89677c9ee627a595a3f5f7386b26ee3c

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_EFI_APPLICATION
Compilation Date 2015-Jan-01 00:00:00

Plugin Output

Suspicious PEiD Signature: HQR data file
Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • exploit
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to Whirlpool
Uses constants related to AES
Uses constants related to Blowfish
Uses constants related to Twofish
Suspicious The PE is possibly packed. Unusual section name found: mods
The PE only has 0 import(s).
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 89677c9ee627a595a3f5f7386b26ee3c
SHA1 66ef4ecf4c215266eb7bdaa6229f89be21509ae6
SHA256 fcc097d8ecb069844b3d26daea36a7907fc1abddcdbb4e547113d37481749f3c
SHA3 b192a3acca3c05d9c4bb5b6553b9cff86c4b292919348a542fdf637f4aaab8ba
SSDeep 196608:xVGT1XvadeyliTd3HQNIm3BLdUk5LjgGFDSPnnAQeOQyW295QnYQM9WIEBBWGYL:bi1XQeeoANIm3BLdUk5LjgGFDSPnnAQ
Imports Hash d41d8cd98f00b204e9800998ecf8427e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2015-Jan-01 00:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 0.0
SizeOfCode 0x8200
SizeOfInitializedData 0xab0200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000400 (Section: .text)
BaseOfCode 0x400
BaseOfData 0x8600
ImageBase 0
SectionAlignment 0x200
FileAlignment 0x200
OperatingSystemVersion 0.0
ImageVersion 0.0
SubsystemVersion 0.0
Win32VersionValue 0
SizeOfImage 0xab9200
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_EFI_APPLICATION
SizeofStackReserve 0x10000
SizeofStackCommit 0x10000
SizeofHeapReserve 0x10000
SizeofHeapCommit 0x10000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 90125584721bcd75a2164de46c93adb8
SHA1 fc743bc64a058072d8a41035f71f02b045e7fd9f
SHA256 c3ce77ab03e4ffb251b93b6b7eb4cacbfb052cf27a8ee7a63c4352ac13a87459
SHA3 31af97b195c49e5aa8a74b6bc4bb30d29bc1a24d308f794e14a778518fa25f22
VirtualSize 0x8200
VirtualAddress 0x400
SizeOfRawData 0x8200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.56424

.data

MD5 17169dfd9347f22a1b1b70621bb66215
SHA1 abf216689927626b98570813238a4de5fc8237d2
SHA256 fd670b1483d02478cebca78719813397fd4b0bcb50540c848eb5d4e97a64e870
SHA3 8c2e043949107681771c39a1a3259f85d679551aeaf484a0530658fa9e8c22f5
VirtualSize 0x9e00
VirtualAddress 0x8600
SizeOfRawData 0x9e00
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.77577

mods

MD5 c33a227ea436d3a58f12e57a0087d464
SHA1 9273e32a04a1261587c4bc01789c2918f0cb12d6
SHA256 79ccd6086c424399bcf162a5c39f761d7090defea09937d4f89aad95fe5c4fce
SHA3 30828815440a3e192800ef3229ecd80332e16e2b55990c904b4e02bccae8e2f8
VirtualSize 0xaa6400
VirtualAddress 0x12400
SizeOfRawData 0xaa6400
PointerToRawData 0x12400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.66546

.reloc

MD5 7b78ff1b62ff54e18121075a145276c7
SHA1 67d95b803b6c517d4c10d1ecaab280b5293c8cf0
SHA256 66a34de4de90a26c91eeeb459aab0c672fccbe619fe80228b85600ddcd8c1332
SHA3 e82cc2f32001ee589fc8b89a6d1d9a070ff24d9fd1a0f6e2e0eaffe486ff3818
VirtualSize 0xa00
VirtualAddress 0xab8800
SizeOfRawData 0xa00
PointerToRawData 0xab8800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.99126

Imports

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

<-- -->