| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2021-Oct-14 07:37:35 |
| Detected languages |
English - United States
|
| Info | Matching compiler(s): | Microsoft Visual C++ 8.0 |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .itext
Unusual section name found: .didata Unusual section name found: .debug |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | The binary may have been compiled on a machine in the UTC+8 timezone. |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 12 |
| TimeDateStamp | 2021-Oct-14 07:37:35 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x1e3000 |
| SizeOfInitializedData | 0x6f46ea |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001E405C (Section: .itext) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x1e5000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x8f6000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetFileType
QueryDosDeviceW GetACP CloseHandle LocalFree SizeofResource VirtualProtect TerminateThread QueryPerformanceFrequency IsDebuggerPresent FindNextFileW GetFullPathNameW VirtualFree ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy FileTimeToDosDateTime ReadFile HeapSize GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW MapViewOfFile LoadLibraryA ResetEvent GetVolumeInformationW FreeResource GetDriveTypeW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread OutputDebugStringW GetCurrentThread GetLogicalDrives GetQueuedCompletionStatus GetFileAttributesExW CreateIoCompletionPort LoadLibraryExW LockResource FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP UnmapViewOfFile GetConsoleCP lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent GetLocaleInfoW CreateFileW DeleteFileW IsDBCSLeadByteEx GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue PostQueuedCompletionStatus SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
|---|---|
| SHFolder.dll |
SHGetFolderPathW
|
| version.dll |
GetFileVersionInfoSizeW
VerQueryValueW GetFileVersionInfoW |
| user32.dll |
CharUpperBuffW
CharNextW MsgWaitForMultipleObjects CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW |
| oleaut32.dll |
SysAllocStringLen
SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate |
| msvcrt.dll |
isupper
isalpha isalnum toupper memchr memcmp memcpy memset isprint isspace iscntrl isxdigit ispunct isgraph islower tolower |
| netapi32.dll |
NetWkstaGetInfo
NetApiBufferFree |
| advapi32.dll |
RegQueryValueExW
RegCloseKey RegOpenKeyExW |
| kernel32.dll (delay-loaded) |
GetFileType
QueryDosDeviceW GetACP CloseHandle LocalFree SizeofResource VirtualProtect TerminateThread QueryPerformanceFrequency IsDebuggerPresent FindNextFileW GetFullPathNameW VirtualFree ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy FileTimeToDosDateTime ReadFile HeapSize GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW MapViewOfFile LoadLibraryA ResetEvent GetVolumeInformationW FreeResource GetDriveTypeW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread OutputDebugStringW GetCurrentThread GetLogicalDrives GetQueuedCompletionStatus GetFileAttributesExW CreateIoCompletionPort LoadLibraryExW LockResource FileTimeToSystemTime GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP UnmapViewOfFile GetConsoleCP lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent GetLocaleInfoW CreateFileW DeleteFileW IsDBCSLeadByteEx GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue PostQueuedCompletionStatus SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
| Attributes | 0x1 |
|---|---|
| Name | kernel32.dll |
| ModuleHandle | 0x20c0a0 |
| DelayImportAddressTable | 0x20c0b4 |
| DelayImportNameTable | 0x20c0f4 |
| BoundDelayImportTable | 0x20c134 |
| UnloadDelayImportTable | 0x20c164 |
| TimeStamp | 1970-Jan-01 00:00:00 |
| Ordinal | 1 |
|---|---|
| Address | 0x206640 |
| Ordinal | 2 |
|---|---|
| Address | 0x11944 |
| Ordinal | 3 |
|---|---|
| Address | 0x66ba4 |
| Strings parameter cannot be nil |
| Invalid index type |
| Index out of bounds (%d) |
| Invalid group name (%s) |
| Invalid time string: %s |
| Invalid time Offset string: %s |
| MD5: Cannot update a finalized hash |
| Error decoding URL style (%%XX) encoded string at position %d |
| Invalid URL encoded character (%s) at position %d |
| Cannot construct an ITask in this manner |
| At least one task in array nil |
| Cannot start a task that has already completed |
| One or more tasks were cancelled |
| One or more errors occurred |
| Must wait on at least one event |
| Cannot call BeginInvoke on a TComponent in the process of destruction |
| A regular expression specified in RegEx is required |
| Error in regular expression at offset %d: %s |
| Error studying the regex: %s |
| Successful match required |
| Windows 2000 |
| Windows XP |
| Windows Server 2003 |
| Windows Server 2003 R2 |
| Windows Server 2012 |
| Windows Server 2012 R2 |
| Windows Server 2016 |
| Windows 8 |
| Windows 8.1 |
| Windows 10 |
| Observer is not supported |
| Cannot have multiple single cast observers added to the observers collection |
| The object does not implement the observer interface |
| No single cast observer with ID %d was added to the observer collection |
| No multi cast observer with ID %d was added to the observer collection |
| Invalid date string: %s |
| Unbalanced stack or queue operation |
| Item not found |
| Duplicates not allowed |
| Insufficient RTTI available to support this operation |
| Parameter count mismatch |
| Type '%s' is not declared in the interface section of a unit |
| VAR and OUT arguments must match parameter type exactly |
| %s (Version %d.%d, Build %d, %5:s) |
| %s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s) |
| 32-bit Edition |
| 64-bit Edition |
| Windows |
| Windows Vista |
| Windows Server 2008 |
| Windows 7 |
| Windows Server 2008 R2 |
| SpinCount out of range. Must be between 0 and %d |
| Invalid Reset Count: %d |
| Invalid Count: %d |
| Invalid Decrement Count: %d |
| Invalid Increment Count: %d |
| Decrement amount will cause invalid results: Count: %d, CurCount: %d |
| Count already max: Amount: %d, CurCount: %d |
| Countdown already reached zero (0) |
| Timespan too long |
| The duration cannot be returned because the absolute value exceeds the value of TTimeSpan.MaxValue |
| Value cannot be NaN |
| Negating the minimum value of a Timespan is invalid |
| Invalid Timespan format |
| Timespan element too long |
| Argument out of range |
| Argument must not be nil |
| Cannot call SetReturnValue on an externally create thread |
| Parameter %s cannot be a negative value |
| Input buffer exceeded for %s = %d, %s = %d |
| Invalid characters in path |
| Invalid characters in file name |
| The specified path is too long |
| The specified path was not found |
| The path format is not supported |
| The drive cannot be found |
| The specified file was not found |
| The specified file already exists |
| The given "%s" local time is invalid (situated within the missing period prior to DST). |
| Length of Strings and Objects arrays must be equal |
| Source and Destination arrays must not be the same |
| Class %s is not intended to be constructed |
| Invalid Timeout value: %s |
| %s has not been registered as a COM class |
| Error reading %s%s%s: %s |
| Stream read error |
| Property is read-only |
| Resource %s not found |
| %s.Seek not implemented |
| Operation not allowed on sorted list |
| %s not in a class registration group |
| Property %s does not exist |
| Stream write error |
| Thread creation error: %s |
| Thread Error: %s (%d) |
| Cannot terminate an externally created thread |
| Cannot wait for an externally created thread |
| Cannot call Start on a running or suspended thread |
| Cannot call CheckTerminated on an externally created thread |
| Class %s not found |
| A class named %s already exists |
| List does not allow duplicates ($0%x) |
| A component named %s already exists |
| String list does not allow duplicates |
| Cannot create file "%s". %s |
| Cannot open file "%s". %s |
| Invalid stream format |
| ''%s'' is not a valid component name |
| Invalid property value |
| Invalid property path |
| Invalid property value |
| List capacity out of bounds (%d) |
| List count out of bounds (%d) |
| List index out of bounds (%d) |
| Out of memory while expanding memory stream |
| Unable to create directory |
| Invalid source array |
| Invalid destination array |
| Character index out of bounds (%d) |
| Start index out of bounds (%d) |
| Invalid count (%d) |
| Invalid destination index (%d) |
| Invalid code page |
| Invalid encoding name |
| No mapping for the Unicode character exists in the target multi-byte code page |
| Invalid StringBaseIndex |
| Operation Cancelled |
| Ancestor for '%s' not found |
| Cannot assign a %s to a %s |
| Can't write to a read-only resource stream |
| CheckSynchronize called from thread $%x, which is NOT the main thread |
| November |
| December |
| Sun |
| Mon |
| Tue |
| Wed |
| Thu |
| Fri |
| Sat |
| Sunday |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Saturday |
| Jul |
| Aug |
| Sep |
| Oct |
| Nov |
| Dec |
| January |
| February |
| March |
| April |
| May |
| June |
| July |
| August |
| September |
| October |
| Exception in safecall method |
| Object lock not owned |
| Monitor support function not initialized |
| Feature not implemented |
| Method called on disposed object |
| %s (%s, line %d) |
| Abstract Error |
| Access violation at address %p in module '%s'. %s of address %p |
| System Error. Code: %d. |
| %s%s |
| A call to an OS function failed |
| Jan |
| Feb |
| Mar |
| Apr |
| May |
| Jun |
| Invalid NULL variant operation |
| Invalid variant operation (%s%.8x) |
| %s |
| Custom variant type (%s%.4x) is out of range |
| Custom variant type (%s%.4x) already used by %s |
| Custom variant type (%s%.4x) is not usable |
| Too many custom variant types have been registered |
| Could not convert variant of type (%s) into type (%s) |
| Overflow while converting variant of type (%s) into type (%s) |
| Variant overflow |
| Invalid argument |
| Invalid variant type |
| Operation not supported |
| Unexpected variant error |
| External exception %x |
| Assertion failed |
| Interface not supported |
| Privileged instruction |
| Exception %s in module %s at %p. |
| %s%s |
| Application Error |
| Format '%s' invalid or incompatible with argument |
| No argument for format '%s' |
| Variant method calls not supported |
| Read |
| Write |
| Execution |
| Invalid access |
| Format string too long |
| Error creating variant or safe array |
| Variant or safe array index out of bounds |
| Variant or safe array is locked |
| Invalid variant type conversion |
| Invalid variant operation |
| Read beyond end of file |
| Disk full |
| Invalid numeric input |
| Division by zero |
| Range check error |
| Integer overflow |
| Invalid floating point operation |
| Floating point division by zero |
| Floating point overflow |
| Floating point underflow |
| Invalid pointer operation |
| Invalid class typecast |
| Access violation at address %p. %s of address %p |
| Access violation |
| Stack overflow |
| Control-C hit |
| <unknown> |
| '%s' is not a valid integer value |
| '%s' is not a valid integer value for %s type |
| '%s' is not a valid floating point value |
| '%s' is not a valid date |
| '%s' is not a valid time |
| '%s' is not a valid date and time |
| '%d.%d' is not a valid timestamp |
| Invalid argument to time encode |
| Invalid argument to date encode |
| Out of memory |
| I/O error %d |
| File not found |
| Invalid filename |
| Too many open files |
| File access denied |
| StartAddressOfRawData | 0x60e000 |
|---|---|
| EndAddressOfRawData | 0x61e028 |
| AddressOfIndex | 0x5e5c20 |
| AddressOfCallbacks | 0x61f010 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |