644b576a23877bb6dfc5883e23faecd2

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Dec-05 22:50:52
Detected languages English - United States

Plugin Output

Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • LoadLibraryExA
  • GetProcAddress
Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
Can create temporary files:
  • CreateFileA
  • GetTempPathA
Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: AB Team d. o. o..
Issuer: GlobalSign CodeSigning CA - SHA256 - G2.
Suspicious VirusTotal score: 1/64 (Scanned on 2018-01-28 12:34:08) Baidu: Win32.Trojan.WisdomEyes.16070401.9500.9654

Hashes

MD5 644b576a23877bb6dfc5883e23faecd2
SHA1 b6871cb00b78e42a13803430a5f38a46f362e8f7
SHA256 01ba7045a10ccf04cb97b3e012b51c8490c2d85d3981be6fca9c3b5573114f63
SHA3 6e74ae9bec34cb1e4b1e901f9b62c6fe297281aa0d8dfc464cfcc7ffe956281a
SSDeep 196608:5y5+S2SmCi/ZF3TPDYsEr4Jw9biCDC5QEIuoGkLqk3ChtHvKboRWoIQo5zS:gQ1j/ZZMsEgw9bGXFoG0H3ChBvKboRbn
Imports Hash f2eb8d789695eff25c68c44db80d0898

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2009-Dec-05 22:50:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x5e00
SizeOfInitializedData 0x28400
SizeOfUninitializedData 0x400
AddressOfEntryPoint 0x30fa (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x7000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x4a000
SizeOfHeaders 0x400
Checksum 0xa186d9
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 856b32eb77dfd6fb67f21d6543272da5
SHA1 6597c511c2ee72f68f5246460f0683dae16dcade
SHA256 c6c2b4f41d6598b94106de36b422dd84534fd9a11d84b2b6a47b3be49524c750
SHA3 445d4953926565462cfa965e27571fc78b940b8fed24eb17ff7c6615386a208c
VirtualSize 0x5c4c
VirtualAddress 0x1000
SizeOfRawData 0x5e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.44011

.rdata

MD5 dc77f8a1e6985a4361c55642680ddb4f
SHA1 3d397ee25b2dd83ab741c67375880151cae94ed8
SHA256 576cdd5bc72421d008c86f056d0727c54cc8b3ec0961e5d0462af48278543d51
SHA3 edd5b030fa77ffcfc332e94d6c130fa3f6888851ffd01c2cb604eabacabb0b1c
VirtualSize 0x129c
VirtualAddress 0x7000
SizeOfRawData 0x1400
PointerToRawData 0x6200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.04684

.data

MD5 7922d4ce117d7d5b3ac2cffe4b0b5e4f
SHA1 4e56bb1994226ae0285c7adee470777262de2c99
SHA256 97773fd68ac3aebb9795c59dc00c5dbc0c992ce0c3c2ef90bfff27eb1cd72b3d
SHA3 837c1fb98044864a56ee24249151c9ea2ddf2cd65e849e3504ba96a9c27a478f
VirtualSize 0x25c58
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x7600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.801

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 c5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470
VirtualSize 0x14000
VirtualAddress 0x2f000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 aeb0a8d56580bf62ed6f097605ddb208
SHA1 37e06aeabd579f85820ef167132d560d13565ba6
SHA256 19102f21155683836fcbbee3bef842d899d15d4baac09e47dd3e9510333383d1
SHA3 71bdb53e1b417c504549efce6ecd8d1d0ebb8cc559ad02e2aab8a0a29d5294a5
VirtualSize 0x62e0
VirtualAddress 0x43000
SizeOfRawData 0x6400
PointerToRawData 0x7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.03891

Imports

KERNEL32.dll CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
USER32.dll EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
GDI32.dll SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
SHELL32.dll SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
ADVAPI32.dll RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
COMCTL32.dll ImageList_AddMasked
ImageList_Destroy
#17
ImageList_Create
ole32.dll CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
VERSION.dll GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Delayed Imports

110

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x666
Entropy 2.82633
MD5 b6bf70baab40fe438feff063bfb9ff6f
SHA1 7d4659d43e08d368ddacd31945872461c0b06253
SHA256 0e90a9e4b8f3a5bf990e8aadfd8096ad7aeaf1a4e032ac7b6395ce191d61c142
SHA3 0db21b559c3ef66108f6ab46bbc922eda718f5ca77a4a734250628331b1fbfc7
Preview

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
Entropy 6.07493
MD5 c7d505254fa1658814cbb08209bfa16a
SHA1 310ab18a70ad5a85758163e7d6bfb97b7399fb46
SHA256 e8221c1f425119563a91e8ef1a473abf7b2e79d62f3f24646ea28700b85f650c
SHA3 768e741a70f906b967ea43c7c5248930a9fd425e71f141543d4cb0c5e0b96a4f

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
Entropy 5.99622
MD5 b968d2e5c29d5ed0c385edbbd9643b73
SHA1 727cfc347e3e528657d6df08f8fbdf7c156b9f42
SHA256 2392ec36a0c4e2db195773fc801138f3c4377c643c7ba9296bf694e5d690fcbc
SHA3 55f551e07be6a12078136d843959f286ea6f041430805cda61a68f215ca32561

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
Entropy 3.61611
MD5 cbbc43afe21ba640fbaaf058eae483e6
SHA1 8001c722e20f6114318ef18ae8d4faa256528826
SHA256 22e059ff4c2ec595e8f17544264a08def4f1d595b4b83c97aec4d5c99cb25562
SHA3 2e916e53bf000717d7c92e9e64ef85c2d1d4b929d7f1b033ef2967dd90b8ec02

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
Entropy 0
MD5 a42b23f1c58701e073db2e9de0b27333
SHA1 f22232cbadff165ceb212527a6d77124312d0688
SHA256 e253c6a87bdd62e771c0ef1b9850dbc9523c51408ca282f994d3530dbbad9b11
SHA3 7531a1c5688cf270f0acbe5e1d605992d9f84c0e7666a65804cf31ab4563ab4c

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
Entropy 0
MD5 7e1b34650fb04bc15a494a1d712cffee
SHA1 43e1808e4308baf093556946552f4fabc05278d8
SHA256 3731b0a75ab19d96b774da62d37eccacd517c6593af20aa66525dc0b951cdba9
SHA3 2d670d0415e0b47f5933e2d38529ee20a0856e70df9d450c70e8a9c608e231e5

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
Entropy 0
MD5 809457c05fe696f5d34ac5ac8768cdd4
SHA1 a2c3e4966415100c7d24f7f3dc7e27d2a60d20c9
SHA256 1b66520d471367f736d50c070a2e2bba8ad88ac58743394a764b888e9cb6f6be
SHA3 3faa2efe9e3de2da51ed5813cfe8ece995a9c3c888f33868e4100cd259c8c7e4

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
Entropy 0
MD5 982079681d7ad12766abc44f06946f3e
SHA1 50f73ed0787bf5911bb907e487efbc84a9714e48
SHA256 250f52cb2d6f1966a29f6ac771fa1cd185b8f8531396c8a4026c0fe635617e0c
SHA3 1dd8326d39f624140c65c52817d9e609b46c4a6dd15ec9381dae2935fa2d3853

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
Entropy 2.71813
MD5 7add80697358fcc3e63354d269ea5ac9
SHA1 72c0a1363b9b4fee0a4acb42b31cd9b5e0664c4c
SHA256 b29c7a1301ddb0e896faf944d8ea8f4e57ff4f3d5fc3e5dc5bf3e64ed6be2fdd
SHA3 1c16f3a722e915b5a44091f0672de07c728452159193eaf1c4f120cc90930040

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016
SHA3 61a5f863c9b12c78269bb13876ca9436a03828d0cc49cf4104d8c0c2bab2ee6f

104

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x158
Entropy 2.70992
MD5 8787162f2e6ba74c06cadcf17b68f0c5
SHA1 7d83ee04bbcb75a6be4b1f3fff07120e694175cb
SHA256 a9915b533449c6415914dcb0688c8a67906bbf6391e466668723132a9f8f95fe
SHA3 c9a2d1554be8f9df62ff54ebbb051de649b61e606dfa11f74ed74f16df908b5d

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
Entropy 2.73893
MD5 386770584473e271f23dced36427f4ff
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19
SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014
SHA3 7c6d8fe47bba995d4c75a3b6e64475f7eb235332fc73b05ce030031542f8bd08

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
SHA3 8cdc23381c2115dc6057d4989e118528c84a56ff835728cfc712f0f9862e3d9c

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023
SHA3 f0ac7ac59811863af5d52e6fac01eb9622f427187487d3c752ebf95a69b56ef5

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
Entropy 2.92787
MD5 5dfa289639a3bcc0497da8db163f01fe
SHA1 6e2c6ea1e2594b66f563fb589276642c127e875f
SHA256 18466509968c3c0bf92ba410fea075def2b257a5a799a113cbc60f13e75f4b01
SHA3 25e7257e6a09f8234d3ea3b41175c4c22bbd858ed1f95b0d2b2371f34c6d45da

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
Entropy 2.88518
Detected Filetype Icon file
MD5 125f6fe16c39913bf159b91f29e1fdf1
SHA1 37f42cc9e2d3c2309ca334e3e85fe2ee81c42e5c
SHA256 cdf6c8d09181de329980e45d4edbe5c092d0b2b6ad981dc665405ac6669c9c66
SHA3 d73fb992a15e46d5bb22704db1975041055284d6d5e3b808ec98c87a54a20320

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x3be
Entropy 5.21482
MD5 18a65b0356650472e36d75deef2173b5
SHA1 ad8ae2a67c7258efa638901ff609cc6561b96b4f
SHA256 cb24fe30879e7b0870fb61f7c16bdb8c4fa9a2a8c2d945bd3ea8dd889e93c0ff
SHA3 076f2af737e197f8ae5283c16aa5519d47d2dcaf7d08d0df014c7876bf3cdc0a

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .ndata has a size of 0! [*] Warning: Section .ndata has a size of 0!