b28223a524ef416d902537b090b29d8a

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2017-May-10 18:30:01
Detected languages English - United States
Debug artifacts C:\Users\Inode Firewall\OneDrive\Documents\Présentations\SEC102\2017\PGSE\SEC102_Laura\bin\Debug\rot13.pdb

Plugin Output

Info Matching compiler(s): MASM/TASM - sig2(h)
MASM/TASM - sig1(h)
Info The PE contains common functions which appear in legitimate applications. Can access the registry:
  • RegEnumValueA
  • RegEnumKeyExA
  • RegCloseKey
  • RegOpenKeyExA
Safe VirusTotal score: 0/72 (Scanned on 2019-06-03 15:12:55) All the AVs think this file is safe.

Hashes

MD5 b28223a524ef416d902537b090b29d8a
SHA1 6a57dd6defecf85a8ba1efd0d19025da505563c1
SHA256 0decd1aa92a3d04dff796f908a03e2bbcabad0bdf094d04b06b7b098d29712cc
SHA3 9780095378779abef9b5f49d22d48db9ef2f8b7882c01847e2c2d8b3e1a2e035
SSDeep 384:54VXlnFpgx5EIcSKgIZ6MaovwnWYIlsisYpmIbeHubbbbT7zbvCx3aFx59T:54VhFpDgIUMaLbYptvCxKFf5
Imports Hash 0551e00d15a7c95525bf36f448ba6fb3

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 2017-May-10 18:30:01
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x6200
SizeOfInitializedData 0x4e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000102D (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x11000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 b2f53c32bfff8a6ee46bfb4793ab3a4f
SHA1 c4531cf5d431b21e5a4064f1f8629ce99750966e
SHA256 bd18e0b44b91ab45487031aa1310dedfcec2493bdb510df91dfc50052223875f
SHA3 2907c2894d7283e0e93ae688fcc576c5fc78adf17c5ff62fb1090557ab0f145c
VirtualSize 0x61bb
VirtualAddress 0x1000
SizeOfRawData 0x6200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.88101

.rdata

MD5 d26c98bf18f28a093f34d2f886d2c7c3
SHA1 2474166dab83890345fa1a3de60888589a9b5591
SHA256 c7b650fe5144def1456abfbab18ec8cdcd62c7ff7386dc6ac043c5900ab834f1
SHA3 a4acbe64156f6044398d800e7c039969eeefb1481e6589cb4b8645eec75ecfec
VirtualSize 0x214d
VirtualAddress 0x8000
SizeOfRawData 0x2200
PointerToRawData 0x6600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.97117

.data

MD5 9a5e88b753349064233708f9e1eaea55
SHA1 a4aa7baf8a208ff27881b3b278227c0e5eb018be
SHA256 d2879eb5d7504fbb6285f91f9d0f4761f422b32bdaaa6ba168a5af461c4afe6f
SHA3 111708ca1cc00bde68b1ec690576d9e5c368343de02ab3144c5571a45caf1445
VirtualSize 0xccc
VirtualAddress 0xb000
SizeOfRawData 0xa00
PointerToRawData 0x8800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.6855

.idata

MD5 15113b70eff61abf02ae54def346e338
SHA1 a621f2c2b335605e2d874d423819d0dcca86d0bf
SHA256 705cbba0c6e2b88b2c8d287e08be6e2d7ed0ad2ecec103a239ecaaa5f2df247c
SHA3 a9f83899b67af24613f823bc7b5beeffb4beabde4e62775937f3a488e2ed874c
VirtualSize 0xd35
VirtualAddress 0xc000
SizeOfRawData 0xe00
PointerToRawData 0x9200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.95825

.gfids

MD5 96069875f941840e876cbffd348cce91
SHA1 4af701989984a91f1759292d157dc8703e5f6862
SHA256 9ff01324f9f671882e0ec39acff5b79bc791976b6da405153f620c7ef9252982
SHA3 5dc2194c26d91d3e8193b1fdf2656cc5a7bb317cfe9e3754b66f06dfa20b6cdd
VirtualSize 0x13a
VirtualAddress 0xd000
SizeOfRawData 0x200
PointerToRawData 0xa000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.214733

.00cfg

MD5 111c05d4f66c2cfef29dac709c3ccb36
SHA1 a6d3dadbb8eccfcee7c82731bc8f432fe1a0f431
SHA256 8aa21d4409dbd0b646652e5915823623fbe8137bea2d2c2807e36255b6d18367
SHA3 c2e6a38d6ad4809a026bae111784f18774fbd2ea6fda46aaa5ef5e6cd713788e
VirtualSize 0x104
VirtualAddress 0xe000
SizeOfRawData 0x200
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.0611629

.rsrc

MD5 100ffcb09b803016c8ef1f86272aa22b
SHA1 242f96b5f8c50a26a7632298b906f1fc107a32e5
SHA256 5855936d84fcc4bfbb95cda8c1afc44b65e3e815efe7db7683e4da3667fb26ac
SHA3 87b74404717b60bd757e2906bb480538bc6f8ad12715bb5830157fdce0f32d51
VirtualSize 0x43c
VirtualAddress 0xf000
SizeOfRawData 0x600
PointerToRawData 0xa400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.13542

.reloc

MD5 9c55f9358629863738d15252676db5ef
SHA1 4cbefcf9143ddf509be0dffea55563938238324c
SHA256 fe2a1429d7ff70abefddea28b89f941331263522c0207eb328b2bfa41a58db7e
SHA3 e0fba943d6b2b5f84b55d423863db24f6a01131ad730fbfc18492521ca6ff6ea
VirtualSize 0x58d
VirtualAddress 0x10000
SizeOfRawData 0x600
PointerToRawData 0xaa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.33163

Imports

KERNEL32.dll ReadFileEx
WriteFile
CloseHandle
CreateFileA
SleepEx
FreeLibrary
VirtualQuery
ReadConsoleA
FindFirstFileA
FindClose
GetLastError
GetStdHandle
GetProcessHeap
HeapFree
HeapAlloc
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
USER32.dll CharUpperA
ADVAPI32.dll RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
VCRUNTIME140D.dll memset
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
ucrtbased.dll __p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
__stdio_common_vsprintf_s
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_controlfp_s
__p___argc
_wmakepath_s
_wsplitpath_s
wcscpy_s
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
strncmp
__stdio_common_vfprintf
__acrt_iob_func
malloc
free
strlen
strcpy
strcat
_set_fmode
__setusermatherr
exit
_initterm_e
_initterm
_initialize_narrow_environment
_get_initial_narrow_environment
terminate
_configure_narrow_argv
_exit

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2017-May-10 18:30:01
Version 0.0
SizeofData 132
AddressOfRawData 0x97d4
PointerToRawData 0x7dd4
Referenced File C:\Users\Inode Firewall\OneDrive\Documents\Présentations\SEC102\2017\PGSE\SEC102_Laura\bin\Debug\rot13.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2017-May-10 18:30:01
Version 0.0
SizeofData 20
AddressOfRawData 0x9858
PointerToRawData 0x7e58

TLS Callbacks

Load Configuration

Size 0x5c
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x40b728
SEHandlerTable 0x4096d0
SEHandlerCount 1

RICH Header

XOR Key 0xab816046
Unmarked objects 0
239 (40116) 2
Imports (VS2015 UPD3 build 24123) 2
C++ objects (VS2015 UPD3 build 24123) 23
C objects (VS2015 UPD3 build 24123) 13
Imports (65501) 7
Total imports 84
C objects (VS2015 UPD3.1 build 24215) 3
Resource objects (VS2015 UPD3 build 24210) 1
Linker (VS2015 UPD3.1 build 24215) 1

Errors

<-- -->