8abdc20f619641e29aa9ad2b999a0dcc

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages English - United States
Russian - Russia
CompanyName PainteR
FileDescription ProxyEmu
FileVersion 0.9.2.0
InternalName ProxyEmu
OriginalFilename emuext.exe
LegalCopyright painter
ProductName ProxyEmu
ProductVersion 0.9.2.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious PEiD Signature: PolyEnE 0.01+ by Lennart Hedlund
Info Interesting strings found in the binary: Contains domain names:
  • adobe.com
  • helpx.adobe.com
  • https://helpx.adobe.com
  • https://helpx.adobe.com/creative-cloud/packager/creative-cloud-licensing-identifiers.html
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE is possibly packed. Unusual section name found: .pr0
Section .pr0 is both writable and executable.
Unusual section name found: .pr1
Section .pr1 is both writable and executable.
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
Functions which can be used for anti-debugging purposes:
  • FindWindowA
  • CreateToolhelp32Snapshot
Code injection capabilities:
  • VirtualAlloc
  • WriteProcessMemory
  • VirtualAllocEx
  • OpenProcess
Code injection capabilities (PowerLoader):
  • GetWindowLongA
  • FindWindowA
Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
Can create temporary files:
  • GetTempPathA
  • CreateFileA
Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • CallNextHookEx
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualAllocEx
  • VirtualProtect
Manipulates other processes:
  • WriteProcessMemory
  • ReadProcessMemory
  • OpenProcess
Can take screenshots:
  • CreateCompatibleDC
  • BitBlt
  • GetDCEx
  • GetDC
  • FindWindowA
Reads the contents of the clipboard:
  • GetClipboardData
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2016-Nov-04 18:46:22
Malicious VirusTotal score: 50/72 (Scanned on 2020-04-25 16:42:29) MicroWorld-eScan: Application.Hacktool.YH
CAT-QuickHeal: Adware.Win32
McAfee: HTool-Crack
Cylance: Unsafe
Sangfor: Malware
K7AntiVirus: Unwanted-Program ( 004d38111 )
Alibaba: HackTool:Win32/Keygen.190419
K7GW: Unwanted-Program ( 004d38111 )
Cybereason: malicious.f61964
Invincea: heuristic
Cyren: W32/Trojan.PLPH-6178
Symantec: PUA.Keygen
ESET-NOD32: a variant of Win32/HackTool.Crack.FS potentially unsafe
APEX: Malicious
Paloalto: generic.ml
ClamAV: Win.Malware.Agent-6370066-0
BitDefender: Application.Hacktool.YH
Avast: FileRepMalware [PUP]
Ad-Aware: Application.Hacktool.YH
Sophos: Generic PUA MK (PUA)
Comodo: ApplicUnwnt@#2u9oe899fvalr
VIPRE: Trojan.Win32.Generic!BT
TrendMicro: CRCK_PATCH
McAfee-GW-Edition: BehavesLike.Win32.Generic.vc
FireEye: Generic.mg.8abdc20f619641e2
SentinelOne: DFI - Malicious PE
Jiangmin: Trojan.Generic.bdaap
Webroot: W32.Riskware.Patcher
eGambit: Unsafe.AI_Score_99%
Antiy-AVL: Trojan/Win32.TGeneric
Microsoft: HackTool:Win32/Patcher
Endgame: malicious (high confidence)
Arcabit: Application.Hacktool.YH
AegisLab: Riskware.Win32.Crack.1!c
GData: Application.Hacktool.YH
AhnLab-V3: Unwanted/Win32.KeyGen.R268822
Acronis: suspicious
ALYac: Misc.Keygen
MAX: malware (ai score=100)
Malwarebytes: CrackTool.Agent
Zoner: Trojan.Win32.48198
TrendMicro-HouseCall: CRCK_PATCH
Rising: HackTool.Patcher!8.2DD (CLOUD)
Yandex: PUP.Crack!
Ikarus: not-a-virus:Crack.Adobe
MaxSecure: Trojan.Basine.A.Crpt
Fortinet: Riskware/HackTool_Crack_FS
BitDefenderTheta: Gen:NN.ZelphiF.34106.zQ0@a8YkUjdi
AVG: FileRepMalware [PUP]
CrowdStrike: win/malicious_confidence_100% (W)

Hashes

MD5 8abdc20f619641e29aa9ad2b999a0dcc
SHA1 caad125358d2ae6d217e74cfcd175ac81c43c729
SHA256 cdc95d0113a2af05c2e70fab23f6c218ae583ebcb47077dd5b705a476f9d6b96
SHA3 cae01a827cc46ff789c01068e080152164bbb04962ff57b0ad4f2c4ce2fac3bf
SSDeep 49152:+kLvWlT+7CZ1k+1T0RSkXDE+QO6oP4DQ4E7U+:+kCZ1bad4+QOJgDQI
Imports Hash f9b971868e29335c16ceaa707224081b

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 10
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x113a00
SizeOfInitializedData 0x83400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0024723F (Section: .pr1)
BaseOfCode 0x1000
BaseOfData 0x115000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.0
ImageVersion 0.0
SubsystemVersion 5.0
Win32VersionValue 0
SizeOfImage 0x26b000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 29de39ddc84d3e785ebfdccbd6faf7e6
SHA1 199d0121f0ab2107605db6f166628057b0c471d5
SHA256 5650288a9b4fd10c94c845085bec26f333e991ce767add60d98f2210a182d7d6
SHA3 da37558fbf8e452c3f346f1f25efedbb116dd38869925f566f6cc8de914a5732
VirtualSize 0x113900
VirtualAddress 0x1000
SizeOfRawData 0x113a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.52752

DATA

MD5 9a741c4d302edf27a7516dcf6aeb8970
SHA1 04f2058d2d3a0ce0bf9bcf8c3a619c75f572bb4e
SHA256 2184b9411d4803aa647f30e1df4e2a2c17d2e4a360c773ca1af60e872e04a957
SHA3 f5d0e3b0e0cf07373883cfa48840abdaa434ea8a5b4e7051b1a99540d1131d28
VirtualSize 0x15b8c
VirtualAddress 0x115000
SizeOfRawData 0x15c00
PointerToRawData 0x113e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.14643

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x11bd
VirtualAddress 0x12b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 bf49aec44e8bdd743d3a48bacbd04b99
SHA1 e8eb8948dce3b4a9594f7cc3791767e62fa07ad9
SHA256 e0e378a13b45ef5fb7a6f7bd134f4a461ec0251d4a3c127fcd2d821766783ffc
SHA3 5b931cce85479954cb0e75323886c9c2939126e864716d71de427a85e6a0fd6e
VirtualSize 0x29b4
VirtualAddress 0x12d000
SizeOfRawData 0x2a00
PointerToRawData 0x129a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.09216

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x10
VirtualAddress 0x130000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 dd5b4ecd178e5866934d5e7368ca8415
SHA1 15ee01b6d328c1557fdcb4c4ba94f946033c41d9
SHA256 a69975fe7d708de59fcb3a21a3628e5315ab548565b2221a0b05d125618777e3
SHA3 fb6c1b59ff5a26e4dd1577b4eeec1c0c000a3e7310e059a207f385b5626c36f0
VirtualSize 0x18
VirtualAddress 0x131000
SizeOfRawData 0x200
PointerToRawData 0x12c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 0.164765

.pr0

MD5 cf4188ce38e74a5ee61b1fe69fa88776
SHA1 0aa0031904b77663da61367818d1c5cc8257ca24
SHA256 1234e97d7215d4b96ad682151f3c2e63322d271f9eb4b5cac45508c2158ab8a4
SHA3 cb07b7c61bb0ac516ad07982fe2e517d547c01c388ae7387c125f97099179578
VirtualSize 0x113736
VirtualAddress 0x132000
SizeOfRawData 0x113800
PointerToRawData 0x12c600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.90531

.pr1

MD5 cc12fadd0ff200d66b02caa78aa0d5b3
SHA1 1c43d990fdd8f095b194759514873fc058ac617a
SHA256 440bfa3a8ea0187c5ece127826babe31d3aa0f1aad92846fe49d63030748351c
SHA3 4c5105cfca08ec2a60956b790fe3b2680dc343bdfdb43ff6764a9bee0d91638b
VirtualSize 0xed59
VirtualAddress 0x246000
SizeOfRawData 0xee00
PointerToRawData 0x23fe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.21496

.reloc

MD5 8f2716d046661b928f420fb6b2561cb3
SHA1 bfb89cdfd00c8b2aa1182bd83ca50be0d822f4a3
SHA256 916bb5b9a72d1836582121267a83e900427437a72f2fa1fc24cb83da289a3160
SHA3 35f7c523aa49cdec288f557b18bbebe549c890d9c3d4811e8690109b81c7b6e0
VirtualSize 0xf400
VirtualAddress 0x255000
SizeOfRawData 0xf400
PointerToRawData 0x24ec00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 6.67919

.rsrc

MD5 d6ab8b4b7dbe61a34789c0816b6d3378
SHA1 e73197c64aac11985c2cfe97c75ab0ad129bbda2
SHA256 5d9eae9695e777c5b0fe7bc58741ec33c9d0e8a85f1b67fa37341602d4c3fac7
SHA3 ad53c65363c55f3f43f415633ff2e4ee091d890a95cc061037d20fdf5f082612
VirtualSize 0x5e92
VirtualAddress 0x265000
SizeOfRawData 0x6000
PointerToRawData 0x25e000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 6.01664

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll (#3) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
version.dll VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32.dll UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixelV
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetViewportOrgEx
GetTextMetricsA
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapDimensionEx
GetBitmapBits
GdiFlush
ExtTextOutA
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePen
CreatePalette
CreateHalftonePalette
CreateFontIndirectW
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
CombineRgn
BitBlt
user32.dll (#2) GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
kernel32.dll (#4) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
oleaut32.dll (#2) SysFreeString
SysReAllocStringLen
SysAllocStringLen
ole32.dll OleUninitialize
OleInitialize
CoUninitialize
CoInitialize
oleaut32.dll (#3) SysFreeString
SysReAllocStringLen
SysAllocStringLen
comctl32.dll ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
shell32.dll ShellExecuteA
SHGetFileInfoA
shell32.dll (#2) ShellExecuteA
SHGetFileInfoA
comdlg32.dll GetOpenFileNameA
kernel32.dll (#5) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll (#3) GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
kernel32.dll (#6) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
kernel32.dll (#7) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x19b4
TimeDateStamp 2016-Nov-04 18:46:22
Entropy 7.88566
Detected Filetype PNG graphic file
MD5 0edbdaa8f090e7e9f831f03279b06209
SHA1 966fe0a9284c7da2bed1e3203069559778d607db
SHA256 50d47edba016d286611c4de4aa28592df5f80756e01bbb6688832630a3f90b86
SHA3 d6f0f91d651c075743160e72f03f3ede904c4bc39f1365a9b669d968daa77fdf

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 2016-Nov-04 18:46:22
Entropy 4.28302
MD5 369b539c1b6d2545fc55b1f6fe13627e
SHA1 f11300f8608cdc1518093c3d9e61abec4bcd7b12
SHA256 d7f1bc7c27c6d3a8783be86f8ac9d3304076872f64ab633d1b7afece6b3b82f3
SHA3 3eeec133434aa5a3e5530b8a8c20e16982b673144fd46bc1aad7363d98b2398f

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 2016-Nov-04 18:46:22
Entropy 4.36835
MD5 068921808d28752d6b2fd8f2924bdbff
SHA1 b8e0b31cba8c93a74b7a7e623849948a0f13ce84
SHA256 6a65d4c13fe5868f1a8865c75b992feea55a7b2a5b5840650e6d7aad88cfdfd0
SHA3 24ffc230ebe0022fa25137ccbc42e67a502ebea81812bf8931cfbe8f3a292d9f

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 2016-Nov-04 18:46:22
Entropy 4.39554
MD5 868523ff8c30ab3568d29a64ecb9a159
SHA1 e1fc78042ae699e46da9896c931bf8ede0ccd5d0
SHA256 0a8c3eb2a617fda6425f52b3d4c4da38988e588fad2a5051af0f0027f511f8d8
SHA3 29247abf80943eec5da6c927c88cc35f6e042d77ac4ba9cc2aa7ea66a7014a98

MAINICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 2016-Nov-04 18:46:22
Entropy 2.44608
Detected Filetype Icon file
MD5 d9e3948c0d8a92624e056377a09f7e89
SHA1 38f63391d1e566064551cfb3ef6037c8d9523343
SHA256 dcc4af09b581fc120ee178f5ff17100f5c9db70aded72b614e8c232b231af672
SHA3 d57d09f94b9b58e0ae44578ad2890d2072c05ee5e14db1aac2f61360e109fe55

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x288
TimeDateStamp 2016-Nov-04 18:46:22
Entropy 3.27105
MD5 566e1d9a4fb5b5599f71a69b13336689
SHA1 0034840770e316062baea72c92f486a8a687b352
SHA256 7656cc1c8976b3128a8be7c8e86d35f066df74d71f2903e541cd2cfa0198582c
SHA3 16823395fdfaf67c9c84b27e148552c69b8614048378af31a02d29c708b85366

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x58a
TimeDateStamp 2016-Nov-04 18:46:22
Entropy 5.27457
MD5 b6a76cef16bf76882df1838e5e407059
SHA1 df31b4ecb6a473d9c6cdc88851bb76684488f865
SHA256 25b617578449687059bbc329fb16588a7d847411a7df0b08583d6b7cbd0b7c96
SHA3 94930cdd492c9387a01a869ed79b89764636ced9dee6c726990c79e8b24ec0c0

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.9.2.0
ProductVersion 0.9.2.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language Russian - Russia
CompanyName PainteR
FileDescription ProxyEmu
FileVersion (#2) 0.9.2.0
InternalName ProxyEmu
OriginalFilename emuext.exe
LegalCopyright painter
ProductName ProxyEmu
ProductVersion (#2) 0.9.2.0
Resource LangID English - United States

TLS Callbacks

StartAddressOfRawData 0x530000
EndAddressOfRawData 0x530010
AddressOfIndex 0x51509c
AddressOfCallbacks 0x531010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section BSS has a size of 0! [*] Warning: Section .tls has a size of 0!