a8ae952cb322e88d2a3e701065c835af
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1992-Jun-19 22:22:17 |
Plugin Output
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE header may have been manually modified. |
The resource timestamps differ from the PE header:
|
| Malicious | VirusTotal score: 15/57 (Scanned on 2016-09-07 17:46:45) |
Bkav:
W32.eHeur.Malware03
MicroWorld-eScan: Gen:Variant.Application.Bundler.DealPly.84 Arcabit: Trojan.Application.Bundler.DealPly.84 Invincea: backdoor.win32.hupigon.ck Symantec: Heur.AdvML.B BitDefender: Gen:Variant.Application.Bundler.DealPly.84 Ad-Aware: Gen:Variant.Application.Bundler.DealPly.84 F-Secure: Gen:Variant.Application.Bundler Zillya: Trojan.DealPlyGen.Win32.1 Avira: ADWARE/DealPly.rsopq Antiy-AVL: Trojan/Win32.TSGeneric GData: Gen:Variant.Application.Bundler.DealPly.84 Rising: Malware.Generic!9FgXlMvQNxH@3 (thunder) Ikarus: PUA.DealPly.Da Qihoo-360: HEUR/QVM05.1.0000.Malware.Gen |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 8 |
| TimeDateStamp | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x55200 |
| SizeOfInitializedData | 0x8400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00056100 (Section: CODE) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x57000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 1.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x64000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Imports
| kernel32.dll |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc WideCharToMultiByte TlsSetValue TlsGetValue MultiByteToWideChar GetModuleHandleA GetLastError GetCommandLineA WriteFile SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType ExitProcess CreateFileA CloseHandle |
|---|---|
| user32.dll |
MessageBoxA
|
| oleaut32.dll |
VariantChangeTypeEx
VariantCopyInd VariantClear SysStringLen SysAllocStringLen |
| kernel32.dll (#2) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc WideCharToMultiByte TlsSetValue TlsGetValue MultiByteToWideChar GetModuleHandleA GetLastError GetCommandLineA WriteFile SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType ExitProcess CreateFileA CloseHandle |
| gdi32.dll |
UnrealizeObject
StretchBlt SetWindowOrgEx SetViewportOrgEx SetTextColor SetROP2 SetBkMode SetBkColor SelectPalette SelectObject SaveDC RestoreDC RectVisible RealizePalette MoveToEx IntersectClipRect GetWindowOrgEx GetTextExtentPointA GetStockObject GetObjectA GetDeviceCaps GetDIBits GetCurrentPositionEx GetBitmapBits ExcludeClipRect EnumFontsA DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreateFontIndirectA CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap |
| user32.dll (#2) |
MessageBoxA
|
| comctl32.dll |
ImageList_GetDragImage
ImageList_DragShowNolock ImageList_SetDragCursorImage ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Destroy ImageList_Create |
Delayed Imports
1
2
3
4
5
6
1 (#2)
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
4089
4090
4091
4093
4094
4095
TBADAP
32762
32763
32764
32765
32766
32767
MAINICON
1 (#3)
String Table contents
| Cannot assign a %s to a %s |
| Cannot create file %s |
| Cannot open file %s |
| Stream read error |
| Stream write error |
| Out of memory while expanding memory stream |
| Can't write to a read-only resource stream |
| WriteObject called twice for the same instance |
| Class %s not found |
| Invalid stream format |
| Resource %s not found |
| Resource %s is of incorrect class |
| List index out of bounds |
| Operation not allowed on sorted string list |
| String list does not allow duplicates |
| Tab index out of bounds |
| A component named %s already exists |
| ''%s'' is not a valid component name |
| A class named %s already exists |
| ''%s'' is not a valid integer value |
| Line too long |
| Invalid property value |
| Invalid property path |
| Property does not exist |
| Property is read-only |
| Error reading %s.%s: %s |
| Ancestor for '%s' not found |
| Bitmap image is not valid |
| Icon image is not valid |
| Metafile is not valid |
| Bitmap is empty |
| Cannot change the size of an icon |
| Unknown picture file extension (.%s) |
| Unsupported clipboard format |
| Out of system resources |
| Canvas does not allow drawing |
| Invalid image size |
| Too many images |
| Image dimensions do not match image list dimensions |
| Invalid ImageList |
| Unable to Replace Image |
| Invalid ImageList Index |
| Error creating window device context |
| Client of TDrag not initialized |
| Error creating window class |
| Error creating window |
| Cannot focus a disabled or invisible window |
| Control '%s' has no parent window |
| Cannot hide an MDI Child Form |
| Cannot change Visible in OnShow or OnHide |
| Cannot make a visible window modal |
| Scrollbar property out of range |
| %s property out of range |
| Menu index out of range |
| Menu inserted twice |
| Sub-menu is not in menu |
| Not enough timers available |
| Printer is not currently printing |
| Printing in progress |
| Printer index out of range |
| Printer selected is not valid |
| %s on %s |
| GroupIndex cannot be less than a previous menu item's GroupIndex |
| Cannot have more than one MDI form per application |
| Cannot create form. No MDI forms are currently active |
| Invalid component registration |
| Can only modify an image if it contains a bitmap |
| A control cannot have itself as its parent |
| OK |
| Cancel |
| &Yes |
| &No |
| &Help |
| &Close |
| &Ignore |
| &Retry |
| Abort |
| &All |
| Cannot drag a form |
| PutObject to undefined item |
| Could not load CARDS.DLL |
| Duplicate CardId found |
| An error returned from DDE ($0%x) |
| DDE Error - conversation not established ($0%x) |
| Error occurred when DDE ran out of memory ($0%x) |
| Unable to connect DDE conversation |
| FB |
| FG |
| BG |
| Cannot load older version of TShape |
| Metafiles |
| Enhanced Metafiles |
| Icons |
| Bitmaps |
| Grid too large for operation |
| Too many rows or columns deleted |
| Grid index out of range |
| Fixed column count must be less than column count |
| Fixed row count must be less than row count |
| %s on line %d |
| Identifier expected |
| String expected |
| Number expected |
| ''%s'' expected |
| %s expected |
| Invalid numeric value |
| Invalid string constant |
| Invalid property value |
| Invalid binary value |
| Outline index not found |
| Parent must be expanded |
| Invalid value for current item |
| Invalid input value |
| Invalid input value. Use escape key to abandon changes |
| Invalid outline index |
| Incorrect level assignment |
| Invalid selection |
| File load error |
| Line too long |
| Maximum outline depth exceeded |
| Warning |
| Error |
| Information |
| Confirm |
| &Yes |
| &No |
| OK |
| Cancel |
| &Help |
| No help available |
| Help |
| &Abort |
| &Retry |
| &Ignore |
| &All |
| BkSp |
| Tab |
| Esc |
| Enter |
| Space |
| PgUp |
| PgDn |
| End |
| Home |
| Left |
| Up |
| Right |
| Down |
| Ins |
| Del |
| Shift+ |
| Ctrl+ |
| Alt+ |
| (Unknown) |
| (None) |
| Value must be between %d and %d |
| Cannot create a default method name for an unnamed component |
| Invalid argument to date encode |
| Invalid argument to time encode |
| ''%s'' is not a valid date |
| ''%s'' is not a valid time |
| ''%s'' is not a valid date and time |
| Invalid file name - %s |
| All files (*.*)|*.* |
| All |
| : [ - no volume label - ] |
| Unable to insert a line |
| The specified directory does not exist. Create it? |
| Select Directory |
| Directory &Name: |
| D&rives: |
| &Directories: |
| &Files: (*.*) |
| Ne&twork... |
| Color |
| ABCDEFGHIJKLMNOP |
| Invalid clipboard format |
| Clipboard does not support Icons |
| Default |
| Text exceeds memo capacity |
| Custom Colors |
| Operation not supported on selected printer |
| There is no default printer currently selected |
| Unable to write to %s |
| Bits index out of range |
| (Untitled) |
| Invalid data type for '%s' |
| Failed to create key %s |
| Failed to set data for '%s' |
| Failed to get data for '%s' |
| Synchronize called when main VCL thread in a WaitFor call |
| Unknown RichEdit conversion file extension (.%s) |
| Menu '%s' is already being used by another form |
| '%s' is not a valid integer value |
| '%s' is not a valid floating point value |
| '%s' is not a valid date |
| '%s' is not a valid time |
| '%s' is not a valid date and time |
| Invalid argument to time encode |
| Invalid argument to date encode |
| Out of memory |
| I/O error %d |
| File not found |
| Invalid filename |
| Too many open files |
| File access denied |
| Read beyond end of file |
| Disk full |
| Invalid numeric input |
| Division by zero |
| Range check error |
| Integer overflow |
| Invalid floating point operation |
| Floating point division by zero |
| Floating point overflow |
| Floating point underflow |
| Invalid pointer operation |
| Invalid class typecast |
| Access violation at address %p. %s of address %p |
| Stack overflow |
| Control-C hit |
| Privileged instruction |
| Operation aborted |
| Exception %s in module %s at %p. |
| %s%s |
| Application Error |
| Format '%s' invalid or incompatible with argument |
| No argument for format '%s' |
| Invalid variant type conversion |
| Invalid variant operation |
| Variant method calls not supported |
| Read |
| Write |
| Format result longer than 4096 characters |
| Format string too long |
| Error creating variant array |
| Variant is not an array |
| Variant array index out of bounds |
| External exception %x |
| Jan |
| Feb |
| Mar |
| Apr |
| May |
| Jun |
| Jul |
| Aug |
| Sep |
| Oct |
| Nov |
| Dec |
| January |
| February |
| March |
| April |
| May |
| June |
| July |
| August |
| September |
| October |
| November |
| December |
| Sun |
| Mon |
| Tue |
| Wed |
| Thu |
| Fri |
| Sat |
| Sunday |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Saturday |
Version Info
TLS Callbacks
| StartAddressOfRawData | 0x45b000 |
|---|---|
| EndAddressOfRawData | 0x45b008 |
| AddressOfIndex | 0x4583d4 |
| AddressOfCallbacks | 0x45c010 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |
Load Configuration
RICH Header
Errors
[*] Warning: Section BSS has a size of 0!
[*] Warning: Section .tls has a size of 0!