82c113ebbf068d7a937322168bceb4e8

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2016-Nov-01 09:22:02
Detected languages English - United States
Debug artifacts O:\CPPwrapper_VS2010\Release_RS\optimizerpro_silent.pdb
CompanyName PC Utilities Software Limited
FileDescription Keep your PC drivers up to date
FileVersion 3.2.0.2
InternalName Driver Pro
LegalCopyright PC Utilities Software Limited
OriginalFilename Driver Pro
ProductName Driver Pro v3.2
ProductVersion 3.2.0.2

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious PEiD Signature: UPolyX V0.1 -> Delikon
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
Can access the registry:
  • RegCloseKey
  • RegFlushKey
  • RegCreateKeyExW
  • RegSetValueExW
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
Malicious The PE is possibly a dropper. Resource IDB_BIN_INSTALL detected as a PE Executable.
Resources amount for 96.3317% of the executable.
Info The PE is digitally signed. Signer: PC Utilities Software Limited
Issuer: COMODO RSA Code Signing CA
Malicious VirusTotal score: 31/57 (Scanned on 2016-11-04 04:50:07) Bkav: W32.HfsAdware.59EA
CAT-QuickHeal: PUA.Driverpro.PR8
McAfee: Artemis!3107C28DA15C
Malwarebytes: PUP.Optional.DriverPro
VIPRE: OptimizerPro (fs) (not malicious)
K7GW: Adware ( 004b203a1 )
K7AntiVirus: Adware ( 004b203a1 )
Baidu: Win32.Adware.SpeedingUpMyPC.a
Symantec: SMG.Heur!gen
Avast: Win32:Adware-CJK [PUP]
Kaspersky: not-a-virus:HEUR:RiskTool.Win32.Generic
NANO-Antivirus: Riskware.Win32.OptimizerPro.dtleju
AegisLab: Win.Troj.Optimizerpro.mfLp
Rising: Malware.Generic!cjJGP5m65YM@4 (thunder)
Comodo: Application.Win32.Optimizero.K
DrWeb: Trojan.PWS.Tibia.2591
Zillya: Trojan.GenericCRTD.Win32.196
Invincea: virus.win32.parite.b
Jiangmin: Adware.BProtector.h
Avira: PUA/OptimizerPro.RE
Antiy-AVL: RiskWare[RiskTool:not-a-virus]/Win32.OptimizerPro
AhnLab-V3: PUP/Win32.Optimizer.R116134
AVware: OptimizerPro (fs)
ESET-NOD32: Win32/Adware.SpeedingUpMyPC.Q
Yandex: Riskware.OptimizerPro!
Ikarus: PUA.SpeedingUpMyPC
GData: Win32.Application.OptimizerPro.L
AVG: Generic.77D
Panda: Trj/Genetic.gen
CrowdStrike: malicious_confidence_100% (D)
Qihoo-360: HEUR/QVM41.1.0000.Malware.Gen

Hashes

MD5 82c113ebbf068d7a937322168bceb4e8
SHA1 9b1ae7675da9c62702ffd1c4ce56683ad9f8f728
SHA256 abcdcbe1158f6f446855bb007b5973c0d0a9c425f5e8086499b2713f7af8afdd
SHA3 030b0f55cc91b8330d8a7e69ecad6751201bd998e05d92f0d511d819d181ddfb
SSDeep 98304:D3bobVkwiXFlJboUaQXK1XR0ZNSHm8GeRLfWFZzo:Lbeirfa1GZN+PhLIZ8
Imports Hash 23ee14b7b8bad73645664a22cfd7f754

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2016-Nov-01 09:22:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 10.0
SizeOfCode 0x14600
SizeOfInitializedData 0x366800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00006869 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x16000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x380000
SizeOfHeaders 0x400
Checksum 0x381b68
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 153c25a894558c86b486e20495de16f9
SHA1 3eea3f9c3aa324614c019cf46cbcb856b6a7b6f5
SHA256 d2eeab52fd5b0cf39503f5d697a20f2f3b8efe97d4eb9d3e2a5b7221cc6aff67
SHA3 061fdb2866c4bc30515418d3c8c258926b1da2f54a6edbe79074fc9fd2a419f0
VirtualSize 0x144cd
VirtualAddress 0x1000
SizeOfRawData 0x14600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.57123

.rdata

MD5 8ea5d734322df60fcdfe41193e6c3d59
SHA1 5e010578c0fb862c680195df62863736f98a3529
SHA256 1c8f840f57169c80230987ea147d55bfe7f828131ae312a510a30ccbdd605117
SHA3 f92e29f5384d496733511e6fd2a319b86fbadd6cdfcda56191e4a7b21ce81346
VirtualSize 0x5112
VirtualAddress 0x16000
SizeOfRawData 0x5200
PointerToRawData 0x14a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.89844

.data

MD5 2cef89c59f35f4fcafe95749186c0933
SHA1 a950abfbf7487b1574b3c9ba6d3f5ce4893dd900
SHA256 2c330216762c94c8210d40ff0331b88161a20af72f58ea98fdc2b300bf9d60ea
SHA3 9bda44a539520bed692e22ad773bccb5a24b64c9326e3ce366da18a68699236d
VirtualSize 0x3484
VirtualAddress 0x1c000
SizeOfRawData 0x1600
PointerToRawData 0x19c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.1127

.rsrc

MD5 4fb8f31a4c2c45c1f8b028908219e86a
SHA1 77df7a101450b90b7c41a4c14e90b358f2657485
SHA256 850f909879943566dbf4d5a92e672b645bc8332aa980808142081b30c62b8e38
SHA3 9aec67ac36f2be9fd2b009c502eb8c7bd740c81171242a03013abd933d522442
VirtualSize 0x35bf24
VirtualAddress 0x20000
SizeOfRawData 0x35c000
PointerToRawData 0x1b200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.86249

.reloc

MD5 55998d3b6241dc40b18743b0cdd28cca
SHA1 2da954cd291964be65091eba85d468553b1e667c
SHA256 7cb755cc024b5ff2f5400bb529d7bdfd789cb549462cd149ed7d2573e88202e5
SHA3 6191b419f0cad6d174685639f07bb9aa5fd4593e20969dea9370c49abd0940a9
VirtualSize 0x3f60
VirtualAddress 0x37c000
SizeOfRawData 0x4000
PointerToRawData 0x377200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.69317

Imports

KERNEL32.dll GetExitCodeProcess
GetModuleFileNameW
SizeofResource
LockResource
CloseHandle
WaitForSingleObject
CreateProcessW
LoadResource
GetTempPathW
FindResourceA
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
IsProcessorFeaturePresent
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
LoadLibraryW
GetProcessHeap
ADVAPI32.dll RegCloseKey
RegFlushKey
RegCreateKeyExW
RegSetValueExW
ole32.dll CoUninitialize
CoInitialize

Delayed Imports

IDB_BIN_INSTALL

Type INSTALLER
Language English - United States
Codepage Latin 1 / Western European
Size 0x313c00
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99365
Detected Filetype PE Executable
MD5 3107c28da15cc8db52ecaeb41e92fa27
SHA1 9498f3281c0b79a8f051ca9aeb0d6132dcf0ca0f
SHA256 e9318226bff1cf3225c26f0bde46ad08f2a745fe9de55153a41c7bf7eb194325
SHA3 f2a939852d0bfcbaa64dbdb9aabb43ea0952f2be8addd5c77efe6f8918d384ba

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.55719
MD5 45ee323ce43873307490c3794c814560
SHA1 a5ab033f792f86a0b12515f99d0a52422efb2a95
SHA256 b28cdfb367ce98d9a96c7ff9fe19af0f2985befcd083828039bf892367bd2959
SHA3 17b421076416f2d0d3cff4a02890539061f8457332766f65a4ec55b83dbe5a2a

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.99883
MD5 41f0453be5c5ba7beda7159cf5116e7b
SHA1 df5372c3b00e9421d8755ad46284356b8d91570f
SHA256 3c6ecb505d686fd6b52a9a7ce53af543b4cc8f9e6c9f8bb36fb0e5a8a10b24f8
SHA3 c4421562570223f4ec448f0df55a9dc58315bac7867ecaf0476c05348f169be6

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.1731
MD5 8e1f9dfb39e5a2c8a727f4066e3d55d2
SHA1 a7fd960c52f243b845c9e8dab117ca4ea7765db3
SHA256 32313d600df4354e7031682c696202cd249d3b60224d260d73aa4ca988f26e05
SHA3 7914226033be99cdc5fa1cb4424a54929275b9feca2635f33d62c3222c1abab4

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.19059
MD5 e674207f8267af19a2bfef20770a123e
SHA1 3b8b95ea78756c3807955e126e07d61b4191028a
SHA256 a16ac8cfa75422fa4fa05b0252f2e58040fddd1380488535965ac320ea7cde01
SHA3 f332a46904ce603a370063a4d29effbcd4006fa543e5ce5389d7ce312617af24

5

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31401
MD5 d1a4ef17cd92170630df50d841663a5d
SHA1 cdfd82f6e112a2224d5e118229be7125caf6245e
SHA256 aab411a3141e56bc242ed90d0dc9dc10b92a54f8990ab3038fc5e46fbad07dfc
SHA3 4659c13f5c21491fd6a8294d8b5eb16f46495d42894272491d089d66d37c3a70

6

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.68398
MD5 30c3e5306044bb310a9e99509246b786
SHA1 5de37c60a5d3f13079a2ecf5b673eeae859c026e
SHA256 377d0afd25039f3a4fbc7341c8afa42472e2f59898ae8ae0184e16b5ddd14afd
SHA3 47a5e6d6f0da31143f0d617b06c7d690683e5f0743ce76f2a46f600633acdb15

7

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.18086
MD5 bd327d7c67c24446c74a49b21b4b5ba5
SHA1 6df73441fb571765fa8cbbcb287d8ab0e9c30ec6
SHA256 9d35dc1f17f6ed09cfadb35fb70dc5c12cf053ad3c9a13a646b709ebab92aa94
SHA3 d75a99270cd8fd688608b6a3cb31e77b9b0edc57b7a64d6e4eb04ef488750715

IDI_ICON1

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71787
Detected Filetype Icon file
MD5 eee2def6081be6fc6c237a1035cd0d47
SHA1 8806faa001a31ea3b44f50dd48cc65beaeaf5980
SHA256 b4a86ff543995d1a1dcad86ec767539180bbe55d27b306186eb5fa4bc3d5872f
SHA3 293718c08c74df16bc3e220b2edcbf174192ba2080a5b914811bc9c27d661b57

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x31c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.38995
MD5 b239dad8c82afb611bc992bb0811b1b1
SHA1 69dba71117f00c1f739555ebd6c428e1123d62b9
SHA256 ea75a3c3d3a5ac3eb9f1af9929dd08bb4a0c3d73ab776cc9a8c4c09af5a2ce97
SHA3 e822373b5a73f65a2f93524ba4d11193eb6c374015eacb36148193cfa038135c

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x525
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27601
MD5 de157d6976c58b4344370299a42f1ce6
SHA1 c7a4336882f496d9541e449469b388fb303a1cd0
SHA256 ca38643ca48ef25db36c9dc27aae15a9c198df2bc55b6e96e9023f8eebf0bbc8
SHA3 6c62558602d6dd48ab30eb2224fe70a64bc2041b3415409448830839d97ff529

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 3.2.0.2
ProductVersion 3.2.0.2
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName PC Utilities Software Limited
FileDescription Keep your PC drivers up to date
FileVersion (#2) 3.2.0.2
InternalName Driver Pro
LegalCopyright PC Utilities Software Limited
OriginalFilename Driver Pro
ProductName Driver Pro v3.2
ProductVersion (#2) 3.2.0.2
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2016-Nov-01 09:22:02
Version 0.0
SizeofData 80
AddressOfRawData 0x19280
PointerToRawData 0x17c80
Referenced File O:\CPPwrapper_VS2010\Release_RS\optimizerpro_silent.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x41c490
SEHandlerTable 0x419b80
SEHandlerCount 27

RICH Header

XOR Key 0xb8e6ed41
Unmarked objects 0
ASM objects (VS2010 build 30319) 16
C++ objects (VS2010 build 30319) 53
C objects (VS2010 build 30319) 126
Imports (VS2008 SP1 build 30729) 9
Total imports 94
175 (VS2010 build 30319) 2
Resource objects (VS2010 build 30319) 1
Linker (VS2010 build 30319) 1

Errors

<-- -->