| Architecture |
IMAGE_FILE_MACHINE_I386
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date |
2005-Sep-06 16:41:48
|
| Detected languages |
English - United States
|
|
Suspicious
|
PEiD Signature: |
UPX -> www.upx.sourceforge.net
|
|
Suspicious
|
The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
|
|
Suspicious
|
The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
- LoadLibraryA
- GetProcAddress
Can take screenshots:
|
|
Suspicious
|
The PE header may have been manually modified. |
The resource timestamps differ from the PE header:
|
|
Suspicious
|
VirusTotal score: 2/68 (Scanned on 2026-07-18 19:40:36) |
APEX:
Malicious
MaxSecure:
Trojan.Malware.300983.susgen
|
| MD5 |
2c0ed2b149975015ab9427dfdda9f6f5
🔍
|
| SHA1 |
ea7a78c94cb3310a4cc3e4c26e823c749b14651c
🔍
|
| SHA256 |
6fe46d940e71c46bbfac00fcd3aca293fdd9678bfcffcc1e631c41d05a9fbdfa
🔍
|
| SHA3 |
e088731c80bba9b5fa2d88fda15967a410a279037c7bfbf043a6ac03e7336372
🔍
|
| SSDeep |
6144:x3vQNzfYdcrAm8H1XQ7+BomlnzpON2wMFUwepoYcH4DP/E5WmA:x3vQNjMc8w2x1IiFUwrxH236A
🔍
|
| Imports Hash |
d2f3d50ab2a0dd6db22b4597b991bde3
🔍
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x80
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections |
3
|
| TimeDateStamp |
2005-Sep-06 16:41:48
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xe0
|
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic |
PE32
|
| LinkerVersion |
2.0
|
| SizeOfCode |
0x45000
|
| SizeOfInitializedData |
0x1000
|
| SizeOfUninitializedData |
0xaf000
|
| AddressOfEntryPoint |
0x000F4D10 (Section: UPX1)
|
| BaseOfCode |
0xb0000
|
| BaseOfData |
0xf5000
|
| ImageBase |
0x400000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
1.0
|
| SubsystemVersion |
4.0
|
| Win32VersionValue |
0
|
| SizeOfImage |
0xf6000
|
| SizeOfHeaders |
0x1000
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve |
0x200000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
🔍
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
🔍
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
🔍
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
🔍
|
| VirtualSize |
0xaf000
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 |
e9c13de15abaeed5c95f5af52f41d904
🔍
|
| SHA1 |
afc242075b01cb4fd9cc630b67b8f07e584b7997
🔍
|
| SHA256 |
5fe06fdbf0ffce04078ebcfabc0dbd6538deeb96b7e5ea6051e7dacac05c815d
🔍
|
| SHA3 |
eb9e0ac642a3daabec415165937bbd116249bd5551819d2d022dd8f8d67f92ff
🔍
|
| VirtualSize |
0x45000
|
| VirtualAddress |
0xb0000
|
| SizeOfRawData |
0x45000
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
7.92907
|
| MD5 |
a86a667a12d88ce57919a8d28104de36
🔍
|
| SHA1 |
7fadd9f53ffa428544060d5f195ea9efac7c6435
🔍
|
| SHA256 |
9704ce4758f4733ae59eddf309f284a0c82651e5a5938278976600b6e0c4a9eb
🔍
|
| SHA3 |
05282125fa37e673a4264550aace18b03fd6dceb0c3387aed5b40c55f6e13972
🔍
|
| VirtualSize |
0x1000
|
| VirtualAddress |
0xf5000
|
| SizeOfRawData |
0x600
|
| PointerToRawData |
0x45200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
4.10226
|
| KERNEL32.DLL |
LoadLibraryA
GetProcAddress
ExitProcess
|
| ddraw.dll |
DirectDrawCreate
|
| dinput.dll |
DirectInputCreateA
|
| dsound.dll |
DirectSoundCreate
|
| GDI32.dll |
BitBlt
|
| msvcrt.dll |
pow
|
| OLE32.dll |
CoInitialize
|
| USER32.dll |
GetDC
|
| WINMM.DLL |
joyGetPosEx
|
| Type |
RT_ICON
|
| Language |
English - United States
|
| Codepage |
UNKNOWN
|
| Size |
0x2e8
|
| TimeDateStamp |
2005-Sep-01 17:00:23
|
| Entropy |
3.55971
|
| MD5 |
a54821a7420471fb8b35f5b73dcbf057
🔍
|
| SHA1 |
3fd7ca0053913552d98373fa9b803c049a465a64
🔍
|
| SHA256 |
7809f492aeb094ecdce046b3400bccf8d94dca085b9e39e1c5e4990547712c2a
🔍
|
| SHA3 |
ff762519d814b1f7acc6ddbc594a7991931f3bbde659725bb1603288fff7a3cf
🔍
|
| Type |
RT_GROUP_ICON
|
| Language |
English - United States
|
| Codepage |
UNKNOWN
|
| Size |
0x14
|
| TimeDateStamp |
2005-Sep-01 17:00:23
|
| Entropy |
1.67095
|
| Detected Filetype |
Icon file
|
| MD5 |
35913758d9456cf8b35f5170eecc9e06
🔍
|
| SHA1 |
0778ef6972099657029fb7e768530dc954c8647b
🔍
|
| SHA256 |
a4e1b5d39d55c4667e8a436af75bf5916b1bd7bd4b9fd0bbdeb3af1844fe27c6
🔍
|
| SHA3 |
5dd302f02c66e2a914d744def9c5ec34b8bc3f723d3f62a93a845cceb0666c27
🔍
|
[*] Warning: Section UPX0 has a size of 0!
6fe46d940e71c46bbfac00fcd3aca293fdd9678bfcffcc1e631c41d05a9fbdfa