977677d68c0170f917e8c2de0326a83613c44bd1b55fefdbec680d685fe6ed11

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2016-Oct-18 09:34:35
Detected languages English - United States
Russian - Russia
Debug artifacts D:\dmr\basic_dll\Release\basic_dll.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryW
 Possibly launches other programs:
  • CreateProcessA
Suspicious The PE is possibly a dropper. Resources amount for 83.9592% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 6c9cbec705b8341e1b7d332214dc7947
SHA1 52407554ac5050a9dd94cd8adfb2e92d34d61a05
SHA256 977677d68c0170f917e8c2de0326a83613c44bd1b55fefdbec680d685fe6ed11
SHA3 0cbe4bc742cbace0b88043637b27c8472e6ceaf1e7c0c3d455d322dbba163aa0
SSDeep 12288:0pyA/97yw9b3dQw84S6Qe5ov5jNXceuC4xSO85xXD387B57d5X1r1e6oeNY0zlr:0hQs3dBazWxSOn5X1r1b93nJOX
Imports Hash 32ac3a5e140b22ee8b0ffa472129245c

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2016-Oct-18 09:34:35
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0x13e00
SizeOfInitializedData 0xba600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000095AE (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x15000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0xd0000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4cdeeec31b3e15eed1c5717440286924
SHA1 2a092f591a2db523b4b9966d360e34f80aea3785
SHA256 f51fc6dfce60fb298810cfd6ed29593e051d4f92a4ce3f860fd1e58d97d4b41a
SHA3 03623779e52efe9357fc24bd8dd3839b03333b589edb479c20e0d79259c1f9ab
VirtualSize 0x13d8b
VirtualAddress 0x1000
SizeOfRawData 0x13e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.59874

.rdata

MD5 6200fedc9336dbe8e2555d9bb842c80c
SHA1 1926ac338d25119a098e246c23e9d0f681709a5e
SHA256 c71021efee862fc1edb0a09203f940d525a84059b1db3eaad54b75de864e5cfb
SHA3 868c2ea29d8e1b365ffebd630e2b10669c16af3a42db12bf37f248bb46799c1c
VirtualSize 0x6ded
VirtualAddress 0x15000
SizeOfRawData 0x6e00
PointerToRawData 0x14200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.87857

.data

MD5 4963944e8aecac5b05de48e87845086c
SHA1 796909d78cbd99978522a51c66ca100febf3f13f
SHA256 f6a0a2f98baf2ba923b65c008be4d8d4a66bef61fa98794c3121c0a68b512df1
SHA3 86ca31c5cbf41f519ceff1a3e53e56696875944c6cfc0ee7cea1230ac4094d71
VirtualSize 0x2fa4
VirtualAddress 0x1c000
SizeOfRawData 0x1200
PointerToRawData 0x1b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.65529

.rsrc

MD5 088f999153fce00d2f577d7cd489da0f
SHA1 13a3c3233edd47b9b510124690f595a4d7c83150
SHA256 7394824d6e955d4be305407e4c529f740ba7f10e900748f1a3361326a6f947ee
SHA3 d50b413bb9e683b1e726199a7a6484ef0ee72f54cb38b026bba914eacd164f10
VirtualSize 0xabd78
VirtualAddress 0x1f000
SizeOfRawData 0xabe00
PointerToRawData 0x1c200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.80163

.reloc

MD5 2914a1f065ac4d654beef4d5e8a06a48
SHA1 af131eabafa3f51a00d59e28dffb8ecdb893bf74
SHA256 16ab93f6389c96a5c76d5452f86b3686c873e278847c5971caf635896c8dab9e
SHA3 54369ee8310766256804ca56f86e635fe33ca5a468c43f033d8a71289944de9a
VirtualSize 0x491e
VirtualAddress 0xcb000
SizeOfRawData 0x4a00
PointerToRawData 0xc8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 2.62534

Imports

KERNEL32.dll LocalAlloc
LocalFree
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
GetModuleHandleA
CreateFileA
WaitForSingleObject
FindResourceA
GetFileSize
CreateProcessA
SetFilePointer
WriteFile
SetEndOfFile
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateFileW
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
ReadFile
MultiByteToWideChar
ReadConsoleW
SetLastError
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
GetModuleFileNameW
SetFilePointerEx
SetStdHandle
WriteConsoleW
FlushFileBuffers
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
LCMapStringW
GetStringTypeW
USER32.dll PostMessageA

Delayed Imports

deciph_basic

Ordinal 1
Address 0x53f0

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x224
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.04378
MD5 245b863be176aab16ef1dbe168defe03
SHA1 c0a369f6f0e77b89c5d9d37fb94e1d5e2d431b5b
SHA256 59ba97d56a01766792386c3b379946bb613c8921e3daf8a878855a268ad5e4aa
SHA3 7efbe82f17422b353f747a146c1e8f1b9df37e90648150f2020442ff9477341e

101

Type UNKNOWN
Language Russian - Russia
Codepage UNKNOWN
Size 0xabaaf
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.79891
MD5 b92a2eee65ee3ea3dafcbbb366d12fef
SHA1 7d48c057479397957ccdf2b6d9f96b7a269cc98b
SHA256 4437afb5605ecde453b0b4acb0f24f86b0e632830ab2de9f97fbee2bcc7bcce6
SHA3 e22a351c25856a8474773091617e7d9e00dd40462ebee6c6bb7baad0419ec185

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2016-Oct-18 09:34:35
Version 0.0
SizeofData 63
AddressOfRawData 0x1a5d0
PointerToRawData 0x197d0
Referenced File D:\dmr\basic_dll\Release\basic_dll.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2016-Oct-18 09:34:35
Version 0.0
SizeofData 16
AddressOfRawData 0x1a610
PointerToRawData 0x19810

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1001c180
SEHandlerTable 0x1001a970
SEHandlerCount 23

RICH Header

XOR Key 0x35334070
Unmarked objects 0
ASM objects (50929) 15
C objects (50929) 112
Imports (VS2008 SP1 build 30729) 5
Total imports 97
C++ objects (50929) 47
211 (VS2012 UPD4 build 61030) 3
Exports (VS2012 UPD4 build 61030) 1
Resource objects (VS2012 UPD4 build 61030) 1
151 1
Linker (VS2012 UPD4 build 61030) 1

Errors

Leave a comment

No comments yet.