Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2009-Dec-05 22:50:46 |
Detected languages |
English - United States
|
Info | Interesting strings found in the binary: |
Contains domain names:
|
Suspicious | The PE is an NSIS installer | Unusual section name found: .ndata |
Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
Suspicious | The file contains overlay data. |
411781 bytes of data starting at offset 0x29c00.
The overlay data has an entropy of 7.99949 and is possibly compressed or encrypted. |
Malicious | VirusTotal score: 44/73 (Scanned on 2024-11-20 09:03:10) |
APEX:
Malicious
AVG: Win32:PUP-gen [PUP] Antiy-AVL: Trojan/Win32.Generic Avast: Win32:PUP-gen [PUP] CAT-QuickHeal: Trojan.IGENERIC CTX: exe.trojan.keygen ClamAV: Win.Trojan.Sality-39125 CrowdStrike: win/grayware_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS DrWeb: Adware.Bho.4103 ESET-NOD32: Win32/Keygen.ACE potentially unsafe Elastic: malicious (high confidence) Fortinet: Riskware/KeyGen GData: Win32.Trojan.Agent.05JO1Z Google: Detected Gridinsoft: Trojan.Win32.Agent.ns Ikarus: Trojan.Agent K7AntiVirus: Unwanted-Program ( 0052f55b1 ) K7GW: Unwanted-Program ( 0052f55b1 ) Kingsoft: malware.kb.a.990 Lionic: Trojan.Win32.Keygen.4!c Malwarebytes: Generic.Malware.AI.DDS McAfee: RDN/Generic.dx McAfeeD: ti!4ED0E186B9C4 Microsoft: HackTool:Win32/Keygen Paloalto: generic.ml Panda: PUP/Keygen Rising: Trojan.Zpevdo!8.F912 (CLOUD) SUPERAntiSpyware: Hack.Tool/Gen-Keygen SentinelOne: Static AI - Suspicious PE Skyhigh: RDN/Generic.dx Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Tencent: Win32.Trojan.Spy.Suxx Trapmine: malicious.moderate.ml.score TrendMicro: PUA.Win32.KeyGen.CRRM TrendMicro-HouseCall: PUA.Win32.KeyGen.CRRM VBA32: Trojan.MulDrop Varist: W32/Agent.FLW.gen!Eldorado VirIT: Trojan.Win32.MulDrop6.CHSK Xcitium: Malware@#2my19ac69yhl7 Yandex: Packed/MPress |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0xd8 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 5 |
TimeDateStamp | 2009-Dec-05 22:50:46 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Magic | PE32 |
---|---|
LinkerVersion | 6.0 |
SizeOfCode | 0x5c00 |
SizeOfInitializedData | 0x1d400 |
SizeOfUninitializedData | 0x400 |
AddressOfEntryPoint | 0x0000323C (Section: .text) |
BaseOfCode | 0x1000 |
BaseOfData | 0x7000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 4.0 |
ImageVersion | 6.0 |
SubsystemVersion | 4.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x4f000 |
SizeOfHeaders | 0x400 |
Checksum | 0 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
KERNEL32.dll |
CompareFileTime
SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA |
---|---|
USER32.dll |
EndDialog
ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow |
GDI32.dll |
SetBkColor
GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject |
SHELL32.dll |
SHGetPathFromIDListA
SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation |
ADVAPI32.dll |
RegQueryValueExA
RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA |
COMCTL32.dll |
ImageList_AddMasked
ImageList_Destroy #17 ImageList_Create |
ole32.dll |
CoTaskMemFree
OleInitialize OleUninitialize CoCreateInstance |
VERSION.dll |
GetFileVersionInfoSizeA
GetFileVersionInfoA VerQueryValueA |
XOR Key | 0x69ead975 |
---|---|
Unmarked objects | 0 |
C objects (VS2003 (.NET) build 4035) | 2 |
Total imports | 155 |
Imports (VS2003 (.NET) build 4035) | 17 |
48 (9044) | 10 |
Resource objects (VS98 SP6 cvtres build 1736) | 1 |