a3d74dfb66d80b36d3ba750363100b75

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2015-Apr-29 15:17:40
Detected languages English - United States
Russian - Russia
CompanyName ООО Корпорация
FileDescription Описание
FileVersion 6.1.2600.0012
InternalName FDownloader
LegalCopyright © ООО Корпорация
OriginalFilename FDownloader
ProductName Загрузчик
ProductVersion 6.1.2600.0012

Plugin Output

Info Matching compiler(s): Microsoft Visual C++
Microsoft Visual C++ v6.0
Microsoft Visual C++ v5.0/v6.0 (MFC)
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA1
Suspicious The PE is possibly packed. Unusual section name found: .qdata
Unusual section name found: .data\x00\x00\x01
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Info The PE is digitally signed. Signer: Consortium ltd..
Issuer: DigiCert SHA2 Assured ID Code Signing CA.
Malicious VirusTotal score: 48/61 (Scanned on 2017-05-18 17:52:46) MicroWorld-eScan: Gen:Variant.Adware.Symmi.51539
CAT-QuickHeal: Trojan.Extenbro.18677
ALYac: Gen:Variant.Adware.Symmi.51539
Malwarebytes: Adware.ICLoader
SUPERAntiSpyware: PUP.LoadMoney/Variant
CrowdStrike: malicious_confidence_100% (D)
K7GW: Adware ( 004b73ea1 )
K7AntiVirus: Adware ( 004b73ea1 )
Invincea: virus.win32.jadtre.a!a
Baidu: Win32.Trojan.Kryptik.sz
F-Prot: W32/S-776b3e14!Eldorado
Symantec: Trojan.Gen.6
TrendMicro-HouseCall: TROJ_GEN.R00XC0PEI17
ClamAV: Win.Adware.Agent-1287372
Kaspersky: not-a-virus:AdWare.Win32.ICLoader.iti
BitDefender: Gen:Variant.Adware.Symmi.51539
NANO-Antivirus: Trojan.Win32.InstallCube.dreene
Avast: Win32:InstallCube-BV [PUP]
Ad-Aware: Gen:Variant.Adware.Symmi.51539
Sophos: ICLoader (PUA)
Comodo: Application.Win32.ICLoader.BACA
F-Secure: Gen:Variant.Adware.Symmi
DrWeb: Trojan.InstallCube.196
Zillya: Adware.ICLoaderCRT.Win32.92
McAfee-GW-Edition: BehavesLike.Win32.ICLoader.fc
Emsisoft: Gen:Variant.Adware.Symmi.51539 (B)
SentinelOne: static engine - malicious
Cyren: W32/S-776b3e14!Eldorado
Jiangmin: AdWare/ICLoader.awh
Avira: ADWARE/ICLoader.Gen4
Fortinet: W32/Kryptik.DJDR!tr
Antiy-AVL: GrayWare[AdWare]/Win32.ICLoader.iti
Endgame: malicious (high confidence)
Arcabit: Trojan.Adware.Symmi.DC953
AegisLab: AdWare.MSIL.DomaIQ.mlp7
ZoneAlarm: not-a-virus:AdWare.Win32.ICLoader.iti
Microsoft: SoftwareBundler:Win32/ICLoader
AhnLab-V3: PUP/Win32.Agent.R148042
McAfee: ICLoader
VBA32: Signed-Downware.ICloader
ESET-NOD32: Win32/Adware.ICLoader.IC
Rising: Malware.Generic.1!tfe (thunder:1:j9LCpUxK6bU)
Yandex: PUA.ICLoader!
Ikarus: PUA.ICLoader
GData: Gen:Variant.Adware.Symmi.51539
AVG: AdInstaller
Panda: Trj/Genetic.gen
Qihoo-360: Win32/Virus.Adware.656

Hashes

MD5 a3d74dfb66d80b36d3ba750363100b75
SHA1 39737fefa2bc7f4f6ba6d08bce5b20cf4a52e7d5
SHA256 a189bc68bff2fc8742c6a6749638320f8062054ab8adf6926204e75617a0df52
SHA3 cebb95641440455bc79dd2faec872cd611f9cdb2dbbc4fa0fc12babb57c804ed
SSDeep 6144:NFkLQrMQ5iz/DKzpaLsi3xZWeKP8EytCgJn5gotBpAuS8Bq3uJM:rkLQrMQ5iPSaLvTW8sa+oZABiJM
Imports Hash bb4abdb5bfab9b7023c0d5b6aac64572

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2015-Apr-29 15:17:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x43000
SizeOfInitializedData 0xd000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x3f348 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x44000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x51000
SizeOfHeaders 0x1000
Checksum 0x56254
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics (EMPTY)
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 04e88270732581ee4f463ba7a831e315
SHA1 3008404c8fe5324fb70ea4d273d6b9e500209d3b
SHA256 d7a5a46904831d4e2feea3d55bcb25d3ea33ea08d44b080e920510e13a1e86ff
SHA3 b764d2217ead5a53b31884b6c3e237e8053774cf0843c3552c4f7f88fd96bffe
VirtualSize 0x429ae
VirtualAddress 0x1000
SizeOfRawData 0x43000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.95051

.qdata

MD5 3aa855737df0f64be61f3353c3a21626
SHA1 830fdd2fb102febba9ff3657a97492aee7d6926e
SHA256 34e08d9c3241667a5e031d23d21ca1e74d7b472d7ac88d99bb77ce9d9be37e2e
SHA3 976995f3fd4761960e7a2eee790eac37c8727521d4266166a37f3d2e052d82a2
VirtualSize 0xee4
VirtualAddress 0x44000
SizeOfRawData 0x1000
PointerToRawData 0x44000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_LNK_NRELOC_OVFL
IMAGE_SCN_MEM_READ
IMAGE_SCN_TYPE_NOLOAD
Entropy 5.2476

.data\x00\x00\x01

MD5 77a885e2e2ef45965eace933d114c974
SHA1 035e87a28780170b3b6fdb1ba1e3de03e5845548
SHA256 88df51b9f4e89dd0d63ddb88fd4b6890a98cddc69ee37eeffdde83dc957aa4ab
SHA3 5b82ad12bd157e462b276b76d51bdb79a87358cbf10875a882769f9921913f96
VirtualSize 0x471c
VirtualAddress 0x45000
SizeOfRawData 0x3000
PointerToRawData 0x45000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.619167

.rsrc

MD5 4ef8bc1631279797d1b63c76e90d630d
SHA1 af8ef6ed9600bf151446b24985189ae8046d96d5
SHA256 9197ad9060a85aaae035a155118825f1fbbd11fd677f32cf7a1110fb8bbae6f5
SHA3 90c519c2fd0abb1215f36512cc28a10d1d0822f4d0db417ba4bd6e982c3061c6
VirtualSize 0x69b8
VirtualAddress 0x4a000
SizeOfRawData 0x7000
PointerToRawData 0x48000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.70648

Imports

COMCTL32.dll #17
VERSION.dll VerQueryValueW
KERNEL32.dll GetVersion
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
GetCommandLineW
WriteFile
VirtualAlloc
CreateFileA
ReadFile
lstrcmpiA
LockResource
TlsSetValue
GetLastError
CreateFileMappingA
FileTimeToDosDateTime
EnumCalendarInfoA
CreateEventA
CompareStringA
CloseHandle
GetCurrentProcess
GetUserDefaultLangID
QueryPerformanceCounter
CreateThread
SetErrorMode
GetModuleHandleA
MultiByteToWideChar
SetFilePointer
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
GetStringTypeW
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
ExitProcess
TlsGetValue
GetStartupInfoA
DeleteFileW
GetVersionExA
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
HeapFree
GetProcAddress
GetCommandLineA
LCMapStringW
GetStringTypeA
LCMapStringA
USER32.dll EndPaint
CreateWindowExA
GetSystemMetrics
MessageBoxA
CreateDialogParamA
ShowWindow
RegisterClipboardFormatA
CharNextA
LoadStringA
GetKeyboardType
GetScrollPos
PtInRect
RemoveMenu
GetClientRect
RegisterClassExA
EndDialog
DialogBoxParamA
GDI32.dll TextOutW
Rectangle
comdlg32.dll ChooseFontA
GetOpenFileNameA
FindTextW
GetSaveFileNameA
ADVAPI32.dll GetUserNameA
AllocateAndInitializeSid
RegCloseKey
RegSetValueExW
SHELL32.dll StrStrIA
ole32.dll CoInitialize
CoTaskMemAlloc
CoUninitialize
OLEAUT32.dll #175

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
Entropy 4.32398
MD5 61b537e9694adc424f6e5b577100d84e
SHA1 a42887d811efe6bfa2f4a1937a7a294e62a6a1a8
SHA256 873de50ce3936c17cd2c8cec8763789ed47ce4ee979e43f6da3c7a97b822b100
SHA3 ef54c49400611215ea90965d05ca3e9678111f338ad17265c43ef84e869c5fcf

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
Entropy 4.83211
MD5 671dd025a01658bc17d623226dea0feb
SHA1 017150eaa6133fcd9eb1ebad952582d95b01e177
SHA256 98db7e41a33c96ccc60b0debae0c9c7e5abed4ec604eb770eb0173c4a42c6379
SHA3 a1099cac4d97c49e9546cb5eb33663e704735f1b90557f0ff9694ca30d907821

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
Entropy 5.13379
MD5 8953d930aaf85b820cf19a35f9e28d3d
SHA1 d562bb54c6d20fa6c530ecc7f2751107ea1f8b96
SHA256 b452b03062ddd5c2e1e72f9bd51a45f551aed3e5ac741e55e91510569b9aa70f
SHA3 20121f2566081423e0c93a29252fa2a7c39b27c01b626a4691066b0e54abb867

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
Entropy 6.25747
MD5 5354c7066a7bae6777668bbe77ce5329
SHA1 5a0dde8e03433105266b6c561e3f59251bed9d4a
SHA256 d914193208662784ad38cf883eebe2a65d186ce6f6af9b69d1fceb290409806f
SHA3 83372e7d3493650e4f65e9a1b5b2646e3c3e9d644878dcbda690b95d3018416a

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
Entropy 5.77753
MD5 ad2a24aa2e8c301cbc9079e7d4356d3c
SHA1 cb9cedd207f4f064240dcb2897c4b002a90c6bc8
SHA256 220aee9709be47e843bf9286338e109775f324be6b41adec9d9269e14f1b7dd2
SHA3 238adf36db74e5109fc694d55f8a40627042f801f8ac4e73ce9d51f8536324a4

MAINICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x30
Entropy 2.50016
Detected Filetype Icon file
MD5 cbb5e98bc6f602fa33226e9855c470b9
SHA1 5071ae4f377f2871312db58d780103c0dc1ee3d7
SHA256 eb1d25243ea4e9b60ccffd55dc287a2201689aa6a43eb840f01062c9338b0004
SHA3 51446498819c224f8d843befbe73c562d5884fb6e68516b84dd831a9acdb8196

138

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
Entropy 1.9815
Detected Filetype Icon file
MD5 40c1414025bcc34e7ba97fd22bc9f5a4
SHA1 b53a6a13513b5205cef6fc6d7556ad80d8b62173
SHA256 d6659139f55adad2497df8d1a11fcd68324a00ccdadbc133ddd49fb79e9ccc1c
SHA3 88871307cc5c77b12020834d9c86e600c63ba1bf44d5c6af4f4274103d294cb5

150

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
Entropy 2.0815
Detected Filetype Icon file
MD5 9b2193af49fdb53892356f594e9f18b9
SHA1 448aa28721dd65475b37505de8140d88d5aa1501
SHA256 9b8ca9c6a330d0d17d1108ab5442d60ea574817a65caa860cceb24313cc4f0e4
SHA3 abaa5f2eda818b5a367cd3d8805e1f65f1eee97ac7c4ebdfbe1719e72a4ca8c1

1 (#2)

Type RT_VERSION
Language Russian - Russia
Codepage UNKNOWN
Size 0x2c8
Entropy 3.77019
MD5 5a019dca6e829e7e5751bee2f96f528d
SHA1 5deec018a3b4ff388b4205577d21544adbb1cc5c
SHA256 46f282fcab11b30be9051d30551d7669ff862d9beae16a5bba9ba9f50b293d26
SHA3 bca3de482f0b75abb91308d68c994e3494a19f299e3946105fe30f2acd8fce28

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x42c
Entropy 5.33361
MD5 fa140205692392be88038eaba9ca7910
SHA1 4ede0ea94437564dc9b1d1d989e3116e92a1a4dc
SHA256 1f4b3a5657ae0d8242461a11cb08b8adf8e46a21fb612336311fcba10faccb61
SHA3 af7f942fb89f5d58640989679f579b6f33d592772b62c021de7a39dd6b4bf667

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 5.1.2600.5512
ProductVersion 5.1.2600.5512
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language Russian - Russia
CompanyName ООО Корпорация
FileDescription Описание
FileVersion (#2) 6.1.2600.0012
InternalName FDownloader
LegalCopyright © ООО Корпорация
OriginalFilename FDownloader
ProductName Загрузчик
ProductVersion (#2) 6.1.2600.0012
Resource LangID Russian - Russia

TLS Callbacks

Load Configuration

RICH Header

Errors