| Architecture |
IMAGE_FILE_MACHINE_I386
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date |
2011-Nov-08 23:03:23
|
| Detected languages |
English - United States
|
|
Info
|
Matching compiler(s): |
Microsoft Visual C++
Microsoft Visual C++ v6.0
|
|
Suspicious
|
PEiD Signature: |
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h)
UPX -> www.upx.sourceforge.net
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
|
|
Suspicious
|
The PE is possibly packed. |
Unusual section name found: LOL0
Section LOL0 is both writable and executable.
Unusual section name found: LOL1
Section LOL1 is both writable and executable.
The PE only has 0 import(s).
|
|
Suspicious
|
The PE contains functions most legitimate programs don't use. |
Leverages the raw socket API to access the Internet:
|
|
Suspicious
|
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
| MD5 |
1fb8f0bcd0abb74c3c111c94aa7a5f60
🔍
|
| SHA1 |
32959618857d36a02d654627d527b9b5c1ac5c77
🔍
|
| SHA256 |
a51bb45ed5d1aec630dc3a795479801847022d4d0dd5e2dc8423e06f425caf45
🔍
|
| SHA3 |
0e180b8511590a062a2b052cfd160bc89454d967dd286a3cab8824da6928b4c4
🔍
|
| SSDeep |
384:N7L2TOjSMsXu0Pip5Na32mlRfTlyKU+jH9jogzyPO8uAgVIzVtmdpfe1nk6EtO:N30OjKxoNa5b9cg+G8hzVtKoO
🔍
|
| Imports Hash |
d41d8cd98f00b204e9800998ecf8427e
🔍
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0xf0
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections |
3
|
| TimeDateStamp |
2011-Nov-08 23:03:23
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xe0
|
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic |
PE32
|
| LinkerVersion |
6.0
|
| SizeOfCode |
0x4000
|
| SizeOfInitializedData |
0x1000
|
| SizeOfUninitializedData |
0x7000
|
| AddressOfEntryPoint |
0x00001681 (Section: LOL0)
|
| BaseOfCode |
0x8000
|
| BaseOfData |
0xc000
|
| ImageBase |
0x400000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
0.0
|
| SubsystemVersion |
4.0
|
| Win32VersionValue |
0
|
| SizeOfImage |
0xd000
|
| SizeOfHeaders |
0x400
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve |
0x100000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
8f9e38a6cadb92bbd2a26e5dbb15217d
🔍
|
| SHA1 |
b4dd9a390f04dcaa5a472e66100e9b326da5afad
🔍
|
| SHA256 |
4aea00b362913c7d035cb3c3170a34f1d68a9f2a8fef51bc06adc0f5d760e4f0
🔍
|
| SHA3 |
c917dfdc60bcedc8e2fea753c6024e6a9ef8a2f0831c230936857a7877c4ce62
🔍
|
| VirtualSize |
0x7000
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0x5a00
|
| PointerToRawData |
0x400
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
5.79702
|
| MD5 |
767e172442b8e514eed14c3f3d24a432
🔍
|
| SHA1 |
8a29dec707ca17fe59cb4168fd04ffae9309ecf9
🔍
|
| SHA256 |
55c3fd933a313b5917a2cbe05954c4f541ea47ef8c0a58963c3f4569ac2db971
🔍
|
| SHA3 |
5890e2b0ad0e417afd799f2fe467d1b3042351d702af522136a8c9c9d02dc99d
🔍
|
| VirtualSize |
0x4000
|
| VirtualAddress |
0x8000
|
| SizeOfRawData |
0x3200
|
| PointerToRawData |
0x5e00
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
5.78978
|
| MD5 |
45a18c9b4b5fd0b3d6c269e06466c707
🔍
|
| SHA1 |
deeaa1df5ab9e0b18ec67eab7b8ad6e4a3a5eaf2
🔍
|
| SHA256 |
dda2231d8c40a22f50de26f9ca20e73f641762eb6206722be250427921d5284c
🔍
|
| SHA3 |
02115da390180d28001496160f2086b8391b9df522f176bb1d1204cb78cbada1
🔍
|
| VirtualSize |
0x1000
|
| VirtualAddress |
0xc000
|
| SizeOfRawData |
0x200
|
| PointerToRawData |
0x9000
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
2.86792
|
| KERNEL32.DLL |
(EMPTY)
|
| WININET.dll |
(EMPTY)
|
| WS2_32.dll |
(EMPTY)
|
| Type |
RT_RCDATA
|
| Language |
English - United States
|
| Codepage |
UNKNOWN
|
| Size |
0x20
|
| TimeDateStamp |
1980-Jan-01 00:00:00
|
| Entropy |
3.65564
|
| MD5 |
8b37145c184cd91a05a9f1be8dbc9cf9
🔍
|
| SHA1 |
6d54c2a67753eeac8986ef0aff9de328fb3ff51f
🔍
|
| SHA256 |
32b1177c11f0f714b162d1de807fad0f54be7b641f4fc2aabadc16af660d8faf
🔍
|
| SHA3 |
96cba27917ad748f794663ae602be3bad566ea24e3937e5791f5563cf031e958
🔍
|
[!] Error: Could not reach the HINT/NAME table.
[*] Warning: An error occurred while trying to read functions imported by module KERNEL32.DLL.