6bbe90e83fc5b6133ae9d4c6a2af99e4b8583cffb15b2595eaa99012eb22bacb

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Mar-08 23:05:20
Detected languages English - United States
FileDescription FrekansLoL v4
FileVersion 3.0.4-rc.1
LegalCopyright
ProductName FrekansLoL v4
ProductVersion 3.0.4-rc.1

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
 Can access the registry:
  • RegEnumValueW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegCreateKeyExW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 15314576 bytes of data starting at offset 0x19a00.
The overlay data has an entropy of 7.99999 and is possibly compressed or encrypted.
Overlay data amounts for 99.3193% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 e1a29fbe88a4ba816248ae56fda4a64b 🔍
SHA1 f53604eb3c9fa6500d7a1ed86541857ae490fd34 🔍
SHA256 6bbe90e83fc5b6133ae9d4c6a2af99e4b8583cffb15b2595eaa99012eb22bacb 🔍
SHA3 01ae6190a6bfd84ad4de744766540f08b2476b21144e2b332f515776c886e2c7 🔍
SSDeep 393216:bO/APVsjQX4/aFrcYA0ftsBb3ICS68TAhiZf:b98QAaybS6qw8f 🔍
Imports Hash 46ce5c12b293febbeb513b196aa7f843 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2025-Mar-08 23:05:20
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6800
SizeOfInitializedData 0x22200
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x0000369F (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x6a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 afb6c5993570f82e85ec446bbb886505 🔍
SHA1 3d96eacb962ab3f739212dac5bffbc1b0ac88889 🔍
SHA256 89bbbfc4d2f459cc1a27370026ac5737eb822174462d5d5577d01e23e9065cc0 🔍
SHA3 4682faf433c5881bed1095ca4cf639c5f7a9d5d9dff55595f105ffec8f30c8ef 🔍
VirtualSize 0x6711
VirtualAddress 0x1000
SizeOfRawData 0x6800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45433

.rdata

MD5 e913094d8cceaca6b405bbbb52936387 🔍
SHA1 20df51227f19cb63323b43e74e506b2d2a09dce8 🔍
SHA256 512cb9ab76c260c6f4f8bb183a3e121f54906dcb42a74cded744aa6f6a330a19 🔍
SHA3 7f1ef0d8b4b6df73acc9b3d021673ec2f165f8688099c2a999d75994bfd54654 🔍
VirtualSize 0x1358
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.0997

.data

MD5 9d011beba2fe64a93f62fbb227cc9c35 🔍
SHA1 b6c4c61822b7f6abcb36cbd339f9cca5a4f4d452 🔍
SHA256 bdc36db376855e354e892a994ecdad27b11262eb19e548501a68049b0692f3f8 🔍
SHA3 cd0027898b2b69e95ffbf04ff0b04a714d00dc112e94d0266e2d5cc90aa7cf4c 🔍
VirtualSize 0x1fb78
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.12305

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2e000
VirtualAddress 0x2a000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 04d5bfa01d0e6a7363874f146e0351ca 🔍
SHA1 ed9a01a09a0a80e3524325393516e8f87a6b6014 🔍
SHA256 78617fb592a5b9032cb22f886a3b20d9f1bd0caf25accd6c43ee37655cc88214 🔍
SHA3 3fb7df4d4b46a78024e3d00782947a3ac28f92395f2df21a03d9e8fb65c388c8 🔍
VirtualSize 0x11210
VirtualAddress 0x58000
SizeOfRawData 0x11400
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.87217

Imports

ADVAPI32.dll RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
SHELL32.dll SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32.dll CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
COMCTL32.dll ImageList_Destroy
#17
ImageList_AddMasked
ImageList_Create
USER32.dll MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
GDI32.dll GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
KERNEL32.dll RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xd14c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9892
Detected Filetype PNG graphic file
MD5 9f6da24dbf57c6dfa31f9cb5afe3c539 🔍
SHA1 02a5037a57555987f9b7dd5f5a89c1e50ca4cde8 🔍
SHA256 e8ba69149b2a1ccdacba61bccde67f311fda5600d964d6abc0176039e0015c6a 🔍
SHA3 cb61f980789e06e7a8b9cef99f765ff87ebafe0947892627120d66d7689ec254 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x145b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.88124
Detected Filetype PNG graphic file
MD5 34b53d60f790b1f789ce504a8984ccd5 🔍
SHA1 291578aa8f89560ac714acc73980fc5f32ca7a1a 🔍
SHA256 922d162b2fb190a4dedd9872305d77e429e04debee796788c0751ca864a6e1ae 🔍
SHA3 055938bcb57650e07bbef70770413a73c433aa44a17725839c88d7512d23a39e 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xca3
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.85661
Detected Filetype PNG graphic file
MD5 696643d67a3b9ef9539d2e52dba562ce 🔍
SHA1 cd83fdc0ec598aea519ae4cd4fe32c7edf36aebd 🔍
SHA256 e107756472741329eb76782174ba2f2db171149dbaf26a08c306b860fcbe3c3a 🔍
SHA3 79056f462627b823632a1321276bf9b019612c44ebe62700d11fd92f54320559 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x694
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.78507
Detected Filetype PNG graphic file
MD5 994313398a3f9b0763f12280ac7a5bc4 🔍
SHA1 eed42e2858ebb92c080384bedbf8973588c538b5 🔍
SHA256 18b74470c345911c66e09092f5246c96921ea654f7e4fd2986a776cf4a2ac98d 🔍
SHA3 597c34fc08b08140afde766e234b9766552b8e80e6a17e548bb457ee2a71b564 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.62055
Detected Filetype PNG graphic file
MD5 1daaa413ddb80f1dbbbb1d5fd7d52225 🔍
SHA1 0c895659e6132de4495fe41b10b7592416ab6db4 🔍
SHA256 e7206c7966222439b9be5be270764a6d5beb39291d0db79213252306a9d62530 🔍
SHA3 c10cc7da14ab3c456b1e6d4fafd2321a973bed5b4244c3402a26ac765e34e3b2 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.61849
Detected Filetype PNG graphic file
MD5 551f01000de65ca859cb2cea63c99f15 🔍
SHA1 c1c1ade080cb6eb066ca66841341c86d656526ed 🔍
SHA256 04b11be047cc712b9f22963b2e03c68c685a31b7baf534c06c1e3bd77c8d9659 🔍
SHA3 2ab1e968460ebdb31ba11767f2726d3fe9b7d821b412da0eadd29e5dbbfb8409 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 982079681d7ad12766abc44f06946f3e 🔍
SHA1 50f73ed0787bf5911bb907e487efbc84a9714e48 🔍
SHA256 250f52cb2d6f1966a29f6ac771fa1cd185b8f8531396c8a4026c0fe635617e0c 🔍
SHA3 b8805d45012d79cfa8bb45e23c9b4a4421cd91538d569e58437efa0f545cf4d4 🔍

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09 🔍
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b 🔍
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016 🔍
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x200
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67385
MD5 d1a92272fbd597e1aa19021483110d5a 🔍
SHA1 9f75072682b37c6c52361d8c988ebd06dd003f63 🔍
SHA256 15663576584c947d634dab9848defcc7d8f05eb0b7e7c6d52d81eca695fc7a6e 🔍
SHA3 704756797695ae34f6fae500852bca70e5066a1d1993348fe40ccf626235d0d6 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17 🔍
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc 🔍
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 🔍
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b 🔍

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa 🔍
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843 🔍
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023 🔍
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f 🔍
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673 🔍
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763 🔍
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4 🔍

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.30907
Detected Filetype Icon file
MD5 8b9a4d027981fb98933dd17f7173bf64 🔍
SHA1 debe56596465f35270d7eb964e68d5d46dffd0f7 🔍
SHA256 c946cedb134cf8111202fae0add922a6f6c2330b810e87a32131b486d8e2f967 🔍
SHA3 c0dd8f97529973e442135993c6b1c40e613c8e7a422a815fd21a7ce461eaa80e 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1f8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.21744
MD5 87b8a15f028ed5aaaaae4dc08ba18940 🔍
SHA1 2e73fdc6d8a0eed98fb9a71c87b0e660f6e729a3 🔍
SHA256 a870212f7a070948c59557744bf9a0e7935e034f0800e0637f37bbb5d9731195 🔍
SHA3 1efffb9d182da75a8aca64c7e8bdef29f39357f3be27a563f29415e1146ab360 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x548
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28639
MD5 07b13c08cb06a8ee40e4cd270e5a7970 🔍
SHA1 4b15f71d939f279ba2168852c4612f9ecb06f195 🔍
SHA256 16233ba24b4e3d43375a8f54e73b60faa220809c667902e7015cc836b9e7002c 🔍
SHA3 f7038fba7c49192ee639552be4cf697612f93f6f15999b33626ee1a612524156 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 3.0.4.0
ProductVersion 3.0.4.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription FrekansLoL v4
FileVersion (#2) 3.0.4-rc.1
LegalCopyright
ProductName FrekansLoL v4
ProductVersion (#2) 3.0.4-rc.1
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd24e50e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 163
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.