
| AutoIt has detected the stack has become corrupt. |
| Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments. |
| AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention. |
| Unable to open the script file. |
| Badly formatted "Func" statement. |
| Unable to parse line. |
| Missing right bracket ')' in expression. |
| Missing operator in expression. |
| Unbalanced brackets in expression. |
| Error in expression. |
| Error parsing function call. |
| Incorrect number of parameters in function call. |
| "ReDim" used without an array variable. |
| Illegal text at the end of statement (one statement per line). |
| "If" statement has no matching "EndIf" statement. |
| "Else" statement with no matching "If" statement. |
| "EndIf" statement with no matching "If" statement. |
| Too many "Else" statements for matching "If" statement. |
| "While" statement has no matching "Wend" statement. |
| "Wend" statement with no matching "While" statement. |
| Variable used without being declared. |
| Array variable has incorrect number of subscripts or subscript dimension range exceeded. |
| Array variable subscript badly formatted. |
| Subscript used with non-Array variable. |
| Too many subscripts used for an array. |
| Missing subscript dimensions in "Dim" statement. |
| No variable given for "Dim", "Local", "Global", "Struct" or "Const" statement. |
| Expected a "=" operator in assignment statement. |
| Invalid keyword at the start of this line. |
| Array maximum size exceeded. |
| "Func" statement has no matching "EndFunc". |
| Duplicate function name. |
| Unknown function name. |
| Unknown macro. |
| Unable to execute the external program. |
| Unable to get a list of running processes. |
| Missing separator character after keyword. |
| Invalid element in a DllStruct. |
| Unknown option or bad parameter specified. |
| Unable to load the internet libraries. |
| "Struct" statement has no matching "EndStruct". |
| Unable to open file, the maximum number of open files has been exceeded. |
| Invalid file handle used. |
| Invalid file filter given. |
| Expected a variable in user function call. |
| "Do" statement has no matching "Until" statement. |
| "Until" statement with no matching "Do" statement. |
| "For" statement is badly formatted. |
| "Next" statement with no matching "For" statement. |
| "ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop. |
| "For" statement has no matching "Next" statement. |
| "Case" statement with no matching "Select"or "Switch" statement. |
| "EndSelect" statement with no matching "Select" statement. |
| Recursion level has been exceeded - AutoIt will quit to prevent stack overflow. |
| Unable to access RunAs API. |
| String missing closing quote. |
| Badly formated Enum statement |
| Badly formated variable or macro. |
| This keyword cannot be used after a "Then" keyword. |
| "Select" statement is missing "EndSelect" or "Case" statement. |
| "If" statements must have a "Then" keyword. |
| Badly formated Struct statement. |
| Cannot assign values to constants. |
| Cannot make existing variables into constants. |
| Only Object-type variables allowed in an "With" statement. |
| Object referenced outside a "With" statement. |
| Nested "With" statements are not allowed. |
| Variable must be of type "Object". |
| The requested action with this object has failed. |
| Variable appears more than once in function declaration. |
| ReDim array can not be initialized in this manner. |
| An array variable can not be used in this manner. |
| Can not redeclare a constant. |
| Can not redeclare a parameter inside a user function. |
| Can pass constants by reference only to parameters with "Const" keyword. |
| Can not initialize a variable with itself. |
| Incorrect way to use this parameter. |
| "EndSwitch" statement with no matching "Switch" statement. |
| "Switch" statement is missing "EndSwitch" or "Case" statement. |
| "ContinueCase" statement with no matching "Select"or "Switch" statement. |
| Assert Failed! |
| AutoIt has encountered a fatal crash as a result of: |
| Unable to execute DLLCall. |
| Obsolete function/parameter. |
| Invalid Exitcode (reserved for AutoIt internal use). |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 3.2.4.9 |
| ProductVersion | 3.2.4.9 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_UNKNOWN
|
| Language | English - United Kingdom |
| FileVersion (#2) | 3, 2, 4, 9 |
| CompiledScript | AutoIt v3 Script : 3, 2, 4, 9 |
| Resource LangID | English - United Kingdom |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x9d4529d2 |
|---|---|
| Unmarked objects | 0 |
| 105 (2067) | 2 |
| C++ objects (VS2003 (.NET) SP1 build 6030) | 5 |
| ASM objects (VS2003 (.NET) SP1 build 6030) | 31 |
| C objects (VS2003 (.NET) SP1 build 6030) | 174 |
| C objects (2179) | 8 |
| C objects (9178) | 1 |
| Imports (2067) | 2 |
| C objects (VS2012 build 50727 / VS2005 build 50727) | 9 |
| Imports (9210) | 4 |
| Imports (2179) | 21 |
| Total imports | 468 |
| 100 (VS2003 (.NET) SP1 build 6030) | 53 |
| 94 (VS2003 (.NET) build 3052) | 1 |
| Linker (VS2003 (.NET) SP1 build 6030) | 1 |