670d8cbac7ca765ef101b5333eeadc81

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2015-Oct-26 15:43:35
Detected languages English - United States
CompanyName Zucchetti.com
ProductName ElaboraBilanci
FileVersion 1.00
ProductVersion 1.00
InternalName ElaboraDiff
OriginalFilename ElaboraDiff.exe

Plugin Output

Info Matching compiler(s): Microsoft Visual Basic 5.0
Microsoft Visual Basic v5.0/v6.0
Microsoft Visual Basic v5.0 - v6.0
Info Interesting strings found in the binary: Contains domain names:
  • Sditest3.dmz6.zucchetti.it
  • Zucchetti.com
  • dmz6.zucchetti.it
  • zucchetti.it
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 670d8cbac7ca765ef101b5333eeadc81
SHA1 0ac8162ece26ce05c873baa2be5ca8b95952a74a
SHA256 2df59c98a698987fd37ead019e7dac1267a2ef1532fad1eea0c6760ba24f5fcc
SHA3 9a2dc2bd5ae27632d0d1ea8109d4f8712a9fe2b2bdba489c294fd7663ebe6608
SSDeep 1536:N4LbeAEzo7UJLniRdBQhn0VlluzDBzS3wn1ykSZj4JCs2Yzxp:Km5zoAJLniRdBQhn0VLuzDBzS3Ej
Imports Hash db698ac6da46ceaf46632c1325f2decc

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xc8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2015-Oct-26 15:43:35
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x14000
SizeOfInitializedData 0x2000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001570 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x15000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x17000
SizeOfHeaders 0x1000
Checksum 0x24210
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5851234931b2e65da9ddfdc2dc8be60e
SHA1 fe424a826360a852a1b5e8e7502cdfe41766bbed
SHA256 35406a571dfb9af3a1163d4bfb3d21dfdf4fb69ce36d0d97817518b1463ca8ef
SHA3 2303395c342097281c4245774d9300315dfb5d8c68423d8379553644b288e9b7
VirtualSize 0x13b94
VirtualAddress 0x1000
SizeOfRawData 0x14000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.46959

.data

MD5 620f0b67a91f7f74151bc5be745b7110
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA3 a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563
VirtualSize 0x45c
VirtualAddress 0x15000
SizeOfRawData 0x1000
PointerToRawData 0x15000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 513ea2dd07b5b33577530be55d7f5806
SHA1 fa5ee9ca1c6b15db1a1b60a020218f5229136702
SHA256 efa742b75f49a4420fcd4e0f96722b7dcdf3a11f3d8f3d92cf24f25397eead2e
SHA3 7b84b29f9795f07d87473753980490936ab5356abf24e89fdd328fc2c2ef86e1
VirtualSize 0x8f4
VirtualAddress 0x16000
SizeOfRawData 0x1000
PointerToRawData 0x16000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.94259

Imports

MSVBVM60.DLL __vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
#513
__vbaVarIndexStore
__vbaNextEachVar
#515
__vbaStrErrVarCopy
_adj_fprem1
__vbaVarSetVarAddref
__vbaStrCat
#553
__vbaHresultCheckObj
__vbaNameFile
#556
__vbaLenVar
__vbaVargVarCopy
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaBoolVar
#520
__vbaVarTstLt
__vbaBoolVarNull
_CIsin
__vbaVargVarMove
#632
__vbaChkstk
__vbaFileClose
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
#560
__vbaObjVar
__vbaVarOr
__vbaVarLateMemSt
_adj_fpatan
__vbaRedim
_CIsqrt
__vbaObjIs
__vbaVarAnd
__vbaVarMul
__vbaExceptHandler
#711
#712
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
#716
__vbaFPException
__vbaStrCompVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaNew2
#648
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
__vbaStrCopy
__vbaI4Str
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
#685
#100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
#610
__vbaVarAdd
__vbaLateMemCall
__vbaVarDup
#612
__vbaUnkVar
__vbaVarCopy
__vbaVarLateMemCallLd
__vbaVarSetObjAddref
#617
_CIatan
__vbaCastObj
__vbaStrMove
__vbaForEachVar
__vbaStrVarCopy
#542
#543
_allmul
__vbaLenVarB
#544
#652
#545
_CItan
#546
#547
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj

Delayed Imports

30001

Type RT_ICON
Language UNKNOWN
Codepage Unicode (UTF 16LE)
Size 0x130
TimeDateStamp 2015-Oct-26 15:43:34
Entropy 2.57965
MD5 a20d09bee9b4207ad5a3b67a78c1dce3
SHA1 ca85fbf532389887f3837bbadd1c579040b99c8b
SHA256 2d3915cdc82e909357d44c4de1b8890bd753605c28df11b10299e3fd09d930b9
SHA3 e3b2b0325b24bb74af126af0863b39a6e63c08820f69cf0ae582a31bfc1052db

30002

Type RT_ICON
Language UNKNOWN
Codepage Unicode (UTF 16LE)
Size 0x2e8
TimeDateStamp 2015-Oct-26 15:43:34
Entropy 1.76987
MD5 24799ca590d42134e7103b06d46fd960
SHA1 4af9a0fe3b7371abc50a18e851f3122fce9a2ffa
SHA256 a32e750bc1b0315530097434a7e1d324b843e1f5ffd95238b49d3a8aa8e6fe09
SHA3 9a17698629ef5e7a1c567a9669be74aa2c9d8356ecfba40c48811e4dcf5ea875

30003

Type RT_ICON
Language UNKNOWN
Codepage Unicode (UTF 16LE)
Size 0x128
TimeDateStamp 2015-Oct-26 15:43:34
Entropy 2.07177
MD5 e6c5053ba1c848d7e16701a2d08fb8c6
SHA1 f253482c0fa25197130f6475f2ded060527843bf
SHA256 46dc088910439dad6a0d69da5e64227d04a640845fd1c31e90a7d4340c539fe0
SHA3 1e6c369197dd1a466ea87357db49ec559ecf82c0c3fa13af1a383445945861e6

1

Type RT_GROUP_ICON
Language UNKNOWN
Codepage Unicode (UTF 16LE)
Size 0x30
TimeDateStamp 2015-Oct-26 15:43:34
Entropy 2.97836
Detected Filetype Icon file
MD5 835a20def9b2661b64b8ac06b4901f36
SHA1 70732dac88537f00c89d105f986ef843d3aca818
SHA256 cbdcb84268fcf2a25b844c1dca787de835c0376e82c1a2e62814a3c940a26cfb
SHA3 9a2de99425a7e2086c65d82719bf44696cfe58b8077ce214e814ceeeb78ba1f4

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Unicode (UTF 16LE)
Size 0x234
TimeDateStamp 2015-Oct-26 15:43:34
Entropy 3.20007
MD5 23526bdb2c5cf587352446ecbb2d9861
SHA1 70c17dec694d8270086a2cc790216f01025bb682
SHA256 b43d3b254fcaeb41a69d083bcebdbd6cee895092ed5b0d029a450b57b24de9ea
SHA3 8c342c700b8bebeaa017a7b0d44a132032556f4158b4e48fac39c57f9e40fd06

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Zucchetti.com
ProductName ElaboraBilanci
FileVersion (#2) 1.00
ProductVersion (#2) 1.00
InternalName ElaboraDiff
OriginalFilename ElaboraDiff.exe
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x89a99a19
Unmarked objects 0
14 (7299) 1
9 (8041) 5
13 (8169) 1

Errors

<-- -->