Architecture |
IMAGE_FILE_MACHINE_I386
|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
Compilation Date |
1970-Jan-01 00:00:00
|
Info |
Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 8.0
|
Suspicious |
The PE is possibly packed. |
The PE only has 1 import(s).
|
Suspicious |
No VirusTotal score. |
This file has never been scanned on VirusTotal.
|
MD5 |
b0a174ba5e122a46e9cc25bbbaa622b9
|
SHA1 |
c66b4d92f3b2ef0d3ca5b67bce50a7b9dab5e1d3
|
SHA256 |
d7d0276dbf37730ebe4c359e933bbec3ce9716389bf84e7145e13c0eef71e166
|
SHA3 |
46aaba276409a4294e59ef0e9c6e4a9ab8100931f9382ec9ed36e8c6365b2810
|
SSDeep |
1536:RN3pq+dJm/BxyDskXy7Xxzr+4MRsw0hR0enIeTCNHXeSOY:73uBUskIskIiC
|
Imports Hash |
e54bd6d7e1f8cc11634350917c4eef06
|
e_magic |
MZ
|
e_cblp |
0x90
|
e_cp |
0x3
|
e_crlc |
0
|
e_cparhdr |
0x4
|
e_minalloc |
0
|
e_maxalloc |
0xffff
|
e_ss |
0
|
e_sp |
0xb8
|
e_csum |
0
|
e_ip |
0
|
e_cs |
0
|
e_ovno |
0
|
e_oemid |
0
|
e_oeminfo |
0
|
e_lfanew |
0x80
|
Signature |
PE
|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections |
4
|
TimeDateStamp |
1970-Jan-01 00:00:00
|
PointerToSymbolTable |
0
|
NumberOfSymbols |
0
|
SizeOfOptionalHeader |
0xe0
|
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
Magic |
PE32
|
LinkerVersion |
3.0
|
SizeOfCode |
0x1b1e2
|
SizeOfInitializedData |
0x4440
|
SizeOfUninitializedData |
0x449cf5
|
AddressOfEntryPoint |
0x0001BEEE (Section: .text)
|
BaseOfCode |
0x1000
|
BaseOfData |
0x1d000
|
ImageBase |
0x400000
|
SectionAlignment |
0x1000
|
FileAlignment |
0x200
|
OperatingSystemVersion |
4.0
|
ImageVersion |
0.0
|
SubsystemVersion |
4.0
|
Win32VersionValue |
0
|
SizeOfImage |
0x46d000
|
SizeOfHeaders |
0x400
|
Checksum |
0
|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
SizeofStackReserve |
0x1000000
|
SizeofStackCommit |
0x100000
|
SizeofHeapReserve |
0x1000000
|
SizeofHeapCommit |
0x100000
|
LoaderFlags |
0
|
NumberOfRvaAndSizes |
16
|
MD5 |
4f6eb78330a519876a53805d2ea4b605
|
SHA1 |
eed24bd8839a9a8f96d31696aa50a56096c2aa22
|
SHA256 |
c5b8ed7af84e0f08213552d5098d290745e0f90da6ebe640acd33f0b08fd57d1
|
SHA3 |
b412989ae855df4cb2f98f265adf0e0f1c3c618885b8bf213af6f4a170ea4bb4
|
VirtualSize |
0x1b1e2
|
VirtualAddress |
0x1000
|
SizeOfRawData |
0x1b200
|
PointerToRawData |
0x400
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
Entropy |
5.33412
|
MD5 |
8b12be45890bf2c24bbb84517caf882c
|
SHA1 |
282d5ead17f92faa9f91037dd5686ddd43a17856
|
SHA256 |
08e2428f1d9edae20f8fac0ebd197d9a8964b8d536901015ae95eddcbf68dd19
|
SHA3 |
35749f9ca06256b68aadc6834693ec53fefaf35766bcbfc607465b4b96af2894
|
VirtualSize |
0x4440
|
VirtualAddress |
0x1d000
|
SizeOfRawData |
0x4600
|
PointerToRawData |
0x1b600
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
Entropy |
2.64772
|
MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
|
VirtualSize |
0x449cf5
|
VirtualAddress |
0x22000
|
SizeOfRawData |
0
|
PointerToRawData |
0x1fc00
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
MD5 |
f3485faf869038b39d9a152e824837ac
|
SHA1 |
b901237626234d6a4a52ddbc8d9ef06868b7d81f
|
SHA256 |
3dd93914097167294934acb7d794022bec4dc44158cc19cb7f45cee75cd137fc
|
SHA3 |
502efeaaa7c59268a5ea6213d978a4135be7a4a08956dd8ed65d3a016096956b
|
VirtualSize |
0x2c2
|
VirtualAddress |
0x46c000
|
SizeOfRawData |
0x400
|
PointerToRawData |
0x1fc00
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
Entropy |
1.94479
|
KERNEL32.DLL |
GetCommandLineA
|
[*] Warning: Could not read an import's name.
[*] Warning: Section .bss has a size of 0!