Manalyzer :: 9de0702f5b72c2128474d0bd3863edfd2aa441b3bae6970e021b57d11a389d30

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2024-Nov-13 08:50:15
Detected languages	English - United States
CompanyName	imc fsd
ProductName	Project1
FileVersion	`1.00`
ProductVersion	`1.00`
InternalName	echocard
OriginalFilename	echocard.exe

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual Basic 5.0` `Microsoft Visual Basic v5.0/v6.0` `Microsoft Visual Basic v5.0 - v6.0`
Suspicious	PEiD Signature:	`HQR data file`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`235a50a46e9c842b23fd3a67a813bc71`
SHA1	`dcfcb4362003ae3ea472bc17c6b4e72cb7269628`
SHA256	`9de0702f5b72c2128474d0bd3863edfd2aa441b3bae6970e021b57d11a389d30`
SHA3	`f82b4baeb875e33e2d3c88b55e16bdfce6d3b057c8af8232fd4f30d9d69c41e3`
SSDeep	`6144:wdR9XCI7WSLt+frgrNzKkoR3vaYvNLKhfXly84BfRnYQwLqNcgKwXwo/Cv+iiZZ:oJCWt+fMBzKkoR3vaYvNLKhfXly84Bf`
Imports Hash	`a4eaee8c22ba17c95df068f4a7a06cf3`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xb8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2024-Nov-13 08:50:15
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x34000`
SizeOfInitializedData	`0x3000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00001648 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x35000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`4.0`
ImageVersion	`1.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x38000`
SizeOfHeaders	`0x1000`
Checksum	`0x3fb06`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`f177edde16dc3b122751fc10cdb70027`
SHA1	`b8550baa7b99560f8c459056e616147841ace5c0`
SHA256	`c115fe8f0f8882df3364832b078a0806586033fd075c317b47f8dbdeca94248e`
SHA3	`b9b3d9983a316e3c24922bc5346c13e763769c4db26f9bfe4459b7967904e635`
VirtualSize	`0x3307c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x34000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.75647`

.data

MD5	`620f0b67a91f7f74151bc5be745b7110`
SHA1	`1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d`
SHA256	`ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7`
SHA3	`a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563`
VirtualSize	`0x1abc`
VirtualAddress	`0x35000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x35000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`d47c299315bd0c68be745e5d37e7a2a6`
SHA1	`84282068014fa33c7bb66069dbc446df1d793aab`
SHA256	`0836cdb5c8b02bfeb430327dbd307da34825b92f8955c0d1530f324e6714b20e`
SHA3	`5faa8acbe758c368acae671188e4e4cbb1883f6f690d95c424aa50cfe883ac78`
VirtualSize	`0x8d4`
VirtualAddress	`0x37000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x36000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.92112`

Imports

MSVBVM60.DLL	`EVENT_SINK_GetIDsOfNames` `_CIcos` `_adj_fptan` `__vbaVarMove` `__vbaFreeVar` `__vbaStrVarMove` `__vbaLateIdCall` `__vbaEnd` `__vbaFreeVarList` `_adj_fdiv_m64` `EVENT_SINK_Invoke` `__vbaFreeObjList` `_adj_fprem1` `__vbaStrCat` `#660` `__vbaHresultCheckObj` `_adj_fdiv_m32` `Zombie_GetTypeInfo` `__vbaLateMemSt` `__vbaObjSet` `__vbaOnError` `_adj_fdiv_m16i` `__vbaObjSetAddref` `_adj_fdivr_m16i` `__vbaBoolVarNull` `_CIsin` `__vbaLateMemStAd` `__vbaChkstk` `EVENT_SINK_AddRef` `__vbaStrCmp` `#529` `__vbaObjVar` `__vbaCastObjVar` `_adj_fpatan` `__vbaLateIdCallLd` `Zombie_GetTypeInfoCount` `EVENT_SINK_Release` `__vbaNew` `_CIsqrt` `EVENT_SINK_QueryInterface` `__vbaVarMul` `__vbaExceptHandler` `_adj_fprem` `_adj_fdivr_m64` `#716` `__vbaFPException` `__vbaStrVarVal` `__vbaVarCat` `_CIlog` `__vbaNew2` `_adj_fdiv_m32i` `_adj_fdivr_m32i` `__vbaStrCopy` `__vbaFreeStrList` `#576` `_adj_fdivr_m32` `_adj_fdiv_r` `#685` `#100` `#610` `__vbaVarAdd` `__vbaFreeVarg` `__vbaVarDup` `__vbaLateMemCallLd` `_CIatan` `__vbaStrMove` `__vbaCastObj` `#619` `_allmul` `_CItan` `_CIexp` `__vbaFreeObj` `__vbaFreeStr`

Delayed Imports

30001

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x130`
TimeDateStamp	2024-Nov-13 08:50:15
Entropy	`2.57965`
MD5	`a20d09bee9b4207ad5a3b67a78c1dce3`
SHA1	`ca85fbf532389887f3837bbadd1c579040b99c8b`
SHA256	`2d3915cdc82e909357d44c4de1b8890bd753605c28df11b10299e3fd09d930b9`
SHA3	`e3b2b0325b24bb74af126af0863b39a6e63c08820f69cf0ae582a31bfc1052db`

30002

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x2e8`
TimeDateStamp	2024-Nov-13 08:50:15
Entropy	`1.76987`
MD5	`24799ca590d42134e7103b06d46fd960`
SHA1	`4af9a0fe3b7371abc50a18e851f3122fce9a2ffa`
SHA256	`a32e750bc1b0315530097434a7e1d324b843e1f5ffd95238b49d3a8aa8e6fe09`
SHA3	`9a17698629ef5e7a1c567a9669be74aa2c9d8356ecfba40c48811e4dcf5ea875`

30003

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x128`
TimeDateStamp	2024-Nov-13 08:50:15
Entropy	`2.07177`
MD5	`e6c5053ba1c848d7e16701a2d08fb8c6`
SHA1	`f253482c0fa25197130f6475f2ded060527843bf`
SHA256	`46dc088910439dad6a0d69da5e64227d04a640845fd1c31e90a7d4340c539fe0`
SHA3	`1e6c369197dd1a466ea87357db49ec559ecf82c0c3fa13af1a383445945861e6`

1

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x30`
TimeDateStamp	2024-Nov-13 08:50:15
Entropy	`2.97836`
Detected Filetype	Icon file
MD5	`835a20def9b2661b64b8ac06b4901f36`
SHA1	`70732dac88537f00c89d105f986ef843d3aca818`
SHA256	`cbdcb84268fcf2a25b844c1dca787de835c0376e82c1a2e62814a3c940a26cfb`
SHA3	`9a2de99425a7e2086c65d82719bf44696cfe58b8077ce214e814ceeeb78ba1f4`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	Unicode (UTF 16LE)
Size	`0x214`
TimeDateStamp	2024-Nov-13 08:50:15
Entropy	`3.1256`
MD5	`7dac917392ae7c30881ab64a388b794c`
SHA1	`1a3b6edf128bae6339e0b1a6a3116a1bd30057cd`
SHA256	`dd56e52fea3f9218e4e0f40601c42ed6bd63202df1c3b82f000b5cefe297203d`
SHA3	`a7a5db0e8253e3207e72235654f2eed4e28f2ae9db24abcbff68e69101333d44`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	imc fsd
ProductName	Project1
FileVersion (#2)	1.00
ProductVersion (#2)	1.00
InternalName	echocard
OriginalFilename	echocard.exe

Resource LangID	English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0x8917de83`
Unmarked objects	`0`
14 (7299)	`1`
9 (8783)	`4`
13 (VS98 SP6 build 8804)	`1`

Errors

Leave a comment

No comments yet.