9997c2b36b8501357c3679548a694f2f07b4e8f9677f27e0722491a5c04ec167

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages Dutch - Netherlands
English - United States
Comments This installation was built with Inno Setup.
CompanyName IGP Software Development
FileDescription Установка программы "Отличник" 3.38
FileVersion 3.3.8.0
LegalCopyright Copyright © 2015 IGP Software Development
ProductName Отличник
ProductVersion 3.3.8.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://www.jrsoftware.org
  • http://www.jrsoftware.org/ishelp/index.php?topic
  • jrsoftware.org
  • www.jrsoftware.org
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
 Possibly launches other programs:
  • CreateProcessA
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2015-Jul-04 13:29:28
Suspicious The file contains overlay data. 1279159 bytes of data starting at offset 0xde00.
The overlay data has an entropy of 7.99986 and is possibly compressed or encrypted.
Overlay data amounts for 95.7461% of the executable.
Safe VirusTotal score: 0/71 (Scanned on 2026-09-13 17:07:09) All the AVs think this file is safe.

Hashes

MD5 72c09448e8a47eb691af086774c47006 🔍
SHA1 327c9d553fa7297b0230c16c231b0409f1a75851 🔍
SHA256 9997c2b36b8501357c3679548a694f2f07b4e8f9677f27e0722491a5c04ec167 🔍
SHA3 34ec508099d2f0c5e15b827cd33261b7eb677cd48c42703a61a03183f452e1dd 🔍
SSDeep 24576:eQi7w01K570n5dpInoLfbBu6IseKyfnDoVfUz95TadBziylN8DlvcAb+Ho:e900+on5MWBfIseKODoK0zziyvkeAD 🔍
Imports Hash 4fb639b17a439bf0efa713bd4c6e715b 🔍

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x9e00
SizeOfInitializedData 0x4600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000A5F8 (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0xb000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 1.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x14000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 04ffdb46e50716ec8cb7db42819802fd 🔍
SHA1 b90277c50a0336f933b0e419e61bbbd83ff6ea26 🔍
SHA256 e56e78858f061e14c12353c6c37204a73d573a5bed8a713dd20e666443b4ab9e 🔍
SHA3 4d917eab00926c64fe9b95e5b19d3ef95fc41e17c26b76f2296dfaab8cd8e006 🔍
VirtualSize 0x9d30
VirtualAddress 0x1000
SizeOfRawData 0x9e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.6316

DATA

MD5 beee52f18301950f82460d9ffe5aec7e 🔍
SHA1 2501181070a2c1a15e3cba4fc93e4a7216f555e3 🔍
SHA256 cf86bae6284395069d7c397b68cf174d3ad5b92add50473f946ad7d720c40561 🔍
SHA3 b1e5328233076e0ee6e0c9685601ba7baece503b3b7e02c58f69a6ad5c71573f 🔍
VirtualSize 0x250
VirtualAddress 0xb000
SizeOfRawData 0x400
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.75472

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xe90
VirtualAddress 0xc000
SizeOfRawData 0
PointerToRawData 0xa600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 bb5485bf968b970e5ea81292af2acdba 🔍
SHA1 40a39d9e8c8cecd5356ab96745d82d2ebfe17cfb 🔍
SHA256 d9ea6e80cc1edfdffa8d534a8c61448b19b74d683845b94ad6d9a543e5ceb8cf 🔍
SHA3 09274dc071547ce3dc33528de99c9ad5a9eb119600e5a61b3127f74cde6dcfbf 🔍
VirtualSize 0x950
VirtualAddress 0xd000
SizeOfRawData 0xa00
PointerToRawData 0xa600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.43073

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8
VirtualAddress 0xe000
SizeOfRawData 0
PointerToRawData 0xb000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 9ba824905bf9c7922b6fc87a38b74366 🔍
SHA1 f43ee83e6afa1c343ff6db68e13efde43471cbb6 🔍
SHA256 ad44157821ba24c07dd44f66940dd75adee9d6919a0577c5a75aa502637dddaa 🔍
SHA3 370eba5499bce03a18d462f5b9e6ee4598126f2a2243cc5fa1590c7c7245c5d7 🔍
VirtualSize 0x18
VirtualAddress 0xf000
SizeOfRawData 0x200
PointerToRawData 0xb000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 0.204488

.reloc

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8c4
VirtualAddress 0x10000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED

.rsrc

MD5 3c665de14d32bd9ae1cbd018ead61bc5 🔍
SHA1 e0971c09a7739d2cfeda4c07e3a46565ddc0f52e 🔍
SHA256 58d282214cfbd8583a5683eed57e15c49790b1f1afd77df48fbd334972da1fc7 🔍
SHA3 d89916764356682052c9b07a544a1ea027ce962ff3270f012657b0fa43a0b92f 🔍
VirtualSize 0x2c00
VirtualAddress 0x11000
SizeOfRawData 0x2c00
PointerToRawData 0xb200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 4.6384

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
WideCharToMultiByte
TlsSetValue
TlsGetValue
MultiByteToWideChar
GetModuleHandleA
GetLastError
GetCommandLineA
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetSystemTime
GetFileType
ExitProcess
CreateFileA
CloseHandle
user32.dll MessageBoxA
oleaut32.dll VariantChangeTypeEx
VariantCopyInd
VariantClear
SysStringLen
SysAllocStringLen
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
WideCharToMultiByte
TlsSetValue
TlsGetValue
MultiByteToWideChar
GetModuleHandleA
GetLastError
GetCommandLineA
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetSystemTime
GetFileType
ExitProcess
CreateFileA
CloseHandle
user32.dll (#2) MessageBoxA
comctl32.dll InitCommonControls
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

Delayed Imports

1

Type RT_ICON
Language Dutch - Netherlands
Codepage UNKNOWN
Size 0x128
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.25755
MD5 c5af786bfd9fd1c53c8fe9f0bd9ce38b 🔍
SHA1 4f6f7d9973b47063aa5353225a2bc5a76aa2a96a 🔍
SHA256 f59f62e7843b3ff992cf769a3c608acd4a85a38b3b302cda8507b75163659d7b 🔍
SHA3 e178a71f02edb18e31bf550d484b2cba8d865e1e9796065addb07855ce5627f9 🔍

2

Type RT_ICON
Language Dutch - Netherlands
Codepage UNKNOWN
Size 0x568
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.47151
MD5 0a451222f7037983439a58e3b44db529 🔍
SHA1 6881cba71174502883d53a8885fb90dad81fd0c0 🔍
SHA256 dc785b2a3e4ea82bd34121cc04e80758e221f11ee686fcfd87ce49f8e6730b22 🔍
SHA3 d5599c242df5383add3fb330d42b31f1751594b36bbf52195e7d1dd564e7f0e3 🔍

3

Type RT_ICON
Language Dutch - Netherlands
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.91708
MD5 90ed3aac2a942e3067e6471b32860e77 🔍
SHA1 b849a2b9901473810b5d74e6703be78c3a7e64e3 🔍
SHA256 ca8fc96218d0a7e691dd7b95da05a27246439822d09b829af240523b28fd5bb3 🔍
SHA3 3f02085a0d69091556ede0b585f45145adce9849e175d8177c2f0fe0891a1bd8 🔍

4

Type RT_ICON
Language Dutch - Netherlands
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.91366
MD5 af05dd5bd4c3b1fc94922c75ed4f9519 🔍
SHA1 f54685a8a314e6f911c75cf7554796212fb17c3e 🔍
SHA256 3bbacbad1458254c59ad7d0fd9bea998d46b70b8f8dcfc56aad561a293ffdae3 🔍
SHA3 150dba8cc825d5c0e9ff3c59015533288d19931847210338a3ef7cdc390c0e78 🔍

4089

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2f2
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.21823
MD5 bbf4b644f9dd284b35eb31573d0df2f7 🔍
SHA1 4f9885ae629e83464e313af5254ef86f01accd0b 🔍
SHA256 2c0d32398e3c95657a577c044cc32fe24fa058d0c32e13099b26fd678de8354f 🔍
SHA3 ebed2e4a929600c1460761d462143feb092840986b31c9748d3aeb8174d4205e 🔍

4090

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x30c
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.31515
MD5 ac2a0551cb90f91d779ee8622682dfb1 🔍
SHA1 ff0db7d2f48d85ceb3539b21ebe9d0ca3443f1da 🔍
SHA256 840989e0a92f2746ae60b8e3efc1a39bcca17e82df3634c1643d76141fc75bb3 🔍
SHA3 58a85f5c53df73aa79e5f5a36aa151ca0d9da4d450ebc2975a3ee827b46342a5 🔍

4091

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2ce
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.25024
MD5 c99b474c52df3049dfb38b5308f2827d 🔍
SHA1 7375e693629ce6bbd1a0419621d094bcd2c67bb7 🔍
SHA256 26bda4da3649a575157a6466468a0a86944756643855954120fd715f3c9c7f78 🔍
SHA3 c6013febd14dd876e3b81111ec17dd2724dbf4147b0ad7be9d03259bcb59fef3 🔍

4093

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x68
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 2.86149
MD5 aec4e28ea9db1361160cde225d158108 🔍
SHA1 249013a10cde021c713ba2dc8912f9e05be35735 🔍
SHA256 d786490af7fe66042fb4a7d52023f5a1442f9b5e65d067b9093d1a128a6af34c 🔍
SHA3 a067c4d88d719ed8d568951acb776bd798b691a8b153f8d94ba0574ede1fbf4c 🔍

4094

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.20731
MD5 c76a8843204c0572bca24ada35abe8c7 🔍
SHA1 066052030d0a32310da8cb5a51d0590960a65f32 🔍
SHA256 00a0794f0a493c167f64ed8b119d49bdc59f76bb35e5c295dc047095958ee2fd 🔍
SHA3 07523cf88b3803ea41acfeb3c9c0c4b5b4b9fb6f9a3232802491d8de1b6c9166 🔍

4095

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xae
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.04592
MD5 4bd4f3f6d918ba49d8800ad83d277a86 🔍
SHA1 1f5e4c73965fea1d1f729efbe7568dcd081a2168 🔍
SHA256 34973a8a33b90ec734bd328198311f579666d5aeb04c94f469ebb822689de3c3 🔍
SHA3 2d01c56a5bf0b390addf4fb5b6ae02f9a64bd03ffd300d3763615bbb8ec911fe 🔍

11111

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x2c
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 4.54912
MD5 42cdfee04b4fd650d01bdd8f1ede61ad 🔍
SHA1 71790f50336d614e06e28f5e34169afaf9cab616 🔍
SHA256 c8bce4fb9265e60f988eaf598198e6c167d1f36a1a3e44ab8cddda0192a6e371 🔍
SHA3 58784e87ca85e9925c5d6d4d4c533b1d24098a7abfdaabe96cef803ea928cb83 🔍

MAINICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 2.64576
Detected Filetype Icon file
MD5 f6262f462f61a1af1cac10cf4b790e5a 🔍
SHA1 4aa3239c2c59fa5f246b0dd68da564e529b98ff4 🔍
SHA256 44b095a62d7e401671f57271e6cada367bb55cf7b300ef768b3487b841facd3c 🔍
SHA3 f2a1d165133c29eba349014fa5f8059ddebe1aba5b220fb89f1a474e95c482ca 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x4f4
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 3.1048
MD5 3c0296666dd332b00a5b048683a747c8 🔍
SHA1 a957d5ce013a49b240aad6354826fa404e103c7c 🔍
SHA256 28ad942843836f9395e8abc3beb8cde9e3393a81dba8e89f0568b577b9974645 🔍
SHA3 1bb603ce987e652a2afac4414f5e0c765477649974c44b00077500a311676d6e 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x62c
TimeDateStamp 2015-Jul-04 13:29:28
Entropy 5.13965
MD5 f78a870573f5bf2f15570e286257fae7 🔍
SHA1 eaccbf47cd42836b0e21ab2196b86d98a28733ca 🔍
SHA256 356ca8abf11d97bf9dcbff47c04bf1ddcb8685ef84d38e6850ec6c28a37655b9 🔍
SHA3 f19c38bb277b8098eb08d8b9a12df0b660a7c01098e20adda4c4fc5765d937ca 🔍

String Table contents

'%s' is not a valid integer value
'%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time
'%s' is not a valid date and time
Invalid argument to time encode
Invalid argument to date encode
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow
Invalid floating point operation
Floating point division by zero
Floating point overflow
Floating point underflow
Invalid pointer operation
Invalid class typecast
Access violation at address %p. %s of address %p
Stack overflow
Control-C hit
Privileged instruction
Operation aborted
Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'
Invalid variant type conversion
Invalid variant operation
Variant method calls not supported
Read
Write
Format result longer than 4096 characters
Format string too long
Error creating variant array
Variant is not an array
Variant array index out of bounds
External exception %x
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
January
February
March
April
May
June
July
August
September
October
November
December
Sun
Mon
Tue
Wed
Thu
Fri
Sat
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 3.3.8.0
ProductVersion 3.3.8.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments This installation was built with Inno Setup.
CompanyName IGP Software Development
FileDescription Установка программы "Отличник" 3.38
FileVersion (#2) 3.3.8.0
LegalCopyright Copyright © 2015 IGP Software Development
ProductName Отличник
ProductVersion (#2) 3.3.8.0
Resource LangID English - United States

TLS Callbacks

StartAddressOfRawData 0x40e000
EndAddressOfRawData 0x40e008
AddressOfIndex 0x40c3d0
AddressOfCallbacks 0x40f010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section BSS has a size of 0! [*] Warning: Section .tls has a size of 0! [*] Warning: Section .reloc has a size of 0!
Leave a comment

No comments yet.