6fe46d940e71c46bbfac00fcd3aca293fdd9678bfcffcc1e631c41d05a9fbdfa

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2005-Sep-06 16:41:48
Detected languages English - United States

Plugin Output

Suspicious PEiD Signature: UPX -> www.upx.sourceforge.net
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can take screenshots:
  • BitBlt
  • GetDC
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2013-Aug-23 06:29:14
Suspicious VirusTotal score: 2/68 (Scanned on 2026-07-18 19:40:36) APEX: Malicious
MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 2c0ed2b149975015ab9427dfdda9f6f5
SHA1 ea7a78c94cb3310a4cc3e4c26e823c749b14651c
SHA256 6fe46d940e71c46bbfac00fcd3aca293fdd9678bfcffcc1e631c41d05a9fbdfa
SHA3 e088731c80bba9b5fa2d88fda15967a410a279037c7bfbf043a6ac03e7336372
SSDeep 6144:x3vQNzfYdcrAm8H1XQ7+BomlnzpON2wMFUwepoYcH4DP/E5WmA:x3vQNjMc8w2x1IiFUwrxH236A
Imports Hash d2f3d50ab2a0dd6db22b4597b991bde3

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2005-Sep-06 16:41:48
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x45000
SizeOfInitializedData 0x1000
SizeOfUninitializedData 0xaf000
AddressOfEntryPoint 0x000F4D10 (Section: UPX1)
BaseOfCode 0xb0000
BaseOfData 0xf5000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xf6000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xaf000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 e9c13de15abaeed5c95f5af52f41d904
SHA1 afc242075b01cb4fd9cc630b67b8f07e584b7997
SHA256 5fe06fdbf0ffce04078ebcfabc0dbd6538deeb96b7e5ea6051e7dacac05c815d
SHA3 eb9e0ac642a3daabec415165937bbd116249bd5551819d2d022dd8f8d67f92ff
VirtualSize 0x45000
VirtualAddress 0xb0000
SizeOfRawData 0x45000
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.92907

.rsrc

MD5 a86a667a12d88ce57919a8d28104de36
SHA1 7fadd9f53ffa428544060d5f195ea9efac7c6435
SHA256 9704ce4758f4733ae59eddf309f284a0c82651e5a5938278976600b6e0c4a9eb
SHA3 05282125fa37e673a4264550aace18b03fd6dceb0c3387aed5b40c55f6e13972
VirtualSize 0x1000
VirtualAddress 0xf5000
SizeOfRawData 0x600
PointerToRawData 0x45200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.10226

Imports

KERNEL32.DLL LoadLibraryA
GetProcAddress
ExitProcess
ddraw.dll DirectDrawCreate
dinput.dll DirectInputCreateA
dsound.dll DirectSoundCreate
GDI32.dll BitBlt
msvcrt.dll pow
OLE32.dll CoInitialize
USER32.dll GetDC
WINMM.DLL joyGetPosEx

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 2005-Sep-01 17:00:23
Entropy 3.55971
MD5 a54821a7420471fb8b35f5b73dcbf057
SHA1 3fd7ca0053913552d98373fa9b803c049a465a64
SHA256 7809f492aeb094ecdce046b3400bccf8d94dca085b9e39e1c5e4990547712c2a
SHA3 ff762519d814b1f7acc6ddbc594a7991931f3bbde659725bb1603288fff7a3cf

ALLEGRO_ICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2005-Sep-01 17:00:23
Entropy 1.67095
Detected Filetype Icon file
MD5 35913758d9456cf8b35f5170eecc9e06
SHA1 0778ef6972099657029fb7e768530dc954c8647b
SHA256 a4e1b5d39d55c4667e8a436af75bf5916b1bd7bd4b9fd0bbdeb3af1844fe27c6
SHA3 5dd302f02c66e2a914d744def9c5ec34b8bc3f723d3f62a93a845cceb0666c27

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section UPX0 has a size of 0!
Leave a comment

No comments yet.