Manalyzer :: 928f9bcb4815fd2f7610274f2253880fc6b0e0859d71a7fd497462841557cec6

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2011-Nov-08 23:03:23
Detected languages	English - United States

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++` `Microsoft Visual C++ v6.0`
Suspicious	PEiD Signature:	`UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser` `UPX v2.0 -> Markus, Laszlo & Reiser (h)` `UPX -> www.upx.sourceforge.net` `UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser`
Suspicious	The PE is possibly packed.	`Unusual section name found: LOL0` `Section LOL0 is both writable and executable.` `Unusual section name found: LOL1` `Section LOL1 is both writable and executable.` `Unusual section name found: .SCY` `Section .SCY is both writable and executable.`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: LoadLibraryA GetProcAddress` `Has Internet access capabilities: InternetOpenA InternetOpenUrlA InternetCloseHandle InternetReadFile` `Leverages the raw socket API to access the Internet: ws2_32.dll`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`6941b39af3f012ba66d4449bdeb5b46c` 🔍
SHA1	`008dd96cc57c5bbb8dd1e8955d3af54dcb5267ed` 🔍
SHA256	`928f9bcb4815fd2f7610274f2253880fc6b0e0859d71a7fd497462841557cec6` 🔍
SHA3	`dd013792d18eecc0ac4514bf59bfb69459fc2227839b3e0dbca4f9c92c3c98f0` 🔍
SSDeep	`384:+aL2TOjSMsXu0Pip5Na32mlRfTlyKU+jH9jogzyPO8uAgVIzVtmdpfe1nk6EtO4:++0OjKxoNa5b9cg+G8hzVtKoOXjQgk` 🔍
Imports Hash	`65813ca46ddf74d9e7238e8cd8267199` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`4`
TimeDateStamp	2011-Nov-08 23:03:23
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x4000`
SizeOfInitializedData	`0x1000`
SizeOfUninitializedData	`0x7000`
AddressOfEntryPoint	`0x00001681 (Section: LOL0)`
BaseOfCode	`0x8000`
BaseOfData	`0xc000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0xe000`
SizeOfHeaders	`0x400`
Checksum	`0x109ab`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

LOL0

MD5	`8f9e38a6cadb92bbd2a26e5dbb15217d 🔍`
SHA1	`b4dd9a390f04dcaa5a472e66100e9b326da5afad 🔍`
SHA256	`4aea00b362913c7d035cb3c3170a34f1d68a9f2a8fef51bc06adc0f5d760e4f0 🔍`
SHA3	`c917dfdc60bcedc8e2fea753c6024e6a9ef8a2f0831c230936857a7877c4ce62 🔍`
VirtualSize	`0x7000`
VirtualAddress	`0x1000`
SizeOfRawData	`0x5a00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.79702`

LOL1

MD5	`767e172442b8e514eed14c3f3d24a432 🔍`
SHA1	`8a29dec707ca17fe59cb4168fd04ffae9309ecf9 🔍`
SHA256	`55c3fd933a313b5917a2cbe05954c4f541ea47ef8c0a58963c3f4569ac2db971 🔍`
SHA3	`5890e2b0ad0e417afd799f2fe467d1b3042351d702af522136a8c9c9d02dc99d 🔍`
VirtualSize	`0x4000`
VirtualAddress	`0x8000`
SizeOfRawData	`0x3200`
PointerToRawData	`0x5e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`5.78978`

.rsrc

MD5	`45a18c9b4b5fd0b3d6c269e06466c707 🔍`
SHA1	`deeaa1df5ab9e0b18ec67eab7b8ad6e4a3a5eaf2 🔍`
SHA256	`dda2231d8c40a22f50de26f9ca20e73f641762eb6206722be250427921d5284c 🔍`
SHA3	`02115da390180d28001496160f2086b8391b9df522f176bb1d1204cb78cbada1 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0xc000`
SizeOfRawData	`0x200`
PointerToRawData	`0x9000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.86792`

.SCY

MD5	`cce6d1ee191ea7a0df0064a3a84d2372 🔍`
SHA1	`d03cf298ccaeebfe1780afac3c60f2e3eaa8cae7 🔍`
SHA256	`e61c5e023b9e1a62fa911a0a708b39016c487279450ad4c70e54f261132a05fa 🔍`
SHA3	`8c784beced49ae5d837ce4ee045548d8389d803bca51bfeb52ed04fcb0d7f7d5 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0xd000`
SizeOfRawData	`0x600`
PointerToRawData	`0x9200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.52597`

Imports

kernel32.dll	`LockResource` `LoadResource` `GlobalAlloc` `SizeofResource` `FindResourceA` `GetModuleHandleA` `Sleep` `GetStringTypeW` `GetStringTypeA` `LCMapStringW` `LCMapStringA` `MultiByteToWideChar` `FlushFileBuffers` `SetStdHandle` `LoadLibraryA` `GetProcAddress` `GetCommandLineA` `GetVersion` `ExitProcess` `TerminateProcess` `GetCurrentProcess` `UnhandledExceptionFilter` `GetModuleFileNameA` `FreeEnvironmentStringsA` `FreeEnvironmentStringsW` `WideCharToMultiByte` `GetEnvironmentStrings` `GetEnvironmentStringsW` `SetHandleCount` `GetStdHandle` `GetFileType` `GetStartupInfoA` `HeapDestroy` `HeapCreate` `VirtualFree` `HeapFree` `RtlUnwind` `WriteFile` `GetLastError` `SetFilePointer` `HeapAlloc` `GetCPInfo` `GetACP` `GetOEMCP` `VirtualAlloc` `HeapReAlloc` `CloseHandle`
wininet.dll	`InternetOpenA` `InternetOpenUrlA` `InternetCloseHandle` `InternetReadFile`
ws2_32.dll	`WSACleanup` `gethostname` `WSAStartup`

Delayed Imports

101

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0x20`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.65564`
MD5	`8b37145c184cd91a05a9f1be8dbc9cf9 🔍`
SHA1	`6d54c2a67753eeac8986ef0aff9de328fb3ff51f 🔍`
SHA256	`32b1177c11f0f714b162d1de807fad0f54be7b641f4fc2aabadc16af660d8faf 🔍`
SHA3	`96cba27917ad748f794663ae602be3bad566ea24e3937e5791f5563cf031e958 🔍`

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.