83f443c2b303b39ce8da3b66a9539d53

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2019-Aug-31 14:49:15
Detected languages English - United States
Debug artifacts C:\Users\zdarovablyat\Projects\Crackmes\lexXxus_crackme1\Release\lexXxus_crackme1.pdb

Plugin Output

Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • system
Suspicious VirusTotal score: 1/69 (Scanned on 2019-10-15 21:51:31) APEX: Malicious

Hashes

MD5 83f443c2b303b39ce8da3b66a9539d53
SHA1 01b26df5c6aab5e7ec5576598def044813342393
SHA256 36c3551d676e99aee53ebbc034841aec799f92901dbcc538bec6f2c07c3891a5
SHA3 d3416762fdb00e2de04fdf0cc1fb10ac50f97cccdbb06270be00b3349a068bdd
SSDeep 384:vk3Awx0UPpHwxremQfZn0RiYY9wto1wentEp/TgJbNDj55E1vWm5a2fYkr7pkf8:UZwQT/ntSM/oV5GS7pg8Y
Imports Hash 5373bf33ba2217cc2c770369bcfc0534

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2019-Aug-31 14:49:15
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x3200
SizeOfInitializedData 0x2600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000303D (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x5000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f3492ba480bda518ef0801e707a7a8fe
SHA1 947858746cfebe7ad126f9cd97f941b06e7a3803
SHA256 8e9a288ef550979eb109d220f1dd1dc2e51d42beab0160f9d5ff26913ab03b65
SHA3 908b308d2647954cb2d96346bc99af3626fdfa0747be74674dbe5b02025e800b
VirtualSize 0x30e0
VirtualAddress 0x1000
SizeOfRawData 0x3200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.9986

.rdata

MD5 f022246155459b26ca2701b2e56be368
SHA1 3080694aa3fd86bfffc99ef667fae46d9e4b25b6
SHA256 c3d3d545da7bae05cc2c3e556034d29524aec686a4c4a140b23a9ef926ea5970
SHA3 4e5345f0ccef0db027ca543ca1297b121f84c92ef76ad02d7c9624f0163705a2
VirtualSize 0x18b4
VirtualAddress 0x5000
SizeOfRawData 0x1a00
PointerToRawData 0x3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71568

.data

MD5 bc1007f5118581263a5c20882c9fe149
SHA1 b69f414e2479bf1257fdd06732e21e2b474702c9
SHA256 236b519ab872d497c2c1bf01e34acb11ee96262d70db8193a1e52aaeee5e5ec9
SHA3 8973801bee751fb318f506aa3a9b90124dd42fb87451d170df89d6f882e34c3e
VirtualSize 0x430
VirtualAddress 0x7000
SizeOfRawData 0x200
PointerToRawData 0x5000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.02253

.rsrc

MD5 004d0e678e525ffdfdb49f756c3148c6
SHA1 1118e9c2f4604b941d1c0463afa525395d86a754
SHA256 e42f4c332ad3da929ebeb2e30afff6fdb3dc348f16b47a31a7ee08b7e091bc48
SHA3 9e257ba83c0cde061588f85f85b71c5cee609ca3eceb7cab57495dba54837eb5
VirtualSize 0x1e0
VirtualAddress 0x8000
SizeOfRawData 0x200
PointerToRawData 0x5200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.69612

.reloc

MD5 133f0912ecae86123a77ebe6c2430a49
SHA1 41a23f6c00cfc6c0867ac7cb8a371db563b75151
SHA256 36a86142f2def9bffdf52f7d910e179ce79ccfc01320b8f4e9d4ab6f7c1e81d3
SHA3 84c6e54d84b18a15088571730c532b11f395a5b81b88781e8a3dbacb1d275c7f
VirtualSize 0x370
VirtualAddress 0x9000
SizeOfRawData 0x400
PointerToRawData 0x5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.02057

Imports

MSVCP140.dll ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
??Bid@locale@std@@QAEIXZ
?_Xlength_error@std@@YAXPBD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QAE@H@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1_Lockit@std@@QAE@XZ
VCRUNTIME140.dll memset
memcpy
_except_handler4_common
memmove
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0.dll _get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_initterm
_controlfp_s
terminate
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
__p___argv
__p___argc
_cexit
system
_exit
_set_app_type
exit
_crt_atexit
_initterm_e
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
api-ms-win-crt-string-l1-1-0.dll strlen
api-ms-win-crt-heap-l1-1-0.dll malloc
free
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
KERNEL32.dll UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2019-Aug-31 14:49:15
Version 0.0
SizeofData 110
AddressOfRawData 0x5538
PointerToRawData 0x3b38
Referenced File C:\Users\zdarovablyat\Projects\Crackmes\lexXxus_crackme1\Release\lexXxus_crackme1.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2019-Aug-31 14:49:15
Version 0.0
SizeofData 20
AddressOfRawData 0x55a8
PointerToRawData 0x3ba8

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2019-Aug-31 14:49:15
Version 0.0
SizeofData 708
AddressOfRawData 0x55bc
PointerToRawData 0x3bbc

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2019-Aug-31 14:49:15
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0xa4
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x407008
SEHandlerTable 0x405500
SEHandlerCount 14

RICH Header

XOR Key 0x58d4d7a0
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 12
C objects (26504) 12
ASM objects (26504) 1
C++ objects (26504) 26
Imports (26504) 5
Imports (26715) 2
Total imports 86
265 (VS2019 Update 2 (16.2) compiler 27905) 3
Resource objects (VS2019 Update 2 (16.2) compiler 27905) 1
Linker (VS2019 Update 2 (16.2) compiler 27905) 1

Errors

<-- -->