94eb3de6900dfa5c1165cfe416096a72
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2021-Apr-10 08:04:04 |
| Detected languages |
English - United Kingdom
English - United States |
| CompanyName | Zhorn Software |
| FileDescription | Caffeine |
| FileVersion | 1, 9, 7, 0 |
| InternalName | caffeine |
| LegalCopyright | Copyright (C) 2021 |
| OriginalFilename | caffeine.exe |
| ProductName | Caffeine Application |
| ProductVersion | 1, 9, 7, 0 |
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/68 (Scanned on 2021-07-07 22:06:10) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 5 |
| TimeDateStamp | 2021-Apr-10 08:04:04 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 9.0 |
| SizeOfCode | 0x3c000 |
| SizeOfInitializedData | 0x2da00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000000000002601C (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x72000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x6e669 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
.rsrc
Imports
| USER32.dll |
GetWindowRect
InflateRect PtInRect SetCursor GetSystemMetrics LoadIconW EnableWindow GetClientRect GetDC SendMessageW RedrawWindow SetCapture GetParent ReleaseCapture IsWindow GetSysColor MessageBeep CopyIcon ReleaseDC InvalidateRect IsIconic UnregisterClassW GetSysColorBrush UnpackDDElParam ReuseDDElParam DestroyMenu LoadAcceleratorsW InsertMenuItemW CreatePopupMenu SetRectEmpty BringWindowToTop TranslateAcceleratorW WindowFromPoint LoadCursorW SetWindowLongW GetWindow SetTimer GetDesktopWindow GetCursorPos GetWindowTextW GetTopWindow SendInput GetAsyncKeyState FindWindowW RegisterWindowMessageW SystemParametersInfoW GetMenuItemID GetSubMenu LoadMenuW PostMessageW KillTimer SetActiveWindow SetForegroundWindow SetMenuDefaultItem TrackPopupMenu ModifyMenuW GetClassNameW CopyRect FillRect DrawEdge DrawTextW GetMenuItemCount GetMenuState GetMenuItemInfoW SetMenuItemInfoW GetMenuCheckMarkDimensions GetMenuStringW EndPaint BeginPaint GetWindowDC ClientToScreen PostQuitMessage CheckMenuItem EnableMenuItem GetFocus LoadBitmapW SetMenuItemBitmaps ValidateRect PeekMessageW GetKeyState IsWindowVisible GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx SetWindowsHookExW ShowOwnedPopups MessageBoxW IsWindowEnabled GetLastActivePopup GetWindowLongW GetWindowThreadProcessId UnhookWindowsHookEx GetWindowPlacement SystemParametersInfoA IntersectRect OffsetRect SetWindowPos GetMenu CallWindowProcW DefWindowProcW GetDlgCtrlID DeferWindowPos EqualRect ScreenToClient AdjustWindowRectEx RegisterClassW GetClassInfoW GetClassInfoExW CreateWindowExW UpdateWindow SetMenu MapWindowPoints GetMessagePos GetMessageTime SetWindowLongPtrW GetWindowLongPtrW DestroyWindow GetDlgItem EndDeferWindowPos BeginDeferWindowPos GetForegroundWindow GetWindowTextLengthW SetFocus RemovePropW GetPropW SetPropW GetClassLongPtrW GetCapture WinHelpW SendDlgItemMessageW SendDlgItemMessageA IsDialogMessageW SetWindowTextW ShowWindow EndDialog GetNextDlgTabItem CreateDialogIndirectParamW TabbedTextOutW DrawTextExW GrayStringW |
|---|---|
| WTSAPI32.dll |
WTSRegisterSessionNotification
|
| KERNEL32.dll |
LoadLibraryA
CompareStringW GlobalFindAtomW FreeResource lstrlenW GlobalFree GlobalUnlock LocalFree FormatMessageW GlobalGetAtomNameW lstrlenA WritePrivateProfileStringW GlobalFlags LocalAlloc LeaveCriticalSection TlsGetValue EnterCriticalSection InitializeCriticalSection TlsAlloc GlobalReAlloc GlobalHandle TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GetVersionExA WriteFile SetFilePointer FlushFileBuffers GetCurrentProcess SetErrorMode GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx GetSystemTimeAsFileTime HeapAlloc HeapFree Sleep ExitProcess RaiseException RtlPcToFileHeader HeapReAlloc HeapQueryInformation HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter TerminateProcess UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetCurrentProcessId SetLastError GlobalAddAtomW CloseHandle GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW LoadLibraryExW WideCharToMultiByte CompareStringA GlobalLock GlobalAlloc GetModuleHandleW GetProcAddress GetVersion GetVersionExW SetThreadExecutionState MultiByteToWideChar FindResourceW LoadResource LockResource SizeofResource GetSystemPowerStatus lstrcmpW MulDiv GetWindowsDirectoryW LoadLibraryW FreeLibrary GetLastError GetTickCount |
| GDI32.dll |
DPtoLP
CreateSolidBrush CreatePatternBrush DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteObject SetMapMode SetBkMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap Rectangle ExcludeClipRect BitBlt CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps GetTextExtentPoint32W GetObjectW CreateFontIndirectW GetStockObject GetPixel |
| WINSPOOL.DRV |
OpenPrinterW
ClosePrinter DocumentPropertiesW |
| ADVAPI32.dll |
RegEnumKeyW
RegSetValueExW RegCreateKeyExW RegOpenKeyW RegQueryValueW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey |
| SHELL32.dll |
DragQueryFileW
DragFinish Shell_NotifyIconW ShellExecuteW |
| SHLWAPI.dll |
PathFindExtensionW
PathFindFileNameW |
| OLEAUT32.dll |
VariantInit
VariantChangeType VariantClear SystemTimeToVariantTime VariantTimeToSystemTime |
| pdh.dll |
PdhOpenQueryW
PdhCloseQuery PdhGetFormattedCounterValue PdhCollectQueryData PdhAddCounterW |
| OLEACC.dll (delay-loaded) |
LresultFromObject
CreateStdAccessibleObject |
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | OLEACC.dll |
| ModuleHandle | 0x5bca0 |
| DelayImportAddressTable | 0x56fa0 |
| DelayImportNameTable | 0x51820 |
| BoundDelayImportTable | 0x51868 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
30994
30996
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
129
138
139
146
30721
30734
3841
3842
3843
3857
3858
3859
3860
3865
3866
3867
3868
3869
3887
30977
30998
30999
31000
31001
31002
31003
31004
31005
31006
31007
31008
31009
31010
31011
128
130
140
142
143
144
145
1 (#2)
1 (#3)
String Table contents
| Open |
| Save As |
| All Files (*.*) |
| Untitled |
| an unnamed file |
| &Hide |
| No error message is available. |
| Attempted an unsupported operation. |
| A required resource was unavailable. |
| Out of memory. |
| An unknown error has occurred. |
| Encountered an improper argument. |
| Incorrect filename. |
| Failed to open document. |
| Failed to save document. |
| Save changes to %1? |
| Failed to create empty document. |
| The file is too large to open. |
| Could not start print job. |
| Failed to launch help. |
| Internal application error. |
| Command failed. |
| Insufficient memory to perform operation. |
| System registry entries have been removed and the INI file (if any) was deleted. |
| Not all of the system registry entries (or INI file) were removed. |
| This program requires the file %s, which was not found on this system. |
| This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s. |
| Enter an integer. |
| Enter a number. |
| Enter an integer between %1 and %2. |
| Enter a number between %1 and %2. |
| Enter no more than %1 characters. |
| Select a button. |
| Enter an integer between 0 and 255. |
| Enter a positive integer. |
| Enter a date and/or time. |
| Enter a currency. |
| Enter a GUID. |
| Enter a time. |
| Enter a date. |
| Unexpected file format. |
| %1 |
| Cannot find this file. |
| Verify that the correct path and file name are given. |
| Destination disk drive is full. |
| Unable to read from %1, it is opened by someone else. |
| Unable to write to %1, it is read-only or opened by someone else. |
| Encountered an unexpected error while reading %1. |
| Encountered an unexpected error while writing %1. |
| %1: %2 |
| Continue running script? |
| Dispatch exception: %1 |
| Unable to read write-only property. |
| Unable to write read-only property. |
| Unable to load mail system support. |
| Mail system DLL is invalid. |
| Send Mail failed to send message. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| %1 was not found. |
| %1 contains an incorrect path. |
| Could not open %1 because there are too many open files. |
| Access to %1 was denied. |
| An incorrect file handle was associated with %1. |
| Could not remove %1 because it is the current directory. |
| Could not create %1 because the directory is full. |
| Seek failed on %1 |
| Encountered a hardware I/O error while accessing %1. |
| Encountered a sharing violation while accessing %1. |
| Encountered a locking violation while accessing %1. |
| Disk full while accessing %1. |
| Attempted to access %1 past its end. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| Attempted to write to the reading %1. |
| Attempted to access %1 past its end. |
| Attempted to read from the writing %1. |
| %1 has a bad format. |
| %1 contained an unexpected object. |
| %1 contains an incorrect schema. |
| pixels |
| Uncheck |
| Check |
| Mixed |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.9.7.0 |
| ProductVersion | 1.9.7.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Zhorn Software |
| FileDescription | Caffeine |
| FileVersion (#2) | 1, 9, 7, 0 |
| InternalName | caffeine |
| LegalCopyright | Copyright (C) 2021 |
| OriginalFilename | caffeine.exe |
| ProductName | Caffeine Application |
| ProductVersion (#2) | 1, 9, 7, 0 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x70603345 |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2008 SP1 build 30729) | 153 |
| ASM objects (VS2008 SP1 build 30729) | 11 |
| C++ objects (VS2008 build 21022) | 3 |
| Imports (VS2008 SP1 build 30729) | 25 |
| Total imports | 542 |
| C++ objects (VS2008 SP1 build 30729) | 138 |
| Linker (VS2008 build 21022) | 1 |
| Resource objects (VS2008 SP1 build 30729) | 1 |