6fd735002bf7d6ff0421ca625034838c

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2014-Oct-31 03:28:47
Detected languages English - United States
Debug artifacts wextract.pdb
CompanyName Microsoft Corporation
FileDescription Win32 Cabinet Self-Extractor
FileVersion 11.00.9600.16384 (winblue_rtm.130821-1623)
InternalName Wextract
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename WEXTRACT.EXE .MUI
ProductName Internet Explorer
ProductVersion 11.00.9600.16384

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious PEiD Signature: FASM 1.5x
FASM v1.5x
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • rundll32.exe
May have dropper capabilities:
  • CurrentVersion\Run
Contains domain names:
  • Command.com
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryExA
Can access the registry:
  • RegSetValueExA
  • RegQueryValueExA
  • RegCreateKeyExA
  • RegOpenKeyExA
  • RegQueryInfoKeyA
  • RegDeleteValueA
  • RegCloseKey
Possibly launches other programs:
  • CreateProcessA
Can create temporary files:
  • CreateFileA
  • GetTempPathA
Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
Enumerates local disk drives:
  • GetDriveTypeA
  • GetVolumeInformationA
Can shut the system down or lock the screen:
  • ExitWindowsEx
Malicious The PE header may have been manually modified. Resource CABINET detected as a CAB Installer file.
The resource timestamps differ from the PE header:
  • 1980-Jan-05 13:21:24
Resources amount for 82.4936% of the executable.
Malicious VirusTotal score: 17/74 (Scanned on 2024-07-13 15:19:18) ALYac: Misc.HackTool.DDoS
APEX: Malicious
AhnLab-V3: Trojan/Win32.Agent.C1645439
Bkav: W32.AIDetectMalware
CrowdStrike: win/malicious_confidence_70% (D)
Cylance: Unsafe
DeepInstinct: MALICIOUS
Elastic: malicious (high confidence)
FireEye: Generic.mg.6fd735002bf7d6ff
Gridinsoft: Spy.Win32.Redline.lu!heur
Lionic: Hacktool.Win32.Generic.3!c
Microsoft: HackTool:Win32/Tnega!MSR
Rising: Hacktool.Tnega!8.126B2 (CLOUD)
Sophos: Generic Reputation PUA (PUA)
ViRobot: HackTool.S.DDoS.221696
Webroot: W32.Malware.Gen
Xcitium: Malware@#3e62q7nsfr84j

Hashes

MD5 6fd735002bf7d6ff0421ca625034838c
SHA1 debbd09b363730e021c64a4a6a4baf3534534e58
SHA256 08e1b614e5bedc3dd61eff8cf1237333382c021d53b52c0a591e65fe0e065b50
SHA3 225f79d84da8b4c4c46fbaf2aa0485e372bac562e74d43c7866360f9927f0b28
SSDeep 3072:rwdK6g8IT9xR75XZyeIWZ+ohOp+oyAFWDBpz0PbIsMjcuZF:gK6g8ITJXp/h8pbFoBpz0DIsMjX7
Imports Hash bc70c4fa605f17c85050b7c7b6d42e44

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2014-Oct-31 03:28:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 11.3
SizeOfCode 0x6a00
SizeOfInitializedData 0x2f400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000069D0 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.3
ImageVersion 6.3
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x3b000
SizeOfHeaders 0x400
Checksum 0x3e0f2
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x40000
SizeofStackCommit 0x2000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 22c7cbc7745692002dbdf65a4bc48e63
SHA1 423b5abcf29ad54765e6fc189a20c94036545951
SHA256 adbae9567e9624498f63410216f642ae3f4ad2fcb02a1c690536939b5b70506c
SHA3 a073afba49634166069baf12f4d19398b8f2c2ba4a601e77f3e3dc023a3732b3
VirtualSize 0x6964
VirtualAddress 0x1000
SizeOfRawData 0x6a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.35038

.data

MD5 317f8a934ee443eee01c2a315bde9ca1
SHA1 3231c3205c7659e4e630a1446ef7576f07198e80
SHA256 87ce7a1e6c4441bed0f1d202ccdd35e307c4c28d885b5072d62e08063af5fb3d
SHA3 d9da2fd6a9a509434e833039fb9912ff7fe6009a02f9d95c04babd3b98892b3d
VirtualSize 0x1a8c
VirtualAddress 0x8000
SizeOfRawData 0x400
PointerToRawData 0x6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.17593

.idata

MD5 a5d9b0c8d0d0e35bcbb5219dda1a3075
SHA1 59242b862a3b98c7d0b0aa3f735c6afee72a735d
SHA256 5ddc16372ab6b6b56d245934b3dd69e923d5ef525e1fe9c3d185d784cd9a7b62
SHA3 00a7b932dcdb9cf0d06375050ace6a4ae681161b613404f7ba08a261545dab26
VirtualSize 0x107c
VirtualAddress 0xa000
SizeOfRawData 0x1200
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.04714

.rsrc

MD5 728fe505482979176bd0fc15b13dcc74
SHA1 cbee656b5470c4c1b5e50e80212316ba103ea183
SHA256 d4ac08d626e1ed70c5756d7362c70c11699f486f18a36490be5a7afc82301e12
SHA3 5434a0745c19e5db46f43ed0efada344c7b235d1db36b77eada1b9f898fbe197
VirtualSize 0x2d2f3
VirtualAddress 0xc000
SizeOfRawData 0x2d400
PointerToRawData 0x8400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.69416

.reloc

MD5 7772c8e6ff71410862c324630aac5515
SHA1 1a05318503c79aa7728d00aef9a5b24ed86d6f63
SHA256 867491c6968a63088b73717fa24f2b134f835caf7a3bdeed525e8ff6222d04db
SHA3 7481554aa9b89006dff99d4601d3f3cf71c0216806b56faca3405cf2c8a46680
VirtualSize 0x8c0
VirtualAddress 0x3a000
SizeOfRawData 0xa00
PointerToRawData 0x35800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.37329

Imports

ADVAPI32.dll OpenProcessToken
GetTokenInformation
RegSetValueExA
EqualSid
RegQueryValueExA
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueA
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
RegCloseKey
KERNEL32.dll GetPrivateProfileIntA
GetFileAttributesA
IsDBCSLeadByte
GetSystemDirectoryA
GlobalUnlock
GetShortPathNameA
CreateDirectoryA
FindFirstFileA
GetLastError
GetProcAddress
RemoveDirectoryA
SetFileAttributesA
GlobalFree
FindClose
GetPrivateProfileStringA
LoadLibraryA
LocalAlloc
WritePrivateProfileStringA
GetModuleFileNameA
FindNextFileA
CompareStringA
_lopen
CloseHandle
LocalFree
DeleteFileA
ExitProcess
DosDateTimeToFileTime
CreateFileA
FindResourceA
GlobalAlloc
ExpandEnvironmentStringsA
LoadResource
WaitForSingleObject
SetEvent
GetModuleHandleW
FormatMessageA
SetFileTime
WriteFile
GetDriveTypeA
GetVolumeInformationA
TerminateThread
SizeofResource
CreateEventA
GetExitCodeProcess
CreateProcessA
_llseek
SetCurrentDirectoryA
GetTempFileNameA
ResetEvent
LockResource
GetSystemInfo
LoadLibraryExA
CreateMutexA
GetCurrentDirectoryA
GetVersionExA
GetVersion
GetTempPathA
CreateThread
LocalFileTimeToFileTime
SetFilePointer
GetWindowsDirectoryA
lstrcmpA
_lclose
GlobalLock
GetCurrentProcess
FreeResource
FreeLibrary
Sleep
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
MulDiv
GetDiskFreeSpaceA
ReadFile
GDI32.dll GetDeviceCaps
USER32.dll GetDC
SendMessageA
SetForegroundWindow
MsgWaitForMultipleObjects
SendDlgItemMessageA
GetWindowRect
MessageBoxA
GetWindowLongA
PeekMessageA
ReleaseDC
GetDlgItem
SetWindowPos
ShowWindow
DispatchMessageA
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
GetDlgItemTextA
LoadStringA
MessageBeep
CharUpperA
CharNextA
ExitWindowsEx
CharPrevA
EndDialog
GetDesktopWindow
SetDlgItemTextA
SetWindowLongA
GetSystemMetrics
msvcrt.dll memset
?terminate@@YAXXZ
_controlfp
memcpy
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_acmdln
_initterm
_amsg_exit
__p__commode
_XcptFilter
_errno
_vsnprintf
__setusermatherr
COMCTL32.dll #17
Cabinet.dll #22
#23
#21
#20
VERSION.dll GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Delayed Imports

3001

Type AVI
Language English - United States
Codepage Latin 1 / Western European
Size 0x2e1a
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.52241
Detected Filetype AVI Resource Interchange File Format
Detected Filetype (#2) Windows animated cursor
MD5 f9035cf32b756fd6a452e9fdfd4a5dd9
SHA1 6912e88a3ee4d2c98ca69772cec564c6334fd9c4
SHA256 3bd1d253c90f7e82dc70dc1e4b869cc2e5e154e6b4079be93837e4a6c68044c0
SHA3 8cd00290363b6d3e609845f2e5828f3e2adaf35c4a97561bcf427bbd054401a6

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.1118
MD5 cc08941d711a52e350de430bfbbbaa79
SHA1 4eecb346a1e3e47cf0ee8804a38f82c636499aa5
SHA256 16b7e6e39d2904ef91717b67825faf656c1c5a32399d892597258a91940e3fa2
SHA3 2c10d40d8ec26bcd0ef6611176dfe1f64ac6c1bc914c29ecb699b3f520b578cc

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.9061
MD5 0dde03219f2e8a2a93b0a5b22553af42
SHA1 27d572b7c329d09279bb3abc0979ab0c6cd7ff32
SHA256 6c31ea835efd362e1f690878dd094b1c0a270bf0455a90f7190bed3f38f58254
SHA3 64183ee318d01f4c89058cf7ed0b684ab283c54d9a20b02d5901e3d1bdb68adc

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.77928
MD5 19abf7622894ac31068f23954c439424
SHA1 40dbb426ffb165f241cf49b3978277a2c0bb899d
SHA256 5309e40f525a77600c8237d862718bd5e5bd67133acbbe6678f6a9f9f27e3a91
SHA3 ab4c0a6bc4988beccbd26f76200fe99d6578780928331674afed94d400ac01ba

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.62704
MD5 18264cf3bfb3485a3165627add2fb71c
SHA1 5a7b64b1e42bb8ae961df53e1d5aca3476fc005b
SHA256 053d273b03655279a9cefb28b6dcfa893aac087cd60a8772a3b72fcad386bdcc
SHA3 575a8f97d829709d6ec6bbd7d60f10b48d0881cc409bdded1b11585fd2324f26

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.45048
MD5 e766fff2acb6fbda90dc20bf236862bc
SHA1 b4df3b310f7041c53e630b615313a39c1372db20
SHA256 d089624a1a2bfb160b9e1ec26d1059be5465538b7c5c44902404e06d91d35cae
SHA3 787e2ea9ebece91b50dbb3152d98df08cf7c4bcab98511e9681204b7f52d765c

2001

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x2f2
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.25575
MD5 733ab5b92105575b10e4716e64f874a7
SHA1 84177368dd4658cebdc991269a7584907f5dcc57
SHA256 ea6588cf6a9eaa2daaeace3bcd90ad19cfaca72505c0cbba9f10a0db2923d888
SHA3 7ed0210cc660b29977851bb04b3cf3c27eb4ea9953117e019b774d7b974ec128

2002

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x1b0
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.16025
MD5 57c16fb56b83819ba4b6267c6dddb013
SHA1 1477b9eb543fbd469c392064e4147d47e74dbb46
SHA256 1abfad902cece4ff79c75ee25d79fe254e3c6af72c161295c7ba006e56cd74b1
SHA3 941c199bcd737811c390814980c5ac4b546ef6538677f9599de9e7afed0bcb46

2003

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x166
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.99713
MD5 dc468a007b317c7439d83a5985cea5a7
SHA1 3d89aacc7eebd8c046e2f0e95f66b2b54d577568
SHA256 ec8a0548b6bb169afe513ec8a366e746255c3556fe66c95067756fb3ec8b895b
SHA3 505917a9fccb89b46551e12f0ced60758a952248cd6f0f7c69967e2e6eabea8d

2004

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x1c0
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.11992
MD5 a5187dc5894162b201fe774046408732
SHA1 81611f2aa32cfc8b03f00856f319870e97554b7d
SHA256 a3565ee9a8656bbdf37e3a50d14d954280cba4895576687a261200aefa1b5b39
SHA3 f9fe30ec54d6b149fa57e2cff2eeece6354e12fb7903c85ec221418ac11e94d0

2005

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x130
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.97326
MD5 ecc5f63aedee66cebcda9ed8fcb3e9f7
SHA1 60fadb22b7c1ac3638b8a4d12e2cbe174941ac71
SHA256 238d6c2e50312c555901a61e92afad3c7c6b42b9abd5acdda68658c2e2b48678
SHA3 b0eb2e4784dc0ae082c941596324510ddcdcd045da590b9db81d1c41f08f02da

2006

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x120
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.97672
MD5 42e1aa8919d27f02bcfc6981dbe5248e
SHA1 ec432b9979fad89557dd0b0ff1de774750f03f76
SHA256 cc21e9115c14c21af11786ff781dcf25c81beda500acf4966d0ddc7260610b06
SHA3 a11e5a0307464c1c66d9615a47d5568ab6bcd39c6bd6858842ad3c535272a129

63

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x8c
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.48958
MD5 ad0fe039aecc9c8af6f573923f182a0a
SHA1 b4fd492a37127d31fc36b7bd07084cc2f1ae18a1
SHA256 29b228ae95784d37b8729fe88e3bf1346c4b1339231dd1e9f702fab0654c5b1f
SHA3 7a67b4664ab18841c125d33dbe110fe774b16f91d1471094307c0ac35be5d8a8

76

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x520
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.2674
MD5 0f3f664bff00f8c4a1b42349d2956963
SHA1 d0ec056db75705bd79b7ebf1767c91dce955d79a
SHA256 7cc882dbb9f1315968f31bf40b57a535ff468271e253575752e03cb4aaa25f0c
SHA3 a81b1ab97bb98d4fb6d1619bf8bdee495b3176693e77305e438805563e952b91

77

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x5cc
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.29977
MD5 5f3ef55a113dc5f00ffc647e8be50df1
SHA1 cf04ac59ce78d6b2ffde0990ef76cf40ee1c439b
SHA256 3f715c8970d240cb57ba8ae8914ea8385b42728ffd48a3916493422a80cc3ed4
SHA3 fdabc44cd05ee45599b1e28ee3ca323cd6768db6606bffe95ceb6025b31b4d2f

80

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x4b0
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.27174
MD5 1f268a77ca8f853ff0c410e622706bef
SHA1 75afb11daf446704dddb5ef5fe39b2009aecf01d
SHA256 39023f15fbabf4be02e0d84a76c363003374b11076406f84cd8f92e49aecd3ba
SHA3 5e684d700849b8552f5449c5869807ce32caa8ae657695824e4a41be4a2ee55d

83

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x44a
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.2912
MD5 586fc633195baca29ef84b9271b42689
SHA1 69d5712401f0ca87f897c68f3a07ee9e01de8a25
SHA256 c1a5490b8a26165048de894aacdcd25e09cec0c4aebc5ff1d435f2cc4757118b
SHA3 04492be8d1f2fd83ad6633ec69825c302118f6039586e9f2bd804e00fdcc0913

85

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x3ce
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.13591
MD5 949714f4f3946ad108bb0817d170c459
SHA1 01b3524390968f27c27943e9f06f145b8527f8de
SHA256 59d8ad57a3629edd20c7b298a6e3604eeb95dfc7c507ad7e329ea0bff7a571ff
SHA3 6447983c227f98b8cd5f4045d58626cd5f965fa8e9cb99c33a68a58136ceb655

ADMQCMD

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x7
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.80735
MD5 527eeaa35a23dd5cac9bddcc2561a457
SHA1 0445b1735fd9797d537d360695940c7e68d25ace
SHA256 eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c
SHA3 28c8e1f57de512535bfd686562ef240323f7331b18e71f0506079f0e67e8f89e

CABINET

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0xea20
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 7.99117
Detected Filetype CAB Installer file
MD5 757a2e2e35d64e9f4859479c5ba1b195
SHA1 58f3c5f33562b6e23b74e3d4f1d5824719861491
SHA256 181b73aa5c02cc52a379008e21a34b94aa305ee1f2c9e96026e2dbbfd2a84a8d
SHA3 5e3f7ed8e84e001fd556258c8625ddf32c07a8de1577025ba0ba726cf7c70082

EXTRACTOPT

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x4
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 0.811278
MD5 4352d88a78aa39750bf70cd6f27bcaa5
SHA1 3c585604e87f855973731fea83e21fab9392d2fc
SHA256 67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450
SHA3 295cd1698c6ac5bd804a09e50f19f8549475e52db1c6ebd441ed0c7b256e1ddf

FILESIZES

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x24
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.80891
MD5 d620e0ce7c75e8b45111221ae539b72a
SHA1 4bf74d3031cfb8cb46539ebdfe6f07cc1e663ca1
SHA256 3e419cf3ab44df6b1a3dc100c30711ac5e30099ec01ab4f1c0f1eb1be7d5cc4c
SHA3 26a7c74d93ae94c90df790ae7f64e04423f054c410d54a0f31d414ca72d9540a

FINISHMSG

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x7
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.80735
MD5 527eeaa35a23dd5cac9bddcc2561a457
SHA1 0445b1735fd9797d537d360695940c7e68d25ace
SHA256 eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c
SHA3 28c8e1f57de512535bfd686562ef240323f7331b18e71f0506079f0e67e8f89e

LICENSE

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x7
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.80735
MD5 527eeaa35a23dd5cac9bddcc2561a457
SHA1 0445b1735fd9797d537d360695940c7e68d25ace
SHA256 eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c
SHA3 28c8e1f57de512535bfd686562ef240323f7331b18e71f0506079f0e67e8f89e

PACKINSTSPACE

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x4
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 0
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
SHA3 8b0a2385d83c8bf7be27e59996f7d881d3bf1fc6606f81ce600b753ad94192a2

POSTRUNPROGRAM

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x7
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.80735
MD5 527eeaa35a23dd5cac9bddcc2561a457
SHA1 0445b1735fd9797d537d360695940c7e68d25ace
SHA256 eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c
SHA3 28c8e1f57de512535bfd686562ef240323f7331b18e71f0506079f0e67e8f89e

REBOOT

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x4
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 0
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
SHA3 8b0a2385d83c8bf7be27e59996f7d881d3bf1fc6606f81ce600b753ad94192a2

RUNPROGRAM

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0xd
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.33468
MD5 3452420a7fbc97caeb85acda35615a6e
SHA1 49ab8b573da5ec2dd34329659d01855c13b7a9a5
SHA256 9745f9ecc53b04321375b779dee7a763ee2d370a124672bd95b6acda1ce126df
SHA3 cc7871ea29d77ae67db9a8263ad9fabb759f3b0c4a57b46ab5b7a26df4924293

SHOWWINDOW

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x4
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 0
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
SHA3 8b0a2385d83c8bf7be27e59996f7d881d3bf1fc6606f81ce600b753ad94192a2

TITLE

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x11
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.73452
MD5 09233556136c0923287d6ad3d3e90bd9
SHA1 53d81344c3605c67f0051141a03393144dc041bf
SHA256 64cbd9d04b98b67bf95135927f56951465ea9d01beece17f582faee6cdcc37ec
SHA3 b0f12a17961a034f4be38706cb7029e75b61b3282bf4e1692677b382b1688e40

UPROMPT

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x7
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.80735
MD5 527eeaa35a23dd5cac9bddcc2561a457
SHA1 0445b1735fd9797d537d360695940c7e68d25ace
SHA256 eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c
SHA3 28c8e1f57de512535bfd686562ef240323f7331b18e71f0506079f0e67e8f89e

USRQCMD

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x7
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.80735
MD5 527eeaa35a23dd5cac9bddcc2561a457
SHA1 0445b1735fd9797d537d360695940c7e68d25ace
SHA256 eaadcdd05a9a7c7f80d53d758f39e4399749d774b09a8a0165fe7c69ad6d8c3c
SHA3 28c8e1f57de512535bfd686562ef240323f7331b18e71f0506079f0e67e8f89e

3000

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x4c
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 2.60989
Detected Filetype Icon file
MD5 5bc94db1418308989abd06b59fe50c51
SHA1 3a65ad4296230691da11a7d5824e6d486010e776
SHA256 f4764d2d9673399ab75524314a3ba694597cc6a3e13c945cd64c9e9377ba0b86
SHA3 bfe41d0d41787b42332259d688832dcd7f2721f203a850236109ee5a49e008f4

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x41c
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 3.43654
MD5 ab89064699f021633a76649c481f2221
SHA1 99c95b6085f581545636664da8e6be69d9752b81
SHA256 1eb23ae34a3048f854f173ee4366bfdce4fd70bd21904a23e406ad4a9a5e8bf2
SHA3 751917c25949b681ebe3c305e05f5973a26e4a40484533508059ac3020e4d4b8

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x5e7
TimeDateStamp 1980-Jan-05 13:21:24
Entropy 5.05393
MD5 f531bc61d81dcce5eef276f7a7d29fb9
SHA1 1bc215e78ed66fe6f62892f663e41f9de103529a
SHA256 2c92e70164364b990848b16b860cc0ccc26fbd910b273d2cc72c39bedcd92652
SHA3 f5602f3ca9d34170de4657238d73a2b334481eba1dcc28e1945cac8258cefb30

String Table contents

Please select a folder to store the extracted files.
%s
Failed to get disk space information from: %s.
System Message: %s.
A required resource cannot be located.
Are you sure you want to cancel?
Unable to retrieve operating system version information.
Memory allocation request failed.
Unable to create extraction thread.
Cabinet is not valid.
Filetable full.
Can not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.
That folder is invalid. Please make sure the folder exists and is writable.
You must specify a folder with fully qualified pathname or choose Cancel.
Could not update folder edit box.
Could not load functions required for browser dialog.
Could not load Shell32.dll required for browser dialog.
Error creating process <%s>. Reason: %s
The cluster size in this system is not supported.
A required resource appears to be corrupted.
Windows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %s
GetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used.
Windows 95 or Windows NT is required to install
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
Do you still want to continue?
Error retrieving Windows folder
NT Shutdown: OpenProcessToken error.
NT Shutdown: AdjustTokenPrivileges error.
NT Shutdown: ExitWindowsEx error.
Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.
The setup program could not retrieve the volume information for drive (%s) .
System message: %s.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.
The installation program appears to be damaged or corrupted. Contact the vendor of this application.
Command line option syntax error. Type Command /? for Help.
Command line options:
/Q -- Quiet modes for package,
/T:<full path> -- Specifies temporary working folder,
/C -- Extract files only to the folder when used also with /T.
/C:<Cmd> -- Override Install Command defined by author.
You must restart your computer before the new settings will take effect.
Do you want to restart your computer now?
Another copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
The folder '%s' does not exist. Do you want to create it?
Another copy of the '%s' package is already running on your system. You can only run one copy at a time.
The '%s' package is not compatible with the version of Windows you are running.
The '%s' package is not compatible with the version of the file: %s on your system.

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 11.0.9600.16384
ProductVersion 11.0.9600.16384
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Microsoft Corporation
FileDescription Win32 Cabinet Self-Extractor
FileVersion (#2) 11.00.9600.16384 (winblue_rtm.130821-1623)
InternalName Wextract
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename WEXTRACT.EXE .MUI
ProductName Internet Explorer
ProductVersion (#2) 11.00.9600.16384
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2014-Oct-31 03:28:47
Version 0.0
SizeofData 37
AddressOfRawData 0x1434
PointerToRawData 0x834
Referenced File wextract.pdb

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x408000
SEHandlerTable 0x401470
SEHandlerCount 2
GuardCFCheckFunctionPointer 4235920
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xcd6ba16e
Unmarked objects 0
ASM objects (65501) 7
C++ objects (65501) 14
C objects (65501) 70
Imports (65501) 17
Total imports 199
210 (65501) 9
126 (VS2012 build 50727 / VS2005 build 50727) 1
Resource objects (65501) 1
Linker (65501) 1

Errors

<-- -->