7dcaadd156295ad4941987d9a3d95a32
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2022-Oct-02 22:03:44 |
| Detected languages |
English - United States
|
| Debug artifacts |
C:\projects\vim-win32-installer\vim\src\gvim.pdb
|
| CompanyName | Vim Developers |
| FileDescription | Vi Improved - A Text Editor |
| FileVersion | 9.0.0643 |
| InternalName | VIM |
| LegalCopyright | Copyright © 1996 |
| LegalTrademarks | Vim |
| OriginalFilename | gvim.exe |
| ProductName | Vim |
| ProductVersion | 9.0.0643 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to security software:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA256
Uses constants related to Blowfish |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/72 (Scanned on 2023-11-02 16:06:05) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2022-Oct-02 22:03:44 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x358400 |
| SizeOfInitializedData | 0xfcc00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000002194 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x45a000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x800000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.gfids
.tls
.rsrc
.reloc
Imports
| KERNEL32.dll |
GlobalFree
FreeConsole GetCurrentDirectoryW SetCurrentDirectoryW CreateJobObjectA GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetFileType TerminateJobObject DeleteTimerQueueTimer BackupRead BackupSeek GetEnvironmentStringsW FreeEnvironmentStringsA SetConsoleTitleW MoveFileW GenerateConsoleCtrlEvent GetExitCodeProcess QueryPerformanceFrequency QueryPerformanceCounter GlobalSize GlobalAlloc LocalHandle lstrlenA LocalAlloc GetConsoleMode GetNumberOfConsoleInputEvents Process32Next DisconnectNamedPipe GetOverlappedResult FlushFileBuffers CreatePipe TerminateProcess GetShortPathNameW GetLongPathNameW GetTempFileNameW DeleteFileW FindClose GetTempPathW FindNextFileW FindFirstFileW GetTickCount DebugBreakProcess CloseHandle OpenProcess FreeLibrary GetProcAddress GetVersionExA HeapSize WriteConsoleW GetModuleHandleA GetProcessHeap GetCommandLineA FindFirstFileExW GetTimeZoneInformation LoadLibraryA CreateFileA AttachConsole WaitForSingleObject GetFileInformationByHandle Sleep CreateToolhelp32Snapshot SetFileAttributesW SetCurrentDirectoryA ResumeThread PeekNamedPipe GetConsoleTitleW SetErrorMode GetProcessId WaitForMultipleObjects AssignProcessToJobObject WriteFile GetCurrentProcess GetFullPathNameW GetCommandLineW CreateNamedPipeA VirtualProtect CreateTimerQueueTimer SetHandleInformation Process32First GetModuleFileNameA ReadFile VirtualQuery MulDiv GlobalUnlock IsBadReadPtr FormatMessageA LocalFree GlobalLock GetSystemInfo GetFileAttributesW CreateFileW GetFinalPathNameByHandleW DeviceIoControl GetLocaleInfoA GetLastError IsValidCodePage GetACP GetCPInfo IsDBCSLeadByteEx CreateProcessA GetStartupInfoA ConnectNamedPipe SetEndOfFile FreeEnvironmentStringsW GetOEMCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx HeapReAlloc HeapAlloc HeapFree GetStdHandle GetModuleFileNameW GetConsoleCP DuplicateHandle ReadConsoleW SetConsoleCtrlHandler GetFileAttributesExW FreeLibraryAndExitThread ExitThread CreateThread RemoveDirectoryW CreateDirectoryW SetEnvironmentVariableW VirtualAlloc SetStdHandle SetFilePointerEx GetModuleHandleExW ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EncodePointer EnterCriticalSection SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetModuleHandleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte GetStringTypeW MultiByteToWideChar |
|---|---|
| ADVAPI32.dll |
RegOpenKeyExA
OpenProcessToken GetNamedSecurityInfoW RegQueryValueA RegCloseKey RegDeleteKeyA RegCreateKeyExA RegSetValueExA GetUserNameW RegEnumKeyExA AdjustTokenPrivileges GetAclInformation GetAce LookupPrivilegeValueA SetNamedSecurityInfoW |
| SHELL32.dll |
DragFinish
DragAcceptFiles DragQueryPoint DragQueryFileW CommandLineToArgvW ShellExecuteW Shell_NotifyIconA DragQueryFileA |
| GDI32.dll |
GetBkMode
GetCurrentObject BitBlt ExtTextOutA CreateFontA CreateCompatibleDC GetDCOrgEx SetPixel GetTextExtentPointW GdiFlush GetPixel GetTextExtentPointA LineTo CreatePen GetObjectW MoveToEx CreateSolidBrush ExtTextOutW GetNearestColor SelectObject StartPage EndDoc EnumFontFamiliesW GetDeviceCaps DeleteDC TextOutW GetTextExtentPoint32W SetTextColor SetBkMode CreateFontIndirectA SetBkColor DeleteObject CreateDCA GetTextMetricsA CreateFontIndirectW SetAbortProc StartDocW EndPage CreateBitmap SetTextAlign |
| COMDLG32.dll |
GetOpenFileNameW
GetSaveFileNameW ReplaceTextW FindTextW ChooseFontW CommDlgExtendedError PrintDlgW |
| ole32.dll |
CoInitialize
CoCreateInstance StringFromCLSID OleUninitialize CoTaskMemFree OleInitialize CoRevokeClassObject CoUninitialize CoRegisterClassObject |
| NETAPI32.dll |
NetApiBufferFree
NetUserEnum |
| USER32.dll |
SetParent
mouse_event ScrollWindowEx IntersectRect IsRectEmpty DestroyMenu GetMessageTime SetMenu MoveWindow GetSysColor GetMonitorInfoA GetDlgItemTextW LoadBitmapA GetKeyboardLayout FrameRect MapWindowPoints RegisterClassW SetClassLongPtrA CallWindowProcA FindWindowExA ClientToScreen DestroyIcon RedrawWindow SetTimer GetCapture RegisterWindowMessageA OffsetRect DialogBoxIndirectParamA GetClassInfoW ShowWindow TrackPopupMenu DestroyCursor GetWindowPlacement GetScrollPos WindowFromPoint IsZoomed MessageBeep SetWindowTextW GetSystemMetrics DrawMenuBar GetCursor SendMessageW ScreenToClient CreateWindowExW FillRect GetMenuItemCount SetActiveWindow MonitorFromWindow InvertRect InsertMenuA SetWindowPos IsWindowVisible GetDC InsertMenuItemW LoadCursorA GetWindowRect GetWindow MonitorFromPoint PostMessageW ShowScrollBar GetKeyState GetMenuState DefWindowProcW GetMessageW SetScrollInfo MessageBoxA GetCaretBlinkTime ShowCursor InvalidateRect IsIconic GetDlgItem GetMenuItemRect GetWindowLongPtrA DrawIconEx KillTimer SystemParametersInfoW ReleaseCapture CreateMenu SetWindowLongPtrA SetCapture InsertMenuW ToUnicode SetCursor TrackPopupMenuEx CreateDialogIndirectParamA RemoveMenu EndDialog GetClientRect PtInRect UpdateWindow CreatePopupMenu SetForegroundWindow LoadIconA MapVirtualKeyA IsWindow DestroyWindow EnableWindow ReleaseDC GetParent EnableMenuItem GetDesktopWindow SetCursorPos GetCursorPos BeginPaint EndPaint SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable RegisterClipboardFormatA GetFocus MessageBoxW CharLowerBuffA GetSystemMenu LoadImageA SendMessageTimeoutA EnumChildWindows GetClassNameA MsgWaitForMultipleObjects wsprintfA GetDlgItemTextA DispatchMessageW IsDialogMessageW PeekMessageW GetWindowTextA CharUpperBuffA SetDlgItemTextW SetWindowTextA RegisterClassA EnumWindows DefWindowProcA CreateWindowExA SetFocus TranslateMessage SendDlgItemMessageA SendMessageA GetWindowDC CreateDialogParamA SystemParametersInfoA PostMessageA |
| COMCTL32.dll |
#17
CreateToolbarEx |
| OLEAUT32.dll |
UnRegisterTypeLib
RegisterActiveObject LoadRegTypeLib LoadTypeLib RegisterTypeLib SysAllocString RevokeActiveObject SetErrorInfo |
| WINMM.dll |
PlaySoundW
mciGetDeviceIDA mciSendStringA mciSendStringW |
| WSOCK32.dll |
connect
recv htons __WSAFDIsSet closesocket select socket send WSAStartup WSACleanup WSAGetLastError inet_ntoa |
| WS2_32.dll |
getaddrinfo
inet_ntop freeaddrinfo |
Delayed Imports
scheme_external_get_thread_local_variables
| Ordinal | 1 |
|---|---|
| Address | 0x2fad00 |
1
IDB_TEAROFF
101
1 (#2)
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
PRINTDLGBOX
IDR_VIM
IDR_VIM_ALERT
IDR_VIM_ERROR
IDR_VIM_INFO
IDR_VIM_QUESTION
1 (#3)
1 (#4)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 9.0.0.0 |
| ProductVersion | 9.0.0.0 |
| FileFlags |
VS_FF_PRERELEASE
|
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Vim Developers |
| FileDescription | Vi Improved - A Text Editor |
| FileVersion (#2) | 9.0.0643 |
| InternalName | VIM |
| LegalCopyright | Copyright © 1996 |
| LegalTrademarks | Vim |
| OriginalFilename | gvim.exe |
| ProductName | Vim |
| ProductVersion (#2) | 9.0.0643 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Oct-02 22:03:44 |
| Version | 0.0 |
| SizeofData | 73 |
| AddressOfRawData | 0x39363c |
| PointerToRawData | 0x391e3c |
| Referenced File | C:\projects\vim-win32-installer\vim\src\gvim.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Oct-02 22:03:44 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0x393688 |
| PointerToRawData | 0x391e88 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2022-Oct-02 22:03:44 |
| Version | 0.0 |
| SizeofData | 884 |
| AddressOfRawData | 0x39369c |
| PointerToRawData | 0x391e9c |
TLS Callbacks
| StartAddressOfRawData | 0x140448000 |
|---|---|
| EndAddressOfRawData | 0x140448010 |
| AddressOfIndex | 0x14040c254 |
| AddressOfCallbacks | 0x14035ae18 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x94 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1403d3008 |
RICH Header
| XOR Key | 0x7b280637 |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2017 v14.15 compiler 26715) | 25 |
| ASM objects (VS2017 v14.15 compiler 26715) | 22 |
| C++ objects (VS2017 v14.15 compiler 26715) | 206 |
| C objects (VS2015 UPD1 build 23506) | 11 |
| ASM objects (VS2015 UPD3 build 24123) | 10 |
| C++ objects (VS2015 UPD3 build 24123) | 38 |
| C objects (VS2015 UPD3 build 24123) | 24 |
| C objects (VS2008 SP1 build 30729) | 5 |
| 135 (VS2008 SP1 build 30729) | 1 |
| Imports (VS2008 SP1 build 30729) | 27 |
| Total imports | 427 |
| 199 (41118) | 11 |
| C objects (LTCG) (24241) | 146 |
| Exports (24241) | 1 |
| Resource objects (VS2015 UPD3 build 24210) | 1 |
| Linker (24241) | 1 |