9ad0a4fb7f7ae17b64172cb939a69858

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2016-Dec-11 21:50:52
Detected languages English - United States

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExA
 Can access the registry:
  • RegDeleteKeyA
  • RegOpenKeyExA
  • RegEnumValueA
  • RegDeleteValueA
  • RegCloseKey
  • RegCreateKeyExA
  • RegSetValueExA
  • RegQueryValueExA
  • RegEnumKeyA
 Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
 Can create temporary files:
  • GetTempPathA
  • CreateFileA
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Changes object ACLs:
  • SetFileSecurityA
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 15805449 bytes of data starting at offset 0xf000.
The overlay data has an entropy of 7.99972 and is possibly compressed or encrypted.
Overlay data amounts for 99.6128% of the executable.
Suspicious VirusTotal score: 2/74 (Scanned on 2024-09-04 06:53:10) Bkav: W32.AIDetectMalware
NANO-Antivirus: Exploit.Java.CVE20131493.cqvzpg

Hashes

MD5 9ad0a4fb7f7ae17b64172cb939a69858
SHA1 cff700de71fd2335ad81ecb4259ca43267752b30
SHA256 5fba77bdbe475867595c48818e7e8c572a33eeff418e0e4dfa630089e9e7087b
SHA3 aca30c4d57e9ffda8433a618beef5d865df708ff81d23f92fbe9a32f401befa8
SSDeep 393216:l191OM91tbfrZvRkpGNtBng4ahY7lZdXbW3A7dGdoHDos9hN:l9OM9/TdvWpGNtFggN37oMoehN
Imports Hash b78ecf47c0a3e24a6f4af114e2d1f5de

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2016-Dec-11 21:50:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6200
SizeOfInitializedData 0x27c00
SizeOfUninitializedData 0x400
AddressOfEntryPoint 0x000031A3 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x4c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 86ec2a2da0012903b23e33f511180572
SHA1 31f7a4e23109644e9d4c4f296c09c4e77367bd9b
SHA256 3353fb095b9bd4292084a98dd95fe63eabe0c0ecef0329cc6c8ab0f456e1791f
SHA3 a88c99bc94a503c18c83e4dcfd2682c120b5e641fd7cdb916ba6237d9d81b369
VirtualSize 0x6071
VirtualAddress 0x1000
SizeOfRawData 0x6200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.43434

.rdata

MD5 cd090b7c5bd9ae3da2a43d4f02ef98b7
SHA1 0f313f736cae707d7f4d0688e46b869cfd5c6392
SHA256 0c7b0f88bf28de326b2ded70eab9751b981c0292a70620427bb7f5f76537b700
SHA3 2569eedd515849aee5787e14ea6132e0b8e11b7c8ef21c6fa476447fe28027df
VirtualSize 0x1352
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.2373

.data

MD5 e98382d1559cdefaafaf45200fe1faf0
SHA1 b7f0b710769c19076472938fadf88cbb4bd1aaef
SHA256 1ee3862dd6e73c98ef5ef780fe394c8613a70c9a764a306a93037f553855b26a
SHA3 acb57327dec9462c149eea306264251984d9291125e080eeccd723866edf686f
VirtualSize 0x254f8
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x7a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.03725

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x15000
VirtualAddress 0x30000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 288b85d028019e6509f9c48b21d85741
SHA1 478becd3d9322f9cfd7011dcefe70c638a10ec0b
SHA256 a81e1c9d221719bd634d4f5149685297ef8a476e37c7b68060871eb8a14e12ef
SHA3 2ecc726cb206480208bfb6bae51af02cd4636943e2bbd5fdd1189b46ac00c1a3
VirtualSize 0x6fd8
VirtualAddress 0x45000
SizeOfRawData 0x7000
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.9189

Imports

KERNEL32.dll SetEnvironmentVariableA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileAttributesA
SetFileAttributesA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
GetFullPathNameA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
GlobalUnlock
GetDiskFreeSpaceA
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc
USER32.dll ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
GDI32.dll SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
SHELL32.dll SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
ADVAPI32.dll RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
COMCTL32.dll ImageList_Create
ImageList_AddMasked
ImageList_Destroy
#17
ole32.dll OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.35962
MD5 093bdf076fcdb0eee0ec47527bdd79c2
SHA1 629e239576de958915a891f1184c9a24882c25e2
SHA256 a03b036d5cabcc868041b62715e8da5a209e2f3628fdd37cecd944cbae01c6c5
SHA3 9b77753024dcde5470eb2d6f214086a335e97a7a91adc048c5a9f3713c3e588c

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.47075
MD5 f6e52ac234540dce98d52282aff1160e
SHA1 18202e11cd0f6437d237466e29d23c28c6d6b490
SHA256 7cfb9314b9ef0afbd831a8b0428d0e66a58d90ffc2032ee37797aeb79062dfd5
SHA3 d9db033176d2b0eae57ad5d71e34488dc7fd93cd588bbbed416df996099d1a35

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.53024
MD5 fcd52cc54ed2044e538fbe7fcf96216d
SHA1 d7c895db938c2abafc525655afd950cd0755c5a0
SHA256 a0f32b35923644a719cef2e943710383356f0a4314ec921fd8e54ce082f3a0d0
SHA3 50552d0e911901c74ce6b92c320ca5f514178c6696892c8f9d4bed7e65b8a0ff

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.59767
MD5 026a2594fa670c1e68c188b0f28a7286
SHA1 3e9ba15b03ed2a08bccc91f91b88d70d7e058c50
SHA256 25507d41e911c4bb0a5cfffe9f71a69660d6ddfd81a3940f150ef9b4a7f7a0b5
SHA3 8eaed7a1c5d4dcd9e558a46950ee3c878c9c59407f627df2c80bc3483a789772

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.78548
MD5 56edfd4f3ac5cc2338651da972f43b3b
SHA1 8949af103a760813cb5ec68c284f80975216cd6e
SHA256 98c2548ff0bbfa8e2d8df9628381da0ff372ca39e6adc3dfd08c007304311d18
SHA3 908e5f5a7224bc776c29a511d981c8af855e930199a145979c912df93833b15f

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.43755
MD5 c123e6a34c5bf53497775dd73fe15a77
SHA1 4d6be02075646fc0f39d73d8e9c34f8693ae625c
SHA256 debae6aa81e5364d8ea1cd67c5af2886945dc52e0878cca70323d09f2cef70ff
SHA3 777fd41f36579a7f5926951d8f4a3bb882ba0b902bf7dc21b44d35c15e2bc0e3

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.5422
MD5 2c53704ff47083497878bbb5aab68b5c
SHA1 9bcda339f48f810419484cfe5df06e055e3240bf
SHA256 1932fb31c0b32e1f7773b5db67b12f0fb2a83c97521c034389ef9479f732d2a1
SHA3 1a385befd1426cb80accd771cacd51a701eb5b86f85d27593dedfcb7a0ed3f29

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.64636
MD5 35d5298f9bf59b845a044c4546f06b1e
SHA1 84ce400590a6ea944a16e8f2acef8627c2168a6b
SHA256 2a9706630d95c70f032505b837f74f46d1c7129b3fc02b681ea5a2f1c7f3c05d
SHA3 67c2722b6498934ea6c6d6219d365c19b2aaf2fa98e3ccb3459f65108af58a43

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37471
MD5 b00592ab59f6d9b37fba11d126228f5a
SHA1 48ea76d0c1c122b4140ab4b0f74cc6c4caef6f2a
SHA256 bac7e045c307111fa0a6036cb10ae8d1234e8c54fee1c2475f180b62add87fb0
SHA3 917d0b93f95700072b869d8040bfa6bc8e54a71f25bd9b6463121cec2839bfd0

102

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71813
MD5 7add80697358fcc3e63354d269ea5ac9
SHA1 72c0a1363b9b4fee0a4acb42b31cd9b5e0664c4c
SHA256 b29c7a1301ddb0e896faf944d8ea8f4e57ff4f3d5fc3e5dc5bf3e64ed6be2fdd
SHA3 40a0e6b6b579b110550a4c3304eb33293a293d9aa288b02b11750143b52423fe

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73893
MD5 386770584473e271f23dced36427f4ff
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19
SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014
SHA3 db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.89887
MD5 663040d6315b1d6ce8c0334d182ed8fc
SHA1 ebcfff801a12fb8ad1200a4526fca8bd2c3e96cf
SHA256 cb3c86cbcb579244a6f819f9c1807a7e89b6e600982ec6ea0841fcdcb16a9efd
SHA3 6a25a2cb16aeb17693f10e8aaa0245c701701db571b458fde7830291a4a01cfc

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73226
Detected Filetype Icon file
MD5 5af8cb4af6cecaed564b1177546db10a
SHA1 87694c3d85073df7cd106761c4b652c068ee53f2
SHA256 4d5a08222594765eb4f41119e9be9b9558c68b580c8de332d172a89a6fe68c01
SHA3 25eba2ecf3abd5de8082c16079adc56319893c8837e933a58c1d77e6d9ffe64a

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x42e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28813
MD5 56e4e04d4e58ff7a4533babd6c1d5f79
SHA1 e92deeb5d1c581b26bfd3a021c8d0f8af9091a82
SHA256 b2568d1247d0a17588e8bb5586fc0473d1565cd3b1e9bdbfce96f29a69650d06
SHA3 435f8e85ec902dc0158de73679812be110d671dda79ff917f5fbc80f2763a97c

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd246d0e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 159
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
<-- -->