9848ebaf453c21b305123d689c7901c4f224d4b5802d45de5a5f3da95f4a9467
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1992-Jun-19 22:22:17 |
| Detected languages |
English - United States
Romanian - Romania Russian - Russia |
Plugin Output
| Suspicious | PEiD Signature: | HASP HL Protection 1.X -> Aladdin |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .itext
Unusual section name found: .protect Section .protect is both writable and executable. |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE header may have been manually modified. |
Resource TFRMLOGINEVALUATOR is possibly compressed or encrypted.
The resource timestamps differ from the PE header:
|
| Suspicious | VirusTotal score: 2/67 (Scanned on 2021-12-27 11:51:56) |
APEX:
Malicious
MaxSecure: Trojan.Malware.300983.susgen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 10 |
| TimeDateStamp | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x12c800 |
| SizeOfInitializedData | 0xc9200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001FF280 (Section: .protect) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x12e000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x37f000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.itext
.data
.bss
.idata
.tls
.rdata
.reloc
.rsrc
.protect
Imports
| KERNEL32.dll |
GetACP
GetCurrentProcess GetCurrentProcessId GetCurrentThread GetLastError GetVersion GetTickCount |
|---|---|
| KERNEL32.dll (#2) |
GetACP
GetCurrentProcess GetCurrentProcessId GetCurrentThread GetLastError GetVersion GetTickCount |
| SETUPAPI.dll |
SetupDiEnumDeviceInfo
|
| KERNEL32.dll (#3) |
GetACP
GetCurrentProcess GetCurrentProcessId GetCurrentThread GetLastError GetVersion GetTickCount |
| USER32.dll |
MessageBoxA
|
| oleaut32.dll |
SysFreeString
|
| advapi32.dll |
RegQueryValueExA
|
| user32.dll |
GetKeyboardType
|
| kernel32.dll |
GetACP
|
| kernel32.dll (#2) |
GetACP
|
| user32.dll (#2) |
GetKeyboardType
|
| gdi32.dll |
UnrealizeObject
|
| version.dll |
VerQueryValueA
|
| kernel32.dll (#3) |
GetACP
|
| advapi32.dll (#2) |
RegQueryValueExA
|
| kernel32.dll (#4) |
GetACP
|
| oleaut32.dll (#2) |
SysFreeString
|
| comctl32.dll |
_TrackMouseEvent
|
| wininet.dll |
InternetReadFile
|
| shell32.dll |
Shell_NotifyIconA
|
| kernel32.dll (#5) |
GetACP
|
| sqlite3.dll |
sqlite3_bind_parameter_index
|
| advapi32.dll (#3) |
RegQueryValueExA
|
Delayed Imports
1
2
3
4
5
6
7
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBNO
BBOK
BBRETRY
BBYES
PREVIEWGLYPH
SP_BB_DOWN
SP_BB_UP
SP_BRUSH_BD
SP_BRUSH_CLEAR
SP_BRUSH_CROSS
SP_BRUSH_DCROSS
SP_BRUSH_FD
SP_BRUSH_H
SP_BRUSH_SOLID
SP_BRUSH_V
SP_GRAD_HORZ_IN
SP_GRAD_HORZ_INOUT
SP_GRAD_HORZ_OUT
SP_GRAD_VERT_IN
SP_GRAD_VERT_INOUT
SP_GRAD_VERT_OUT
SP_HRL
SP_HTB
SP_NEXTMONTH
SP_NEXTYEAR
SP_PEN1
SP_PEN2
SP_PEN3
SP_PEN4
SP_PEN6
SP_PEN_DASH
SP_PEN_DASHDOT
SP_PEN_DASHDOTDOT
SP_PEN_DOT
SP_PEN_SOLID
SP_PRIORMONTH
SP_PRIORYEAR
SP_SHADOW1
SP_SHADOW10
SP_SHADOW11
SP_SHADOW12
SP_SHADOW13
SP_SHADOW14
SP_SHADOW15
SP_SHADOW16
SP_SHADOW17
SP_SHADOW18
SP_SHADOW19
SP_SHADOW2
SP_SHADOW20
SP_SHADOW21
SP_SHADOW3
SP_SHADOW4
SP_SHADOW5
SP_SHADOW6
SP_SHADOW7
SP_SHADOW8
SP_SHADOW9
SP_VRL
SP_VTB
1 (#2)
2 (#2)
3 (#2)
4 (#2)
5 (#2)
6 (#2)
DLGTEMPLATE
TEXTFILEDLG
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
DVCLAL
PACKAGEINFO
TFRMLOGINEVALUATOR
TMAINFORM
TRUNTESTFORM
TSPLASHFORM
32761
32762
32763
32764
32765
32766
32767
MAINICON
1 (#3)
String Table contents
| Do not display this message again |
| Restore |
| &Yes |
| &No |
| OK |
| Cancel |
| &Abort |
| &Retry |
| &Ignore |
| &All |
| N&oToAll |
| &YesToAll |
| &Help |
| Warning |
| Error |
| Information |
| Confirm |
| UTF-7 |
| Cannot change the size of a JPEG image |
| JPEG error #%d |
| JPEG Image File |
| Mi&nimize |
| Ma&ximize |
| &Close |
| &Restore |
| Minimize to &Tray |
| Ro&llUp |
| Minimize |
| Maximize |
| Close |
| Minimize to Tray |
| Roll Up |
| System menu |
| Ctrl+ |
| Alt+ |
| Invalid clipboard format |
| Clipboard does not support Icons |
| Cannot open clipboard |
| Menu '%s' is already being used by another form |
| Docked control must have a name |
| Error removing control from dock tree |
| - Dock zone not found |
| - Dock zone has no control |
| Error loading dock zone from the stream. Expecting version %d, but found %d. |
| ANSI |
| ASCII |
| Unicode |
| Big Endian Unicode |
| UTF-8 |
| BkSp |
| Tab |
| Esc |
| Enter |
| Space |
| PgUp |
| PgDn |
| End |
| Home |
| Left |
| Up |
| Right |
| Down |
| Ins |
| Del |
| Shift+ |
| Bitmaps |
| Warning |
| Error |
| Information |
| Confirm |
| &Yes |
| &No |
| OK |
| Cancel |
| &Help |
| &Abort |
| &Retry |
| &Ignore |
| &All |
| N&o to All |
| Yes to &All |
| Cannot create form. No MDI forms are currently active |
| A control cannot have itself as its parent |
| OK |
| Cancel |
| &Yes |
| &No |
| &Help |
| &Close |
| &Ignore |
| &Retry |
| Abort |
| &All |
| Cannot drag a form |
| Metafiles |
| Enhanced Metafiles |
| Icons |
| Invalid ImageList |
| Invalid ImageList Index |
| Failed to read ImageList data from stream |
| Failed to write ImageList data to stream |
| Error creating window device context |
| Error creating window class |
| Cannot focus a disabled or invisible window |
| Control '%s' has no parent window |
| Cannot hide an MDI Child Form |
| Cannot change Visible in OnShow or OnHide |
| Cannot make a visible window modal |
| Menu index out of range |
| Menu inserted twice |
| Sub-menu is not in menu |
| Not enough timers available |
| GroupIndex cannot be less than a previous menu item's GroupIndex |
| Stream write error |
| Unable to find a Table of Contents |
| No help found for %s |
| No context-sensitive help installed |
| No help found for context |
| No topic-based help system installed |
| Bitmap image is not valid |
| Icon image is not valid |
| Metafile is not valid |
| Invalid pixel format |
| Scan line index out of range |
| Cannot change the size of an icon |
| Unsupported clipboard format |
| Out of system resources |
| Canvas does not allow drawing |
| Invalid image size |
| Invalid property path |
| Invalid property value |
| Invalid data type for '%s' |
| List capacity out of bounds (%d) |
| List count out of bounds (%d) |
| List index out of bounds (%d) |
| Out of memory while expanding memory stream |
| Error reading %s%s%s: %s |
| Stream read error |
| Property is read-only |
| Failed to get data for '%s' |
| Resource %s not found |
| %s.Seek not implemented |
| Operation not allowed on sorted list |
| %s not in a class registration group |
| Property %s does not exist |
| Saturday |
| Ancestor for '%s' not found |
| Cannot assign a %s to a %s |
| Bits index out of range |
| Can't write to a read-only resource stream |
| CheckSynchronize called from thread $%x, which is NOT the main thread |
| Class %s not found |
| A class named %s already exists |
| List does not allow duplicates ($0%x) |
| A component named %s already exists |
| String list does not allow duplicates |
| Cannot create file "%s". %s |
| Cannot open file "%s". %s |
| Invalid stream format |
| ''%s'' is not a valid component name |
| Invalid property value |
| October |
| November |
| December |
| Sun |
| Mon |
| Tue |
| Wed |
| Thu |
| Fri |
| Sat |
| Sunday |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Jun |
| Jul |
| Aug |
| Sep |
| Oct |
| Nov |
| Dec |
| January |
| February |
| March |
| April |
| May |
| June |
| July |
| August |
| September |
| Operation not supported |
| Unexpected variant error |
| External exception %x |
| Assertion failed |
| Interface not supported |
| Exception in safecall method |
| %s (%s, line %d) |
| Abstract Error |
| Access violation at address %p in module '%s'. %s of address %p |
| System Error. Code: %d. |
| %s |
| A call to an OS function failed |
| Jan |
| Feb |
| Mar |
| Apr |
| May |
| Format '%s' invalid or incompatible with argument |
| No argument for format '%s' |
| Variant method calls not supported |
| Read |
| Write |
| Error creating variant or safe array |
| Variant or safe array index out of bounds |
| Variant or safe array is locked |
| Invalid variant type conversion |
| Invalid variant operation |
| Invalid variant operation (%s%.8x) |
| %s |
| Could not convert variant of type (%s) into type (%s) |
| Overflow while converting variant of type (%s) into type (%s) |
| Variant overflow |
| Invalid argument |
| Invalid variant type |
| Division by zero |
| Range check error |
| Integer overflow |
| Invalid floating point operation |
| Floating point division by zero |
| Floating point overflow |
| Floating point underflow |
| Invalid pointer operation |
| Invalid class typecast |
| Access violation at address %p. %s of address %p |
| Access violation |
| Stack overflow |
| Control-C hit |
| Privileged instruction |
| Exception %s in module %s at %p. |
| %s%s |
| Application Error |
| '%s' is not a valid integer value |
| '%s' is not a valid floating point value |
| '%s' is not a valid date |
| '%s' is not a valid time |
| '%s' is not a valid date and time |
| Invalid argument to time encode |
| Invalid argument to date encode |
| Out of memory |
| I/O error %d |
| File not found |
| Invalid filename |
| Too many open files |
| File access denied |
| Read beyond end of file |
| Disk full |
| Invalid numeric input |
Version Info
TLS Callbacks
| StartAddressOfRawData | 0x53a000 |
|---|---|
| EndAddressOfRawData | 0x53a034 |
| AddressOfIndex | 0x52e78c |
| AddressOfCallbacks | 0x53b010 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |
Load Configuration
RICH Header
Errors
[*] Warning: Section .bss has a size of 0!
[*] Warning: Section .tls has a size of 0!
Leave a comment
No comments yet.