659e7a31913d0bf24a8b6b9380fecfaf
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2015-Feb-16 07:20:10 |
| Detected languages |
Chinese - Taiwan
English - United States |
| Debug artifacts |
d:\@Share\Projects\InsydeH2OUVE--[Going]BiosBitmapVariable\Windows\Output\bin\Win32\Release\VariableEdit.pdb
|
| FileDescription | Insyde H2OUVE (UEFI Variable Editor) |
| FileVersion | 1.0.0.11-beta4 |
| InternalName | H2OUVE |
| LegalCopyright | Copyright (C) 2014 Insyde Software Corp. All Rights Reserved. |
| OriginalFilename | H2OUVE.exe |
| ProductName | H2OUVE |
| ProductVersion | 1.0.0.11-beta4 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains another PE executable:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to SHA1 |
| Malicious | The file headers were tampered with. | The RICH header checksum is invalid. |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. |
Resource 141 detected as a PE Executable.
Resource 142 detected as a PE Executable. Resource 143 detected as a PE Executable. Resource 144 detected as a PE Executable. |
| Suspicious | VirusTotal score: 2/65 (Scanned on 2026-02-10 03:42:00) |
Google:
Detected
Ikarus: Trojan-Spy.Agent |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0 |
| e_cp | 0x28 |
| e_crlc | 0x19 |
| e_cparhdr | 0x20 |
| e_minalloc | 0x4b7 |
| e_maxalloc | 0x5b7 |
| e_ss | 0x87d |
| e_sp | 0x180 |
| e_csum | 0 |
| e_ip | 0x54 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x10958 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2015-Feb-16 07:20:10 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 9.0 |
| SizeOfCode | 0x83600 |
| SizeOfInitializedData | 0x1d5400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000503F5 (Section: .text) |
| BaseOfCode | 0x11000 |
| BaseOfData | 0x95000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x273000 |
| SizeOfHeaders | 0x10c00 |
| Checksum | 0x275f06 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| IMM32.dll |
ImmGetVirtualKey
|
|---|---|
| gdiplus.dll |
GdipDrawImageRectRect
GdipCloneImage GdipGetImageWidth GdipDeleteGraphics GdipCreateBitmapFromHBITMAP GdiplusStartup GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipGetImageHeight GdipFree |
| KERNEL32.dll |
UnlockFile
SetEndOfFile DuplicateHandle FindClose FindFirstFileW GetVolumeInformationW GetShortPathNameW FileTimeToLocalFileTime GetFileAttributesExW LocalFileTimeToFileTime GetFileSizeEx SetErrorMode TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetSystemTimeAsFileTime HeapAlloc HeapReAlloc HeapSize RtlUnwind RaiseException ExitProcess GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate QueryPerformanceCounter GetTickCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation GetTimeFormatA GetDateFormatA GetConsoleCP GetConsoleMode LockFile LCMapStringA InitializeCriticalSectionAndSpinCount SetStdHandle GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP GetProcessHeap CreateFileA SetEnvironmentVariableA lstrlenW SizeofResource LockResource LoadResource FindResourceW Sleep GetTempPathW CreateFileW WriteFile CloseHandle SetCurrentDirectoryW CopyFileW DeleteFileW GetFileSize ReadFile WideCharToMultiByte GetStartupInfoW AllocConsole GetStdHandle FreeConsole ReadConsoleW WriteConsoleW ReadConsoleInputW GetPrivateProfileIntW GetPrivateProfileStringW GetModuleHandleW GetProcAddress GetModuleFileNameW GetLastError GetCurrentProcess InterlockedDecrement MultiByteToWideChar FlushFileBuffers SetFilePointer lstrcmpiW GetStringTypeExW MoveFileW GetCurrentDirectoryW GlobalFlags SystemTimeToFileTime FileTimeToSystemTime GetThreadLocale TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement GetDiskFreeSpaceW GetFullPathNameW GetTempFileNameW GetFileTime SetFileTime GetFileAttributesW WritePrivateProfileStringW GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GetModuleHandleA GlobalGetAtomNameW GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW CompareStringW lstrcmpW GetVersionExA FreeResource GetCurrentProcessId SetLastError GlobalFree FormatMessageW LocalFree MulDiv VirtualFree VirtualAlloc LoadLibraryA ExpandEnvironmentStringsA LoadLibraryW FreeLibrary lstrlenA GlobalSize GlobalUnlock GlobalLock GlobalAlloc LCMapStringW |
| USER32.dll |
GrayStringW
GetWindowDC BeginPaint EndPaint PostQuitMessage ValidateRect TranslateMessage GetMessageW ShowOwnedPopups GetMenuItemInfoW DrawIcon SetWindowRgn GetSysColorBrush SetRect WindowFromPoint GetDCEx LockWindowUpdate UnregisterClassW DestroyIcon CharUpperW UnpackDDElParam ReuseDDElParam DestroyMenu SetCursor LoadAcceleratorsW InsertMenuItemW CreatePopupMenu SetRectEmpty BringWindowToTop TranslateAcceleratorW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow DispatchMessageW BeginDeferWindowPos EndDeferWindowPos UnhookWindowsHookEx DrawTextExW GetMessagePos PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetForegroundWindow IsWindowVisible PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos OffsetRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowTextLengthW GetWindowTextW GetScrollPos SetScrollPos GetWindow SetFocus GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem EnableWindow UpdateWindow LoadBitmapW SendMessageW GetNextDlgTabItem EndDialog GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled MessageBoxW GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount DrawMenuBar GetWindowRect DrawFocusRect ReleaseDC IntersectRect IsRectEmpty DrawTextW TabbedTextOutW SetParent GetSystemMenu DeleteMenu IsZoomed ShowScrollBar SetCaretPos GetCursorPos LoadCursorW DestroyCursor SetCursorPos RedrawWindow GetMessageTime InflateRect GetDC GetClientRect GetSysColor InvalidateRect FillRect DestroyCaret CreateCaret GetKeyState GetParent SetCapture ReleaseCapture ClientToScreen LoadMenuW GetSubMenu KillTimer ShowCaret PtInRect SetTimer SystemParametersInfoW OpenClipboard EmptyClipboard SetClipboardData RegisterClipboardFormatW GetFocus GetSystemMetrics GetClipboardData IsClipboardFormatAvailable CloseClipboard GetTopWindow |
| GDI32.dll |
RestoreDC
SetBkMode SetMapMode ExcludeClipRect IntersectClipRect LineTo MoveToEx SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW ExtTextOutW Escape SetViewportOrgEx SaveDC SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx CreatePatternBrush GetStockObject CreatePen CreateSolidBrush CreateFontIndirectW CreateEllipticRgn LPtoDP Ellipse CreateRectRgnIndirect SetRectRgn CombineRgn GetBkColor DeleteDC StretchDIBits GetCharWidthW DeleteObject GetTextMetricsW PatBlt CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox GetDeviceCaps GetTextExtentPoint32W BitBlt SetBoundsRect SelectObject CreateCompatibleBitmap CreateCompatibleDC OffsetViewportOrgEx CreateFontW |
| COMDLG32.dll |
GetFileTitleW
|
| WINSPOOL.DRV |
OpenPrinterW
DocumentPropertiesW ClosePrinter |
| ADVAPI32.dll |
LookupPrivilegeValueW
RegCreateKeyW GetFileSecurityW SetFileSecurityW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueW RegOpenKeyExA RegQueryValueExA RegCloseKey AdjustTokenPrivileges OpenProcessToken |
| SHELL32.dll |
DragFinish
DragQueryFileW ExtractIconW SHGetFileInfoW ShellExecuteW |
| COMCTL32.dll |
InitCommonControlsEx
|
| SHLWAPI.dll |
PathFindFileNameW
PathRemoveFileSpecW PathStripToRootW PathFindExtensionW PathIsUNCW |
| ole32.dll |
CoTaskMemFree
CoCreateInstance OleUninitialize OleInitialize CoUninitialize CoInitializeEx OleRun |
| OLEAUT32.dll |
SysAllocString
SysAllocStringByteLen SysStringByteLen SysFreeString VariantClear SysAllocStringLen VariantChangeType VariantInit GetErrorInfo |
| OLEACC.dll (delay-loaded) |
LresultFromObject
CreateStdAccessibleObject |
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | OLEACC.dll |
| ModuleHandle | 0xbca8c |
| DelayImportAddressTable | 0xb9f34 |
| DelayImportNameTable | 0xb472c |
| BoundDelayImportTable | 0xb4768 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
141
142
143
144
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
128
135
30994
30996
1
2
3
4
5
6
7
8
9
10
11
12
128 (#2)
130
134
139
100
106
147
30721
30722
30723
30734
7 (#2)
9 (#2)
2049
2051
3585
3601
3602
3603
3604
3605
3606
3697
3713
3825
3826
3841
3842
3843
3845
3857
3858
3859
3860
3865
3866
3867
3868
3869
3887
128 (#3)
30997
30977
30978
30998
30999
31000
31001
31002
31003
31004
31005
31006
31007
31008
31009
31010
31011
128 (#4)
129
133
1 (#2)
1 (#3)
128 (#5)
String Table contents
| OLE initialization failed. Make sure that the OLE libraries are the correct version. |
| UEFI Variable Edit |
| UEFI Variable Edit |
| UEFI VariableEdit.Document |
| VariableEdit.Document |
| : { - - - - } (Size= Attr=) |
| Import a file |
| Import |
| Save the variable data |
| Save |
| UEFIVariableEdit |
| Ready |
| Create a new document |
| New |
| Open an existing document |
| Open |
| Close the active document |
| Close |
| Save the active document |
| Save |
| Save the active document with a new name |
| Save As |
| Change the printing options |
| Page Setup |
| Change the printer and printing options |
| Print Setup |
| Print the active document |
| Display full pages |
| Print Preview |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Open this document |
| Erase the selection |
| Erase |
| Erase everything |
| Erase All |
| Copy the selection and put it on the Clipboard |
| Copy |
| Cut the selection and put it on the Clipboard |
| Cut |
| Find the specified text |
| Find |
| Insert Clipboard contents |
| Paste |
| Repeat the last action |
| Repeat |
| Replace specific text with different text |
| Replace |
| Select the entire document |
| Select All |
| Undo the last action |
| Undo |
| Redo the previously undone action |
| Redo |
| Split the active window into panes |
| Split |
| Display program information, version number and copyright |
| About |
| Quit the application; prompts to save documents |
| Exit |
| Switch to the next window pane |
| Next Pane |
| Switch back to the previous window pane |
| Previous Pane |
| EXT |
| CAP |
| NUM |
| SCRL |
| OVR |
| REC |
| Show or hide the toolbar |
| Toggle ToolBar |
| Show or hide the status bar |
| Toggle StatusBar |
| Change the window size |
| Change the window position |
| Reduce the window to an icon |
| Enlarge the window to full size |
| Switch to the next document window |
| Switch to the previous document window |
| Close the active window and prompts to save the documents |
| Restore the window to normal size |
| Activate Task List |
| Open |
| Save As |
| All Files (*.*) |
| Untitled |
| Close print preview mode |
| Cancel Preview |
| an unnamed file |
| &Hide |
| No error message is available. |
| Attempted an unsupported operation. |
| A required resource was unavailable. |
| Out of memory. |
| An unknown error has occurred. |
| Encountered an improper argument. |
| on %1 |
| &One Page |
| &Two Page |
| Page %u |
| Page %u |
| Pages %u-%u |
| prn |
| Output.prn |
| Printer Files (*.prn)|*.prn|All Files (*.*)|*.*|| |
| Print to File |
| to %1 |
| Incorrect filename. |
| Failed to open document. |
| Failed to save document. |
| Save changes to %1? |
| Failed to create empty document. |
| The file is too large to open. |
| Could not start print job. |
| Failed to launch help. |
| Internal application error. |
| Command failed. |
| Insufficient memory to perform operation. |
| System registry entries have been removed and the INI file (if any) was deleted. |
| Not all of the system registry entries (or INI file) were removed. |
| This program requires the file %s, which was not found on this system. |
| This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s. |
| Enter an integer. |
| Enter a number. |
| Enter an integer between %1 and %2. |
| Enter a number between %1 and %2. |
| Enter no more than %1 characters. |
| Select a button. |
| Enter an integer between 0 and 255. |
| Enter a positive integer. |
| Enter a date and/or time. |
| Enter a currency. |
| Enter a GUID. |
| Enter a time. |
| Enter a date. |
| Unexpected file format. |
| %1 |
| Cannot find this file. |
| Verify that the correct path and file name are given. |
| Destination disk drive is full. |
| Unable to read from %1, it is opened by someone else. |
| Unable to write to %1, it is read-only or opened by someone else. |
| Encountered an unexpected error while reading %1. |
| Encountered an unexpected error while writing %1. |
| %1: %2 |
| Continue running script? |
| Dispatch exception: %1 |
| Unable to read write-only property. |
| Unable to write read-only property. |
| Unable to load mail system support. |
| Mail system DLL is invalid. |
| Send Mail failed to send message. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| %1 was not found. |
| %1 contains an incorrect path. |
| Could not open %1 because there are too many open files. |
| Access to %1 was denied. |
| An incorrect file handle was associated with %1. |
| Could not remove %1 because it is the current directory. |
| Could not create %1 because the directory is full. |
| Seek failed on %1 |
| Encountered a hardware I/O error while accessing %1. |
| Encountered a sharing violation while accessing %1. |
| Encountered a locking violation while accessing %1. |
| Disk full while accessing %1. |
| Attempted to access %1 past its end. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| Attempted to write to the reading %1. |
| Attempted to access %1 past its end. |
| Attempted to read from the writing %1. |
| %1 has a bad format. |
| %1 contained an unexpected object. |
| %1 contains an incorrect schema. |
| pixels |
| Uncheck |
| Check |
| Mixed |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.11 |
| ProductVersion | 1.0.0.11 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| FileDescription | Insyde H2OUVE (UEFI Variable Editor) |
| FileVersion (#2) | 1.0.0.11-beta4 |
| InternalName | H2OUVE |
| LegalCopyright | Copyright (C) 2014 Insyde Software Corp. All Rights Reserved. |
| OriginalFilename | H2OUVE.exe |
| ProductName | H2OUVE |
| ProductVersion (#2) | 1.0.0.11-beta4 |
| Resource LangID | Chinese - Taiwan |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2015-Feb-16 07:20:10 |
| Version | 0.0 |
| SizeofData | 133 |
| AddressOfRawData | 0xa9ff0 |
| PointerToRawData | 0xa91f0 |
| Referenced File | d:\@Share\Projects\InsydeH2OUVE--[Going]BiosBitmapVariable\Windows\Output\bin\Win32\Release\VariableEdit.pdb |
TLS Callbacks
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x4b8210 |
| SEHandlerTable | 0x4ad420 |
| SEHandlerCount | 391 |
RICH Header
| XOR Key | 0x390153d6 |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2012 build 50727 / VS2005 build 50727) | 7 |
| ASM objects (VS2008 SP1 build 30729) | 26 |
| C objects (VS2008 SP1 build 30729) | 183 |
| C++ objects (VS2008 SP1 build 30729) | 146 |
| C++ objects (VS2008 build 21022) | 7 |
| C++ objects (VS2012 build 50727 / VS2005 build 50727) | 1 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 27 |
| Total imports | 564 |
| 138 (VS2008 SP1 build 30729) | 59 |
| Linker (VS2008 build 21022) | 1 |
| Resource objects (VS2008 SP1 build 30729) | 1 |