88394fa523825b855f25427fde85af84

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2007-Apr-28 08:11:59
Detected languages English - United States
Debug artifacts c:\Dev\Xbox360\Xplorer360\Original\Release\Xplorer360.pdb
FileDescription Xbox 360 File Explorer
FileVersion 0, 10, 0, 1
InternalName Xplorer360
LegalCopyright Copyright (C) 2006 roofus
OriginalFilename Xplorer360.exe
ProductName Xplorer360
ProductVersion 0, 10, 0, 1

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ v7.1 EXE
Microsoft Visual Basic v5.0 - v6.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryA
Possibly launches other programs:
  • ShellExecuteA
Can create temporary files:
  • CreateFileA
  • GetTempPathA
Suspicious VirusTotal score: 2/64 (Scanned on 2018-04-09 02:14:25) Bkav: W32.eHeur.Malware14
ClamAV: Win.Worm.Bybz-204

Hashes

MD5 88394fa523825b855f25427fde85af84
SHA1 41601ce45440ac550c65437d1c68a0ddf0d1f38b
SHA256 a8d512910cf1fb0fca70e38f543836f4e3ae6c8198988811317642f9ea90f4c1
SHA3 eee8f43bb0781c0ff8039c28f74dba47ec1a346a8bdcf956cbf96b8fa7af8eab
SSDeep 3072:hHk72nIk6XVMx2k87/f2iQGA1C+bfHK4:dWk6ek172iQGA1C+jK
Imports Hash c26b858e8079c143fb27665ad7e46977

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2007-Apr-28 08:11:59
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 7.0
SizeOfCode 0xa000
SizeOfInitializedData 0x11000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00009C80 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xb000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x1c000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f70b559b622cd6a0275f979daf356be7
SHA1 34474cc1315072bfc6bcd5f603835e12514f3818
SHA256 3c40c3c41a17408ee61cf41508121104089ba7b1fd854e6793639d113e405f86
SHA3 523532c3c7436b557a816963ffad1fe745bbc165c6ad8e616c233aeac6612133
VirtualSize 0x9f7e
VirtualAddress 0x1000
SizeOfRawData 0xa000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.36405

.rdata

MD5 ea273ac1dbde89b69dcbdf40b795a66d
SHA1 26b9f8f7e17a1fa95d684101bfd3c444c9692f24
SHA256 aa529d7eebc53b0985e00e393e0140c81faa69da9ab7c5d7cdb416d832200909
SHA3 9d40b2e0706817797df33403f0797cd2323c0f2527650474a7e6915fc730199e
VirtualSize 0x34f2
VirtualAddress 0xb000
SizeOfRawData 0x4000
PointerToRawData 0xb000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.8209

.data

MD5 5cc987916644f83da12d2b0924035fdb
SHA1 622ceca5e8430151fc3a9b128b06ea307f66e696
SHA256 ed55994adbe82ecb5b635a55a0a9623301935c824fb5535447da87c3c63c7525
SHA3 bbf7a30d5ea03df6b41a99492a8e0d1f6173a7b727128e483dff8f2627603726
VirtualSize 0x7b0
VirtualAddress 0xf000
SizeOfRawData 0x1000
PointerToRawData 0xf000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.430593

.rsrc

MD5 d93e0c27570f31871b4a402e46cd9fba
SHA1 e4981c3c43fec06782520a9eef8d6fa108082e43
SHA256 9d81b36beccf48804e2a7e5f12d6f4c39deb501b9b935c2d72902df351cc85fd
SHA3 766a8dfea42902e56677fd28315f8aaa3e17395c04302e625b59923c43613055
VirtualSize 0xbc98
VirtualAddress 0x10000
SizeOfRawData 0xc000
PointerToRawData 0x10000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.01806

Imports

SHELL32.dll SHFileOperationA
DragQueryFileA
ShellExecuteA
SHGetPathFromIDListA
SHGetFileInfoA
SHBrowseForFolderA
urlmon.dll CopyStgMedium
SETUPAPI.dll SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
KERNEL32.dll GetStartupInfoA
ExitProcess
RaiseException
GetVersionExA
DebugBreak
QueryPerformanceCounter
GetTickCount
CreateFileA
GetLogicalDrives
GlobalAlloc
CreateDirectoryA
SetCurrentDirectoryA
GlobalFree
DeviceIoControl
GetCurrentDirectoryA
CloseHandle
GetTempPathA
GetFileSize
WaitForSingleObject
SetEvent
WriteFile
CreateEventA
ReadFile
GetOverlappedResult
FindFirstFileA
GetLastError
ResetEvent
FindNextFileA
GetFileAttributesA
CreateThread
GetModuleHandleW
LoadLibraryW
GetFileAttributesW
GetModuleFileNameW
SetLastError
GetProcAddress
LoadLibraryA
GetModuleHandleA
OutputDebugStringA
GetVersion
lstrlenA
GlobalLock
GlobalUnlock
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CancelIo
GetCurrentThreadId
GetCurrentProcessId
FreeLibrary
GetProcessHeap
HeapFree
GetCurrentProcess
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapAlloc
USER32.dll PeekMessageA
MessageBoxA
SetTimer
GetDlgCtrlID
LoadCursorA
CallWindowProcA
GetSysColorBrush
EndDialog
GetDlgItem
SetWindowLongA
SetPropA
RegisterClipboardFormatA
GetCursorPos
PostQuitMessage
SetCapture
GetKeyState
GetFocus
LoadIconA
wsprintfA
GetClientRect
CheckMenuRadioItem
EnableMenuItem
DefWindowProcA
ShowWindow
ReleaseCapture
RegisterClassA
MoveWindow
GetMessageA
TranslateMessage
ChildWindowFromPoint
DispatchMessageA
SetWindowTextA
UpdateWindow
DialogBoxParamA
SetDlgItemTextA
ScreenToClient
TrackPopupMenu
GetSubMenu
GetMenu
GetWindowTextA
GetWindowLongA
CreateWindowExA
MsgWaitForMultipleObjectsEx
SetCursor
GetPropA
SendMessageA
GDI32.dll SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
SelectObject
GetObjectA
comdlg32.dll GetOpenFileNameA
GetSaveFileNameA
ole32.dll RevokeDragDrop
OleInitialize
OleUninitialize
ReleaseStgMedium
CoCreateInstance
DoDragDrop
RegisterDragDrop
MSVCR71.dll _getcwd
_mkdir
time
strncmp
strlen
sprintf
strcat
_chdir
_itoa
_controlfp
?terminate@@YAXXZ
__security_error_handler
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
vsprintf
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
_snprintf
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memcmp
strcmp
strncpy
_stat
free
memcpy
strcpy
_stricmp
localtime
memset

Delayed Imports

1

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
Entropy 2.47861
MD5 36530f7f9903bee71ae977a6f6027dd6
SHA1 5121aae2bf52187c8c30abe8ef7207cf3591b5f8
SHA256 b3e2af1f1977627c6387856926d10a97f14ff775162ff723f26147de9171d3aa
SHA3 f50156a77d637f76d6dd2574305a64aab432a6fdcf3398773b135e528e253698

2

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0xb4
Entropy 2.62373
MD5 2fa1e5b27780f275780c15bfff7aa5e0
SHA1 f17c3b96d73a56f20d809116da8ffb8aa116ce77
SHA256 b1a3084998113957e42273ce24371f383e2dd589beb9e4d52644ae38891eefc9
SHA3 24a4bafb035386f926a044ac20e187a151aa91f04693894f6a371d89d77377ea

111

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x9c6a
Entropy 6.06626
MD5 64343750740b367a80eb2ad8a89ef70d
SHA1 8c7a02b7ae370c4dd9b9cccf6a7c0a45faf6c9f0
SHA256 4d6fa6a26adc2e71ae1e14e762612deccc70cd008f3b8d97df3385630bd271cc
SHA3 13cbe9b7f73ab0768f87db38ef8e587c59cbc5fe98a0d81a28c4f14446507d48
Preview

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
Entropy 6.13196
MD5 248333bdd0b120e5a25f52a369d39ddf
SHA1 7e7ba39a1f1284a643317829e3ed8e4d33e78036
SHA256 a0f359f9384c64403164ae5aebd479bb3bdfb2d7fac250ba5b0692a1e3639613
SHA3 b99f405baf893ca6839614672f16055d82d95ed33700d05656f8482c67e9f401

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
Entropy 5.99
MD5 ba354d7480b4a0341c0097e38ce309ef
SHA1 4ebf8b979ea667e92eb62d7159fbffef349bcd1b
SHA256 627009377ed08919df3ea9ca9854f6af63959bf00579e915b22e36853b1e7761
SHA3 4280d461847d73e7cc44971a5950829dc9b63558dab4c7f9d4a956f9f6c86049

101

Type RT_MENU
Language English - United States
Codepage UNKNOWN
Size 0x2a4
Entropy 3.28283
MD5 30e106cf91722c7a5802b4c68f9fdbda
SHA1 12e5601bfe25835ab6e08e126e2e185599b32cff
SHA256 602ff950049b031dac3256bce77dbc2263cb109ab832a51aa4f86403874d285f
SHA3 91f325679212248bf4f491dec2419a6bbdf9d5342fbad7039ac765dff0fc9f60

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x1a2
Entropy 3.32274
MD5 c7d22f4a23e7b660422fc8d0ad824db5
SHA1 2caac0a8a9b246975d24a7885c6c86888fb10531
SHA256 9c1938d1431db832726a231fc8118f0e83a48027a172bfcd9809987aad13a7da
SHA3 bbc7ca5c2d68cfb539393f27584252347935ec086b2af0225078313b5e8266e1

112

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x128
Entropy 3.16692
MD5 ba73a5002a4976d9dea1b382370c1db0
SHA1 fc0db6885eac7572a868b774f9996d8ddf17d0c3
SHA256 33903acfe49230fecdf84150bc56aa054f1820f4cb741a56e9b6d0f00374e7cc
SHA3 45c00c45e1ac4908a34a83dccccdae5aef70e0763017e691e024c15006a4feb4

127

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x180
Entropy 3.16075
MD5 c83725b1a17ffdd73acd9f56df1479e9
SHA1 b5c3872c451649d5693d27d2a8c0ab9ac6ef3080
SHA256 efc060fa98cb243aa4188517805a7990754eebec260514cd6a6525fd3a01d2cf
SHA3 3b05e3675deed970b21e28fac7fbc2ff4bc916645904ec0c05a90c0412e3d37e

104

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x22
Entropy 2.05878
Detected Filetype Cursor file
MD5 7e68da438d06972412341d26a0b154e0
SHA1 2e8b4399fad4b323487c836ad0ad8b3042ba877d
SHA256 1ae3e871bb24efadc5c3ed9b87b902421883b191abb09c3d1033e38d9e538d4b
SHA3 7f3d31e2383eeaea12d4c290d72d0642cdbaa2421dfe3de1090e091bf6becfc5

110

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
Entropy 2.48251
Detected Filetype Icon file
MD5 d754cf71b6437880ac3e9934f6c0bd53
SHA1 e2c2d50c621da9b3dd766dee98950140d87394a2
SHA256 6d11e578cc598f327e8fd1eb6b0b30275170d6dc833d0c945754a797e6fadf1f
SHA3 79e44bc929305611d915586a1574dafd37bc1d8c690e0fd21e8f7a3763803425

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2b8
Entropy 3.36196
MD5 e7024082a1855758748bf2ed725b4496
SHA1 b73e8146bb53218819d0a18112da2597e04bfd0a
SHA256 e225b3f4529d13fffe37290c329b33e4587197a7ef8b87f3d49fe8bacb72b277
SHA3 3f6a90c0008faee3f124705ede80a5372d173a41d51b17f5421b46830bf193f2

2 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x2c5
Entropy 4.88748
MD5 9b9661ccead44068668d4ddfaf1818aa
SHA1 77a4a811c98aa874841458fad084675343defbaf
SHA256 95806a900f2994907daac91239e6a5c5404532d519e646c440bf782705f1ebbb
SHA3 88d321ec2de8b6edde97672485a278ebd7f0cf103930fbde8a4062f2b7d1c2fe

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.10.0.1
ProductVersion 0.10.0.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription Xbox 360 File Explorer
FileVersion (#2) 0, 10, 0, 1
InternalName Xplorer360
LegalCopyright Copyright (C) 2006 roofus
OriginalFilename Xplorer360.exe
ProductName Xplorer360
ProductVersion (#2) 0, 10, 0, 1
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2007-Apr-28 08:11:59
Version 0.0
SizeofData 82
AddressOfRawData 0xd470
PointerToRawData 0xd470
Referenced File c:\Dev\Xbox360\Xplorer360\Original\Release\Xplorer360.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x40f040
SEHandlerTable 0x40d4d0
SEHandlerCount 6

RICH Header

XOR Key 0xd7b93e77
Unmarked objects 0
105 (2067) 5
Imports (VS2003 (.NET) build 3077) 2
ASM objects (VS2003 (.NET) build 3077) 7
C objects (VS2003 (.NET) build 3077) 15
C++ objects (VS2003 (.NET) build 3077) 11
Total imports 175
Imports (VS2003 (.NET) build 4035) 17
C objects (VS2003 (.NET) build 4035) 4
100 (VS2003 (.NET) build 3077) 16
94 (VS2003 (.NET) build 3052) 1
Linker (VS2003 (.NET) build 3077) 1

Errors