af73842df4612ac8ea0163d0d65def6f1052733d1765ec1a4c093c4cf771d79b

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2004-Mar-02 08:03:38
Detected languages English - United States

Plugin Output

Suspicious The PE is possibly packed. Section .text is both writable and executable.
Section .rsrc is both writable and executable.
The PE only has 4 import(s).
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Malicious VirusTotal score: 3/71 (Scanned on 2026-11-01 18:08:52) Kingsoft: malware.kb.a.999
Malwarebytes: Malware.Heuristic.2014
Trapmine: suspicious.low.ml.score

Hashes

MD5 acdf185fe7767d711fc99cb57df46044 🔍
SHA1 6ba82f1f0990719a4c32d8b450b51bcc9ea99e9c 🔍
SHA256 af73842df4612ac8ea0163d0d65def6f1052733d1765ec1a4c093c4cf771d79b 🔍
SHA3 5d016ba9d60f2509f84a8043c7919d7607f307045ddc8d64b861ff15812661fc 🔍
SSDeep 12288:otalu5H2ZcD3lfC0cQlqyFwnbBqOlxQEzDBqjy5S0Sija:6ku5WZ4lfWQUyFel7zAQSk 🔍
Imports Hash 09d0478591d4f788cb3e5ea416c25237 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 2
TimeDateStamp 2004-Mar-02 08:03:38
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 7.0
SizeOfCode 0x132000
SizeOfInitializedData 0x1331000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001000 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x133000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x1467000
SizeOfHeaders 0x400
Checksum 0x9b4b1
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x800000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ed097fe8ec2395144c054534c74e0e9e 🔍
SHA1 ad7e33f5015a16d7c26c8046b81cf154f216e20f 🔍
SHA256 3491f1a565c2ba01804fcfee889c05a8a83cbd0a00a4da5c9f6fd43e209edf7c 🔍
SHA3 5c9c5bbc15c99ff292c0a9c69eae966032a1cca1aea3accbabcd68f65edb3fe9 🔍
VirtualSize 0x1463000
VirtualAddress 0x1000
SizeOfRawData 0x92c00
PointerToRawData 0x400
PointerToRelocations 0x32434550
PointerToLineNumbers 0x4f10
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99965

.rsrc

MD5 cf2a6144b7bf6c8c3645f359dd71d526 🔍
SHA1 be427f62d104b6eb495781f45480dab84674dc7b 🔍
SHA256 27770ec2c0a96f4349f22a3b2d770fd9a685d1f592c6fb62596f01a78516398f 🔍
SHA3 a98f9419c2ac6f4bca71d5a1de9874ab62280c0fd27122e2a1f104cf4c9bb73f 🔍
VirtualSize 0x3000
VirtualAddress 0x1464000
SizeOfRawData 0x2200
PointerToRawData 0x93000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.13004

Imports

kernel32.dll LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Delayed Imports

1

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x3042a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍

128

Type RT_BITMAP
Language English - United States
Codepage UNKNOWN
Size 0x1428
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍

1 (#2)

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.56852
MD5 e03a51eae72d96e0e62a0672b0341813 🔍
SHA1 aa5e9fc87c4a7c725663b092ac3d3c3754913fa7 🔍
SHA256 6af8671a8dc20240cb1474e2f2b331311c79dc5866b984a18b94144f4bafab1e 🔍
SHA3 c186bb3b11ff4d98d1dc5ad37927b748ab41e4fd0796c02b590bb1f247e5689d 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.64952
MD5 99b6bda83523d3808af3b692277d1642 🔍
SHA1 af0e99f8a0c92b749fb70b32c7c6694eb72a7bb2 🔍
SHA256 ee0fc678aea8839d6e6f289cf4b8c609f2090480ef58d4d8d68084e581fac073 🔍
SHA3 341c234b854de28dae0063244708473ff8cb0295a983882d3c8d200dbeb1c24f 🔍

1 (#3)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x38
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍

1 (#4)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.32824
Detected Filetype Icon file
MD5 62d6b1d51e9721a781148fb63c1970c6 🔍
SHA1 0491f06e0b5fe9241d44138303ece1776840fd6d 🔍
SHA256 1d47c7bd2cc20089bc0387c8e7ac0a1680e9b4dc81dbde998c3c5c8e6c7d69aa 🔍
SHA3 9f1474d08ea9f8bc44f2b127a2a96dbaaed16872128ddd81afe07b2b3756d3bd 🔍

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xf91d23d8
Unmarked objects 0
C++ objects (VS2002 (.NET) build 9466) 15
39 (9162) 10
ASM objects (VS2002 (.NET) build 9466) 47
Imports (9111) 2
C objects (VS2002 (.NET) build 9466) 171
Imports (VS2002 (.NET) build 9466) 2
Imports (9210) 13
Total imports 272
43 (VS2002 (.NET) build 9466) 179
Resource objects (VS2002 (.NET) build 9466) 1
Linker (VS2002 (.NET) build 9466) 1

Errors

[!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 128 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 128 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 128 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Bitmap is malformed! [!] Error: Resource 128 is bigger than the PE. Not trying to load it in memory. [!] Error: Bitmap is malformed! [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 128 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 128 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory. [!] Error: Resource 1 is bigger than the PE. Not trying to load it in memory.
Leave a comment

No comments yet.