Manalyzer :: b4c3e8c8bf971413cda6e22c34373c561762f1938d5750b6a82073656855dec3

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2024-Nov-12 04:18:25
Detected languages	English - United States
CompanyName	IMC
ProductName	Project1
FileVersion	`1.00`
ProductVersion	`1.00`
InternalName	doppler
OriginalFilename	doppler.exe

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual Basic 5.0` `Microsoft Visual Basic v5.0/v6.0` `Microsoft Visual Basic v5.0 - v6.0`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`dea44156576abf96132b2246dd537824`
SHA1	`be33aceb2aee083463b9eaceef6aabb6d4b873f0`
SHA256	`b4c3e8c8bf971413cda6e22c34373c561762f1938d5750b6a82073656855dec3`
SHA3	`abcf3c958d97424bfe298e143ad36692237ada1455ed6041ad285ebf0f5f6fc4`
SSDeep	`24576:kZt+fMBTB4LT7KJr3gg33AM13XQs4VuHgco06mHw8Y0f68LH7Kdr3gc33AMh3XQ:2t+fMBT`
Imports Hash	`626be63861cb2ec3a3a9308ffa4563cb`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xc8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2024-Nov-12 04:18:25
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x6bb000`
SizeOfInitializedData	`0x3000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00001924 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x6bc000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`4.0`
ImageVersion	`1.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x6bf000`
SizeOfHeaders	`0x1000`
Checksum	`0x6c574d`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`64713fcd75e6975517f7fe20ff09f451`
SHA1	`70320e9c7c05fba354694b610f304ae10a24c2d5`
SHA256	`ab9ae5eb90b4cedec592e2f8db12442c5b066bed9113a52f47f80c23e5e7b347`
SHA3	`de1bbe65992b0005e85ae2c6660dd53c09a9b486b400227afdb470439e7e2d14`
VirtualSize	`0x6ba7e4`
VirtualAddress	`0x1000`
SizeOfRawData	`0x6bb000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.13535`

.data

MD5	`620f0b67a91f7f74151bc5be745b7110`
SHA1	`1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d`
SHA256	`ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7`
SHA3	`a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563`
VirtualSize	`0x1b70`
VirtualAddress	`0x6bc000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x6bc000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`cc9d52700b65acba763751c837b61ec0`
SHA1	`fdd83cbcce263d9834a6f6a7289d1f8a438e46dd`
SHA256	`94984017edac4eafb778d07e617d483bec96290880c177853a5f7262ce66a5f3`
SHA3	`9023800d55fe46a9508a8d32069f973ae1e2ed10df3560d34a68e6b2ab29c2c7`
VirtualSize	`0x8c4`
VirtualAddress	`0x6be000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x6bd000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.91344`

Imports

MSVBVM60.DLL	`EVENT_SINK_GetIDsOfNames` `_CIcos` `_adj_fptan` `__vbaVarMove` `__vbaFreeVar` `__vbaStrVarMove` `__vbaLateIdCall` `__vbaEnd` `__vbaFreeVarList` `_adj_fdiv_m64` `EVENT_SINK_Invoke` `__vbaFreeObjList` `_adj_fprem1` `__vbaStrCat` `#660` `__vbaHresultCheckObj` `_adj_fdiv_m32` `Zombie_GetTypeInfo` `__vbaLateMemSt` `__vbaObjSet` `#595` `__vbaOnError` `_adj_fdiv_m16i` `__vbaObjSetAddref` `_adj_fdivr_m16i` `__vbaBoolVarNull` `_CIsin` `__vbaLateMemStAd` `__vbaChkstk` `EVENT_SINK_AddRef` `__vbaStrCmp` `#529` `__vbaVarTstEq` `__vbaObjVar` `__vbaCastObjVar` `_adj_fpatan` `__vbaLateIdCallLd` `Zombie_GetTypeInfoCount` `EVENT_SINK_Release` `__vbaNew` `_CIsqrt` `EVENT_SINK_QueryInterface` `__vbaVarMul` `__vbaExceptHandler` `_adj_fprem` `_adj_fdivr_m64` `#716` `__vbaFPException` `__vbaStrVarVal` `__vbaVarCat` `_CIlog` `__vbaNew2` `_adj_fdiv_m32i` `_adj_fdivr_m32i` `__vbaStrCopy` `__vbaFreeStrList` `#576` `_adj_fdivr_m32` `_adj_fdiv_r` `#685` `#100` `#610` `__vbaVarAdd` `__vbaFreeVarg` `__vbaVarDup` `__vbaLateMemCallLd` `_CIatan` `__vbaStrMove` `__vbaCastObj` `#619` `_allmul` `_CItan` `_CIexp` `__vbaFreeObj` `__vbaFreeStr`

Delayed Imports

30001

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x130`
TimeDateStamp	2024-Nov-12 04:18:25
Entropy	`2.57965`
MD5	`a20d09bee9b4207ad5a3b67a78c1dce3`
SHA1	`ca85fbf532389887f3837bbadd1c579040b99c8b`
SHA256	`2d3915cdc82e909357d44c4de1b8890bd753605c28df11b10299e3fd09d930b9`
SHA3	`e3b2b0325b24bb74af126af0863b39a6e63c08820f69cf0ae582a31bfc1052db`

30002

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x2e8`
TimeDateStamp	2024-Nov-12 04:18:25
Entropy	`1.76987`
MD5	`24799ca590d42134e7103b06d46fd960`
SHA1	`4af9a0fe3b7371abc50a18e851f3122fce9a2ffa`
SHA256	`a32e750bc1b0315530097434a7e1d324b843e1f5ffd95238b49d3a8aa8e6fe09`
SHA3	`9a17698629ef5e7a1c567a9669be74aa2c9d8356ecfba40c48811e4dcf5ea875`

30003

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x128`
TimeDateStamp	2024-Nov-12 04:18:25
Entropy	`2.07177`
MD5	`e6c5053ba1c848d7e16701a2d08fb8c6`
SHA1	`f253482c0fa25197130f6475f2ded060527843bf`
SHA256	`46dc088910439dad6a0d69da5e64227d04a640845fd1c31e90a7d4340c539fe0`
SHA3	`1e6c369197dd1a466ea87357db49ec559ecf82c0c3fa13af1a383445945861e6`

1

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x30`
TimeDateStamp	2024-Nov-12 04:18:25
Entropy	`2.97836`
Detected Filetype	Icon file
MD5	`835a20def9b2661b64b8ac06b4901f36`
SHA1	`70732dac88537f00c89d105f986ef843d3aca818`
SHA256	`cbdcb84268fcf2a25b844c1dca787de835c0376e82c1a2e62814a3c940a26cfb`
SHA3	`9a2de99425a7e2086c65d82719bf44696cfe58b8077ce214e814ceeeb78ba1f4`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	Unicode (UTF 16LE)
Size	`0x204`
TimeDateStamp	2024-Nov-12 04:18:25
Entropy	`3.14097`
MD5	`bbc8f2b619a57199f0653332eb17e234`
SHA1	`ada0a10d1b7774513b26d3e820c37869e485972e`
SHA256	`54cdea2569f12b6f7f601ab211e35bbcc4b4dc3a655046d809741ba5fc02c038`
SHA3	`5a4aba16e7ebbe630963e310ddb39c71b1a8b168a2dce57780136748ab43897c`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	IMC
ProductName	Project1
FileVersion (#2)	1.00
ProductVersion (#2)	1.00
InternalName	doppler
OriginalFilename	doppler.exe

Resource LangID	English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0x89aa0373`
Unmarked objects	`0`
14 (7299)	`1`
9 (8783)	`5`
13 (VS98 SP6 build 8804)	`1`

Errors

Leave a comment

No comments yet.