ca4e896e2a1c9aee161d3eafd5db8fc1fed3609c83b2563bffaef5bab74467b7
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Jan-02 11:55:47 |
| Detected languages |
English - United States
|
| Comments | This installation was built with Inno Setup. |
| CompanyName | Sked |
| FileDescription | SkedAC Setup |
| FileVersion | |
| LegalCopyright | |
| OriginalFileName | |
| ProductName | SkedAC |
| ProductVersion | 1.2.0 |
Plugin Output
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA256
Uses constants related to SHA512 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .itext
Unusual section name found: .didata |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
2138726 bytes of data starting at offset 0xd0a00.
The overlay data has an entropy of 7.99991 and is possibly compressed or encrypted. |
| Suspicious | VirusTotal score: 2/72 (Scanned on 2026-03-13 13:50:39) |
Cylance:
Unsafe
DeepInstinct: MALICIOUS |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 11 |
| TimeDateStamp | 2026-Jan-02 11:55:47 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xb1200 |
| SizeOfInitializedData | 0x1f400 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x000B1E60 (Section: .itext) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xb3000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xdf000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Imports
| kernel32.dll |
GetACP
GetExitCodeProcess CloseHandle LocalFree SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW CompareStringOrdinal RtlUnwind SetFilePointerEx GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection LoadResource SuspendThread GetTickCount GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
|---|---|
| comctl32.dll |
InitCommonControls
|
| user32.dll |
CreateWindowExW
TranslateMessage CharLowerBuffW CallWindowProcW CharUpperW PeekMessageW GetSystemMetrics SetWindowLongW MessageBoxW DestroyWindow CharUpperBuffW CharNextW MsgWaitForMultipleObjects LoadStringW ExitWindowsEx DispatchMessageW |
| oleaut32.dll |
SafeArrayPutElement
VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType |
| advapi32.dll |
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW OpenProcessToken FreeSid AllocateAndInitializeSid EqualSid RegQueryValueExW GetTokenInformation ConvertSidToStringSidW RegCloseKey |
| kernel32.dll (delay-loaded) |
GetACP
GetExitCodeProcess CloseHandle LocalFree SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW CompareStringOrdinal RtlUnwind SetFilePointerEx GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection LoadResource SuspendThread GetTickCount GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | kernel32.dll |
| ModuleHandle | 0xc1080 |
| DelayImportAddressTable | 0xc1090 |
| DelayImportNameTable | 0xc10b4 |
| BoundDelayImportTable | 0xc10d8 |
| UnloadDelayImportTable | 0xc10f0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
dbkFCallWrapperAddr
| Ordinal | 1 |
|---|---|
| Address | 0xba63c |
__dbk_fcall_wrapper
| Ordinal | 2 |
|---|---|
| Address | 0xe578 |
100
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
DVCLAL
PACKAGEINFO
11111
MAINICON
1
1 (#2)
String Table contents
| No single cast observer with ID %d was added to the observer collection |
| No multi cast observer with ID %d was added to the observer collection |
| SHA2: Cannot update a finalized hash |
| Must wait on at least one event |
| Cannot call BeginInvoke on a TComponent in the process of destruction |
| Windows 2000 |
| Windows XP |
| Windows Server 2003 |
| Windows Server 2003 R2 |
| Windows Server 2012 |
| Windows Server 2012 R2 |
| Windows Server 2016 |
| Windows Server 2019 |
| Windows Server 2022 |
| Windows 8 |
| Windows 8.1 |
| Windows 10 |
| Windows 11 |
| Observer is not supported |
| Cannot have multiple single cast observers added to the observers collection |
| The object does not implement the observer interface |
| Insufficient RTTI available to support this operation |
| Parameter count mismatch |
| Type '%s' is not declared in the interface section of a unit |
| VAR and OUT arguments must match parameter type exactly |
| Property '%s' is read-only |
| Property '%s' is write-only |
| RTTI objects cannot be manually destroyed by application code |
| %s (Version %d.%d, Build %d, %5:s) |
| %s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s) |
| 32-bit Edition |
| 64-bit Edition |
| Windows |
| Windows Vista |
| Windows Server 2008 |
| Windows 7 |
| Windows Server 2008 R2 |
| Error reading %s%s%s: %s |
| Stream read error |
| Property is read-only |
| %s.Seek not implemented |
| Property %s does not exist |
| Stream write error |
| Thread creation error: %s |
| Thread Error: %s (%d) |
| Cannot terminate an externally created thread |
| Cannot wait for an externally created thread |
| Cannot call Start on a running or suspended thread |
| Invalid argument |
| Source and Destination arrays must not be the same |
| SpinCount out of range. Must be between 0 and %d |
| Argument out of range |
| Duplicates not allowed |
| Cannot assign a %s to a %s |
| CheckSynchronize called from thread $%x, which is NOT the main thread |
| Class %s not found |
| List does not allow duplicates ($0%x) |
| A component named %s already exists |
| ''%s'' is not a valid component name |
| Invalid property value |
| Invalid property path |
| Invalid property value |
| List capacity out of bounds (%d) |
| List count out of bounds (%d) |
| List index out of bounds (%d) |
| . %s range is 0..%d |
| . %s is empty |
| Out of memory while expanding memory stream |
| %s has not been registered as a COM class |
| Monday |
| Tuesday |
| Wednesday |
| Thursday |
| Friday |
| Saturday |
| Invalid source array |
| Invalid destination array |
| Character index out of bounds (%d) |
| Start index out of bounds (%d) |
| Invalid count (%d) |
| Invalid destination index (%d) |
| Invalid code page |
| No mapping for the Unicode character exists in the target multi-byte code page |
| Invalid StringBaseIndex |
| Ancestor for '%s' not found |
| May |
| June |
| July |
| August |
| September |
| October |
| November |
| December |
| Sun |
| Mon |
| Tue |
| Wed |
| Thu |
| Fri |
| Sat |
| Sunday |
| Jan |
| Feb |
| Mar |
| Apr |
| May |
| Jun |
| Jul |
| Aug |
| Sep |
| Oct |
| Nov |
| Dec |
| January |
| February |
| March |
| April |
| Invalid variant type |
| Operation not supported |
| Unexpected variant error |
| External exception %x |
| Assertion failed |
| Interface not supported |
| Exception in safecall method |
| Object lock not owned |
| Monitor support function not initialized |
| Feature not implemented |
| Method called on disposed object |
| %s (%s, line %d) |
| Abstract Error |
| Access violation at address %p in module '%s' (offset %x). %s of address %p |
| System Error. Code: %d. |
| %s%s |
| A call to an OS function failed |
| Variant method calls not supported |
| Read |
| Write |
| Execution |
| Invalid access |
| Error creating variant or safe array |
| Variant or safe array index out of bounds |
| Variant or safe array is locked |
| Invalid variant type conversion |
| Invalid variant operation |
| Invalid NULL variant operation |
| Invalid variant operation (%s%.8x) |
| %s |
| Could not convert variant of type (%s) into type (%s) |
| Overflow while converting variant of type (%s) into type (%s) |
| Variant overflow |
| Invalid argument |
| Invalid floating point operation |
| Floating point division by zero |
| Floating point overflow |
| Floating point underflow |
| Invalid pointer operation |
| Invalid class typecast |
| Access violation at address %p. %s of address %p |
| Access violation |
| Stack overflow |
| Control-C hit |
| Privileged instruction |
| Operation aborted |
| Exception %s in module %s at %p. |
| %s%s |
| Application Error |
| Format '%s' invalid or incompatible with argument |
| No argument for format '%s' |
| '%s' is not a valid integer value |
| '%d.%d' is not a valid timestamp |
| Invalid argument to time encode |
| Invalid argument to date encode |
| Out of memory |
| I/O error %d |
| File not found |
| Invalid filename |
| Too many open files |
| File access denied |
| Read beyond end of file |
| Disk full |
| Invalid numeric input |
| Division by zero |
| Range check error |
| Integer overflow |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 0.0.0.0 |
| ProductVersion | 0.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | This installation was built with Inno Setup. |
| CompanyName | Sked |
| FileDescription | SkedAC Setup |
| FileVersion (#2) | |
| LegalCopyright | |
| OriginalFileName | |
| ProductName | SkedAC |
| ProductVersion (#2) | 1.2.0 |
| Resource LangID | English - United States |
|---|
TLS Callbacks
| StartAddressOfRawData | 0x4c3000 |
|---|---|
| EndAddressOfRawData | 0x4c3018 |
| AddressOfIndex | 0x4b3c14 |
| AddressOfCallbacks | 0x4c4010 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |
Load Configuration
RICH Header
Errors
[*] Warning: Section .bss has a size of 0!
[*] Warning: Section .tls has a size of 0!
Leave a comment
No comments yet.