9a5a8245138f3e7a7a3c401e2b2474026fd81af634e194487595c7cf7af49a34
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Mar-30 16:55:23 |
| Detected languages |
English - United States
|
| CompanyName | Zen |
| FileDescription | Zen Installer |
| FileVersion | 0.27.1 |
| LegalCopyright | Copyright (c) 2026 Irbis and Zen contributors. Licensed under MIT License. |
| ProductName | Zen |
| ProductVersion | 0.27.1 |
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is an NSIS installer | Unusual section name found: .ndata |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: SignPath Foundation
Issuer: GlobalSign GCC R45 CodeSigning CA 2020 |
| Safe | VirusTotal score: 0/71 (Scanned on 2026-10-18 14:23:53) | All the AVs think this file is safe. |
Hashes
| MD5 | a41f3aa362411cc498871e91b52a0719 🔍 |
|---|---|
| SHA1 | 0ec80f85ad6c0c430ed9af919e6c41f14c13f028 🔍 |
| SHA256 | 9a5a8245138f3e7a7a3c401e2b2474026fd81af634e194487595c7cf7af49a34 🔍 |
| SHA3 | 6b6787f7f8f7fcf8a9f0c29ba325b46dc56145d5daf43629512105bc0b23df63 🔍 |
| SSDeep | 393216:vhO+n1RUYJvWxdAIjrg2tjU1Ar868Q8DV1Bl:vhJnNOM28+Uur58f 🔍 |
| Imports Hash | f4639a0b3116c2cfc71144b88a929cfd 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2024-Mar-30 16:55:23 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x6a00 |
| SizeOfInitializedData | 0x2d200 |
| SizeOfUninitializedData | 0x800 |
| AddressOfEntryPoint | 0x00003552 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x8000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 6.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x68000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0xc76753 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 595406ea4e71ef6f8675a1bd30bcc8f9 🔍 |
|---|---|
| SHA1 | c7a19a07f995a4fda4dc31a45035082a84f5cf28 🔍 |
| SHA256 | b4a6ff6f191a159043ffffa183e2fef9d6bb005521c480e9eeff3a396316ff21 🔍 |
| SHA3 | 5231a5c74192437da36ed36a8904ee24a141e3229eacabbb979d4dd6b4b6aeb7 🔍 |
| VirtualSize | 0x68f8 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x6a00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.48222 |
.rdata
| MD5 | a995b118b38426885fc6ccaa984c8b7a 🔍 |
|---|---|
| SHA1 | 9844579ec308452627ef731b5e1a1241ddc0fa2c 🔍 |
| SHA256 | e4a15bb054e962743cf6587247e1b36ec2f1a4c56d5430eab24cdcc336f5bece 🔍 |
| SHA3 | f2ca027f7b7b8ad33860315a6df25444bb3648d4f142d975c221e7a8e6a534b7 🔍 |
| VirtualSize | 0x1464 |
| VirtualAddress | 0x8000 |
| SizeOfRawData | 0x1600 |
| PointerToRawData | 0x6e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.96909 |
.data
| MD5 | 7a91ec9f1c18e608c3f3f503ba4191c1 🔍 |
|---|---|
| SHA1 | 3c15fde552ffcda63f8c7ca4716ffc5bdeafc0dc 🔍 |
| SHA256 | 0b394d61932417aac0ac358d6e055b7ae4ac5a5e3be7bec1127415c5b6823149 🔍 |
| SHA3 | 115e6402ebfc5611f2f9d0d0e95566b136fc87dd610865fb0e7eb1b7088426ca 🔍 |
| VirtualSize | 0x2a818 |
| VirtualAddress | 0xa000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x8400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 4.16554 |
.ndata
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x27000 |
| VirtualAddress | 0x35000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.rsrc
| MD5 | 65c320e7025ca6e834526d56435a3387 🔍 |
|---|---|
| SHA1 | 0304f6a93dbdb0fb998502a81f5527bc11c90a37 🔍 |
| SHA256 | 90b470d033b0b7f9b51106a0420e74ec2a13ef393d286529421bdc3e6e535909 🔍 |
| SHA3 | 7b510948b36b0a99e40fd037028cbfafba9d800b253579843b741c1c350b29cf 🔍 |
| VirtualSize | 0xbb80 |
| VirtualAddress | 0x5c000 |
| SizeOfRawData | 0xbc00 |
| PointerToRawData | 0x8a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.80086 |
Imports
| ADVAPI32.dll |
RegEnumValueW
RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW |
|---|---|
| SHELL32.dll |
SHGetPathFromIDListW
SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW |
| ole32.dll |
CoCreateInstance
OleUninitialize OleInitialize IIDFromString CoTaskMemFree |
| COMCTL32.dll |
ImageList_Destroy
#17 ImageList_AddMasked ImageList_Create |
| USER32.dll |
MessageBoxIndirectW
GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics |
| GDI32.dll |
GetDeviceCaps
SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor |
| KERNEL32.dll |
lstrcmpiA
CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW |
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4e3d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.85661 |
| Detected Filetype | PNG graphic file |
| MD5 | 70849e28c58b5f73424901eaca857793 🔍 |
| SHA1 | 9d7ef732a372f1d592b1cfd9a988452a66426a37 🔍 |
| SHA256 | 34636fcc57ea352cd20bbe86dddb705f83176fd4ddd62074f2a04f9c6873601d 🔍 |
| SHA3 | 342c5d9deb977f0904cc359b720fbcb4816a967a3deb9b913a78bc7dfc8d4886 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.2168 |
| MD5 | 911b62d2caa292db5ef7438934b5332a 🔍 |
| SHA1 | 43500bd4f3632e41fd4151fab583d20e95021047 🔍 |
| SHA256 | 6f89b68592a9b83ba7f62614bfbed76e3478afc8b1c340d8c67ebd441f1ae6b9 🔍 |
| SHA3 | 4479b8c0b38df0c93f829481b0699ef4f89679ac8eb2d2aa4bac8850c16586f1 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x22b8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.91861 |
| Detected Filetype | PNG graphic file |
| MD5 | a8fc1995410ce5a9aaa0ec76e7bddd98 🔍 |
| SHA1 | 50a932869e7665400b79b2eaf104658883943315 🔍 |
| SHA256 | 61b70695deb6927b7585e4425804a0a696fcb2bfd918ed15b429b1df1c6353bc 🔍 |
| SHA3 | d6c61e8974161e7184e1745c7abf72d778943b8284e794040ee4fda5e0e690ba 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.71165 |
| MD5 | dc949ba57f47c49c534cc08d3263cf80 🔍 |
| SHA1 | e919919037cd3eea85806f723025049db4644150 🔍 |
| SHA256 | 2bb537a50f313fc72c0cdb6837e1705323d53def8857ea32ffd84effa957db0e 🔍 |
| SHA3 | 5476d47a9a4d461044f1c016107d25572875b869f68b024de08b5ad4e2f209b6 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.44335 |
| MD5 | cf622d6691cee791c7b79c2fc6071232 🔍 |
| SHA1 | 44b54bf5ee01ee3df469efcafa112b0a98bf5924 🔍 |
| SHA256 | 2993fa1f79376b6533e5b6b1461d2f9f7a6f3a57331b85d7f5a9f3f41aa67d8e 🔍 |
| SHA3 | 2f29fba0e178729d483532a094f27c9de643b6d1785c748518bc1510567c859e 🔍 |
102
| Type |
RT_DIALOG
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xb4 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.71813 |
| MD5 | a69caf66f3f899403f8b25b02dc61908 🔍 |
| SHA1 | 3e5db9186cf0f75be24676462d88170e5950d9c8 🔍 |
| SHA256 | 7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50 🔍 |
| SHA3 | 1eea945e3712b317143e07560f54b0b9a13b1fd6c2b57cab9176181a9aaf4f79 🔍 |
103
| Type |
RT_DIALOG
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x120 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.56193 |
| MD5 | db6dd0434da4d7cac564518725167e09 🔍 |
| SHA1 | a65a1367d7cd96450f089a8f8108239bbcea9f5b 🔍 |
| SHA256 | c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016 🔍 |
| SHA3 | 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff 🔍 |
105
| Type |
RT_DIALOG
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x202 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.73893 |
| MD5 | 386770584473e271f23dced36427f4ff 🔍 |
| SHA1 | d14ce95f784b35e4e3ebee535476ebcd3e380c19 🔍 |
| SHA256 | 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014 🔍 |
| SHA3 | db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662 🔍 |
106
| Type |
RT_DIALOG
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xf8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.91148 |
| MD5 | fa83652660409e90e0db9731ad2adb17 🔍 |
| SHA1 | 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc 🔍 |
| SHA256 | 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 🔍 |
| SHA3 | 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b 🔍 |
111
| Type |
RT_DIALOG
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0xee |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.92767 |
| MD5 | 1db3e4c32b9560257ddf3506fef9dd3f 🔍 |
| SHA1 | 6666e0c8336456cfacec71d84415c6516e9e2673 🔍 |
| SHA256 | 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763 🔍 |
| SHA3 | 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4 🔍 |
103 (#2)
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.49283 |
| Detected Filetype | Icon file |
| MD5 | d09a3e1531eaaf56f1e01bf698d71a81 🔍 |
| SHA1 | d20ea4f3403ffbc1af0d152e3fc1ac91d8fb7ca6 🔍 |
| SHA256 | 3813bd22ecd61e1338d68b695d826edea1b2597e2f84c3fe24a45ab53f74ff29 🔍 |
| SHA3 | 9a086c522e6d762f11523b8c1f36755397be1110252f86125db0daae0357723b 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x290 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.30226 |
| MD5 | 52836a39b3798aa5ead0b2f329dd6297 🔍 |
| SHA1 | 72ebfdd402dcc85f96bc423038a79e8c0cd73f20 🔍 |
| SHA256 | 527a5bd0f9bb4fddc0f2f4ead7848153f093d394bd10a1696024fe105059886d 🔍 |
| SHA3 | 93b7bc5b89a65e071bcb98865dd50b70dbc0088c5b1f4499a0a814caeb4a1d6e 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x42e |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.28813 |
| MD5 | 801ca73a087b948a8991dc4901c4dac6 🔍 |
| SHA1 | c7198cc2c47a562ad414c4a567fd18b2598f070b 🔍 |
| SHA256 | fb7414194d1b352675ad29558198470e4abb09321104a4c9289d4265c61e83a2 🔍 |
| SHA3 | 9791e84b00fcf8f56a9552005aacd6b5abb53eabcbae494f383974013b6d3fdf 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0 |
| FileVersion | 0.27.1.0 |
| ProductVersion | 0.27.1.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Zen |
| FileDescription | Zen Installer |
| FileVersion (#2) | 0.27.1 |
| LegalCopyright | Copyright (c) 2026 Irbis and Zen contributors. Licensed under MIT License. |
| ProductName | Zen |
| ProductVersion (#2) | 0.27.1 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0xd24e50e9 |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2003 (.NET) build 4035) | 2 |
| Total imports | 163 |
| Imports (VS2003 (.NET) build 4035) | 15 |
| 48 (9044) | 10 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
Errors
[*] Warning: Section .ndata has a size of 0!
Leave a comment
No comments yet.