61f12dbf2e87e6a8f543eba05a0ddca71cb1f397622eb53094223e31202f488d

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Mar-08 23:05:20
Detected languages English - United States
FileDescription SeekAndPicture 2 — The Irony of Debt
FileVersion 0.10.175
LegalCopyright Copyright © 2026 FramePoison
ProductName SeekAndPicture 2 — The Irony of Debt
ProductVersion 0.10.175

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Can access the registry:
  • RegEnumValueW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegCreateKeyExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 33562 bytes of data starting at offset 0x26400.
The overlay data has an entropy of 7.98609 and is possibly compressed or encrypted.
Safe VirusTotal score: 0/69 (Scanned on 2026-08-31 14:44:57) All the AVs think this file is safe.

Hashes

MD5 fcb484b662a4182626058e4b5c2a50ec 🔍
SHA1 a2bb24ea58c4fd849da81f0f0e17a6526fe8e179 🔍
SHA256 61f12dbf2e87e6a8f543eba05a0ddca71cb1f397622eb53094223e31202f488d 🔍
SHA3 bdba85c3c901dd3841dfc5fd870f20e8fa72bbd011764d1e309ad132411c515e 🔍
SSDeep 3072:74gtwNDdk1uL/tds/OKrihATYO6Bx7cfYqdGbtSNKPmq477/50A35NHbTev6eEvQ:74gtwn9/v3UKZ7DqUB0nnuXEvNbngmjK 🔍
Imports Hash 46ce5c12b293febbeb513b196aa7f843 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2025-Mar-08 23:05:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6c00
SizeOfInitializedData 0x2d200
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x000036C4 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x81000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d4d1f63a8f810eb2199178fe92ebc658 🔍
SHA1 ed9c08090e8440971a3ea5b1de72d950c073d59b 🔍
SHA256 53715588aed9d1b1468f047dce22539fd7723d637ed9657a73071e90cb9bfb11 🔍
SHA3 722aae5e889992ccd511c7dbc4bd760754ea1e53161907d631c8a4e944b853d5 🔍
VirtualSize 0x6a82
VirtualAddress 0x1000
SizeOfRawData 0x6c00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.47295

.rdata

MD5 a269a5731c1a739bb8381bf936040e32 🔍
SHA1 b2352d1eda8e3e5751f25516de996dd96b7abb9d 🔍
SHA256 858ae4e85ba932955e6a1ade834da9659c79d151a7719d98df7760d74a91355f 🔍
SHA3 4fbb7076d254897ea01fbfb16683ed9b00fc759bef4bf835f27a15d33672efe2 🔍
VirtualSize 0x1464
VirtualAddress 0x8000
SizeOfRawData 0x1600
PointerToRawData 0x7000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.96971

.data

MD5 edea0019dc20cf51b122de66adb8cb54 🔍
SHA1 ade71cfe1040639230bff1a3a2841d27d0562159 🔍
SHA256 d794683494589fa615af31f784c2331a970f83d93b9e8b44a7a35d64741944cb 🔍
SHA3 74289772e6a6e735f49ec582fae9e4e301cf68c41d39e6750aed54222d170b6b 🔍
VirtualSize 0x2a858
VirtualAddress 0xa000
SizeOfRawData 0x800
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.43645

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2e000
VirtualAddress 0x35000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 fcdc597b2f33237fa4b47aed82e00593 🔍
SHA1 d19ad2861f6017661698caa8069bfd4af2a177a5 🔍
SHA256 537d329169d8cb67e1cf600566d519e38ef2254c040c1e3b4ad32f0dd096a205 🔍
SHA3 1850f13ae7051dd25f3016a97191ae050c706a59648480c1f386045b0cab071a 🔍
VirtualSize 0x1d4b8
VirtualAddress 0x63000
SizeOfRawData 0x1d600
PointerToRawData 0x8e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.95378

Imports

ADVAPI32.dll RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
SHELL32.dll SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32.dll CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
COMCTL32.dll ImageList_Destroy
#17
ImageList_AddMasked
ImageList_Create
USER32.dll MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
GDI32.dll GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
KERNEL32.dll RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x173be
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99451
Detected Filetype PNG graphic file
MD5 85ef99e8a9f52c3e150fdf15b1d084a4 🔍
SHA1 83ab48757552ecd0c04f7b0659a5be4b512e22d5 🔍
SHA256 e138aacfd0e012895c39b70d6a3013936e1a6d940090595256c73c33731663e3 🔍
SHA3 ed90de05ed8a0d415cbc2e92b160a923c9e0f1aab8d6a6791750f5186e2be2c6 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22c7
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.89156
Detected Filetype PNG graphic file
MD5 8911d3b689b7c3166365905304c07eac 🔍
SHA1 19844eecab6af9751eb85fabbcfb354985a21c3f 🔍
SHA256 60348b776b06c5b996b8151a21eb4a5900eb7419a6c631d32ed65fc03324a221 🔍
SHA3 68514a20a03d9b97ff8883b8dce1782e5f65554cb8851747e4db36858ce39471 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x15fd
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85432
Detected Filetype PNG graphic file
MD5 d9b4c8acc7a45c3a447e689025012549 🔍
SHA1 a29c3abfb467755e598dff4121fcc27d69e4e2d8 🔍
SHA256 5540e4ef7ded9b068a39153c053a1302bc5ede8fb3f44f8b70d84bf86ca4b6ee 🔍
SHA3 3fce677986a57b260d9d61acf2eea6073b7b97c4e9246cfedba3e770fc48c119 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xbab
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.74881
Detected Filetype PNG graphic file
MD5 540f8a2ab12d55a7fd2dc18100577f72 🔍
SHA1 fe802dd48036281e3d2202abfe0d1b2e6892171e 🔍
SHA256 5bdac14f559459fdd027670a368fb1f73d96145720322dc1639b314a709ab3c7 🔍
SHA3 258cd1dc89d725495a2b2f14c29fb85e2ed9d7a1e492b42e250ca61b0e8514b4 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x779
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.65945
Detected Filetype PNG graphic file
MD5 e98ac739a8c135c6d9179634d4f598a1 🔍
SHA1 9eef2d656cf11170de3180c88f882a46fadadd7e 🔍
SHA256 07d971fd98533bd94eaa61cc1387e9d58439bdcedcaf6f1b4e13cc3b48dea230 🔍
SHA3 85afe017581164a3718f619c2f1a0d06de9a7209b89b96198407ca2e383d142d 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3f1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.53017
Detected Filetype PNG graphic file
MD5 81c0c6b010965cbb1b21a1afd3b2881e 🔍
SHA1 9683a377ae6598ca5640595184d0608dd391045b 🔍
SHA256 88897e51e728d0c4bc6d8a7e96f06f84752789c4f138780c67db64dd5117477b 🔍
SHA3 7683dc8f50e9ab5d2e2abd2b7fa66eacae2fc3b0a5464c5adfe7f195a8c5700c 🔍

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09 🔍
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b 🔍
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016 🔍
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73893
MD5 386770584473e271f23dced36427f4ff 🔍
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19 🔍
SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014 🔍
SHA3 db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17 🔍
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc 🔍
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 🔍
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b 🔍

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa 🔍
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843 🔍
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023 🔍
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f 🔍
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673 🔍
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763 🔍
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4 🔍

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66591
Detected Filetype Icon file
MD5 f36eeaa28242dffeaafe78d16d528393 🔍
SHA1 17269cbfc858717d04f7fd2f4bb40b664e324e05 🔍
SHA256 aa1a89416e4cab6cd6ff0c045a91aa955de9ac405a0bbda64e92810b14a94587 🔍
SHA3 daf29488a1cb8a334dd09558d8dfc0bbca4dbe924334f03e881e5b3c8f9c1e79 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x288
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.35565
MD5 ebcd0bb7c0e59d0aa641aa710da7bd3e 🔍
SHA1 6c04940c1e4a5a5b034b39e8b4d220a626ebb8c4 🔍
SHA256 e5dd3856e584a1786f4ed8ca14efd15f6f0f043b298c71332e68481eeea8bf6a 🔍
SHA3 63dfbc77765c157930ec87c5512855cd895d03615fc92479446f772a2ee3ebbb 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x548
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28639
MD5 07b13c08cb06a8ee40e4cd270e5a7970 🔍
SHA1 4b15f71d939f279ba2168852c4612f9ecb06f195 🔍
SHA256 16233ba24b4e3d43375a8f54e73b60faa220809c667902e7015cc836b9e7002c 🔍
SHA3 f7038fba7c49192ee639552be4cf697612f93f6f15999b33626ee1a612524156 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 0.10.175.0
ProductVersion 0.10.175.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription SeekAndPicture 2 — The Irony of Debt
FileVersion (#2) 0.10.175
LegalCopyright Copyright © 2026 FramePoison
ProductName SeekAndPicture 2 — The Irony of Debt
ProductVersion (#2) 0.10.175
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd24e50e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 163
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.