Manalyze report for cee0b19b7471f026dcf4d04c31e36ce5f3d4c29999e980a2276e2f8838eaa167

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2018-Dec-15 22:26:14
Detected languages	English - United States

Plugin Output

Info	Interesting strings found in the binary:	`Contains domain names: http://nsis.sf.net http://nsis.sf.net/NSIS_Error nsis.sf.net`
Suspicious	The PE is an NSIS installer	`Unusual section name found: .ndata`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExW` `Can access the registry: RegCreateKeyExW RegOpenKeyExW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW` `Possibly launches other programs: CreateProcessW` `Can create temporary files: GetTempPathW CreateFileW` `Functions related to the privilege level: AdjustTokenPrivileges OpenProcessToken` `Changes object ACLs: SetFileSecurityW` `Can shut the system down or lock the screen: ExitWindowsEx`
Info	The PE is digitally signed.	`Signer: TikTok Pte. Ltd.` `Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1`
Suspicious	VirusTotal score: 2/71 (Scanned on 2026-09-06 07:13:02)	`Skyhigh: Artemis!Trojan` `TrellixENS: Artemis!4E62F79BC939`

Hashes

MD5	`4e62f79bc9396089acddc07ee97d0ef3` 🔍
SHA1	`ea2e5951f4e80475b58509cc3aade5986e14e578` 🔍
SHA256	`cee0b19b7471f026dcf4d04c31e36ce5f3d4c29999e980a2276e2f8838eaa167` 🔍
SHA3	`41d8542dc5832ba425bc94a1e9555f98a0b8c086384686fbf681dae841c82e52` 🔍
SSDeep	`98304:bHpZB+u8zDafAlYQhIlugnqVVNOj84WZuVzvEoDNDBxpyomb0E:bRD0DSQYQhIPJjsZuVzDdHyoG0E` 🔍
Imports Hash	`b34f154ec913d2d2c435cbd644e91687` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xd8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`5`
TimeDateStamp	2018-Dec-15 22:26:14
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x6800`
SizeOfInitializedData	`0x73800`
SizeOfUninitializedData	`0x4000`
AddressOfEntryPoint	`0x0000338F (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x8000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`6.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x1a5000`
SizeOfHeaders	`0x400`
Checksum	`0x3f0b4a`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`7618d4c0cd8bb67ea9595b4266b3a91f 🔍`
SHA1	`0e5e99bb884a9fe9f4dee59b6bf9acf9746f3115 🔍`
SHA256	`ce82fa2004645edaffdd8fd1f54321b03658763348fada9402003d62f0ddff6b 🔍`
SHA3	`ccd8c869ba0ff281d15235e1af0a9750153fa0b82ccddbf9423a7d72c0b9dfae 🔍`
VirtualSize	`0x6627`
VirtualAddress	`0x1000`
SizeOfRawData	`0x6800`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.45028`

.rdata

MD5	`eecac1fed9cc6b447d50940d178404d8 🔍`
SHA1	`0a0c2be86d54840b2eaa4abf2412bb3588e032c4 🔍`
SHA256	`76ef9b6bda1f3f0560eb03c72afb8b3862e70e5f091d9fd62ebb6905fa34a639 🔍`
SHA3	`56c4918c79f159b821216cd16db69ccb9c3fa8d4545f5f26f6b7902fedc4a3a9 🔍`
VirtualSize	`0x14a2`
VirtualAddress	`0x8000`
SizeOfRawData	`0x1600`
PointerToRawData	`0x6c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.02518`

.data

MD5	`db8f31a08a2242d80c29e1f9500c6527 🔍`
SHA1	`bdd9e7400edf5b4fddcffb66fcb1d3d83c8901da 🔍`
SHA256	`e2835b9de081782fa567c22333052e11d1632bff5697c817ae031f3201cd77da 🔍`
SHA3	`57418e3f956819c21cc21d25fc98b7a7422a73a7339f1ef395d9be8917eac41b 🔍`
VirtualSize	`0x70ff8`
VirtualAddress	`0xa000`
SizeOfRawData	`0x600`
PointerToRawData	`0x8200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.03712`

.ndata

MD5	`d41d8cd98f00b204e9800998ecf8427e 🔍`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍`
VirtualSize	`0x124000`
VirtualAddress	`0x7b000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.rsrc

MD5	`ceca2ee3f20ecb73f551f78cbe926b88 🔍`
SHA1	`a77b47af242dc7056fca38f43beed742a400ca87 🔍`
SHA256	`96c615cf820fe0b73f1564805ddb5b8b1c7fc68424798cbc6f77ea41c8635c29 🔍`
SHA3	`6f6bc05a5ff80462d7dbb0953a93600702526f419f5afe57e6abf1e3b24edc75 🔍`
VirtualSize	`0x5ac0`
VirtualAddress	`0x19f000`
SizeOfRawData	`0x5c00`
PointerToRawData	`0x8800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.8087`

Imports

KERNEL32.dll	`SetEnvironmentVariableW` `SetFileAttributesW` `Sleep` `GetTickCount` `GetFileSize` `GetModuleFileNameW` `GetCurrentProcess` `CopyFileW` `SetCurrentDirectoryW` `GetFileAttributesW` `GetWindowsDirectoryW` `GetTempPathW` `GetCommandLineW` `GetVersion` `SetErrorMode` `lstrlenW` `lstrcpynW` `GetDiskFreeSpaceW` `ExitProcess` `GetShortPathNameW` `CreateThread` `GetLastError` `CreateDirectoryW` `CreateProcessW` `RemoveDirectoryW` `lstrcmpiA` `CreateFileW` `GetTempFileNameW` `WriteFile` `lstrcpyA` `MoveFileExW` `lstrcatW` `GetSystemDirectoryW` `GetProcAddress` `GetModuleHandleA` `GetExitCodeProcess` `WaitForSingleObject` `lstrcmpiW` `MoveFileW` `GetFullPathNameW` `SetFileTime` `SearchPathW` `CompareFileTime` `lstrcmpW` `CloseHandle` `ExpandEnvironmentStringsW` `GlobalFree` `GlobalLock` `GlobalUnlock` `GlobalAlloc` `FindFirstFileW` `FindNextFileW` `DeleteFileW` `SetFilePointer` `ReadFile` `FindClose` `lstrlenA` `MulDiv` `MultiByteToWideChar` `WideCharToMultiByte` `GetPrivateProfileStringW` `WritePrivateProfileStringW` `FreeLibrary` `LoadLibraryExW` `GetModuleHandleW`
USER32.dll	`GetSystemMenu` `SetClassLongW` `EnableMenuItem` `IsWindowEnabled` `SetWindowPos` `GetSysColor` `GetWindowLongW` `SetCursor` `LoadCursorW` `CheckDlgButton` `GetMessagePos` `LoadBitmapW` `CallWindowProcW` `IsWindowVisible` `CloseClipboard` `SetClipboardData` `EmptyClipboard` `OpenClipboard` `ScreenToClient` `GetWindowRect` `GetDlgItem` `GetSystemMetrics` `SetDlgItemTextW` `GetDlgItemTextW` `MessageBoxIndirectW` `CharPrevW` `CharNextA` `wsprintfA` `DispatchMessageW` `PeekMessageW` `ReleaseDC` `EnableWindow` `InvalidateRect` `SendMessageW` `DefWindowProcW` `BeginPaint` `GetClientRect` `FillRect` `DrawTextW` `EndDialog` `RegisterClassW` `SystemParametersInfoW` `CreateWindowExW` `GetClassInfoW` `DialogBoxParamW` `CharNextW` `ExitWindowsEx` `DestroyWindow` `GetDC` `SetTimer` `SetWindowTextW` `LoadImageW` `SetForegroundWindow` `ShowWindow` `IsWindow` `SetWindowLongW` `FindWindowExW` `TrackPopupMenu` `AppendMenuW` `CreatePopupMenu` `EndPaint` `CreateDialogParamW` `SendMessageTimeoutW` `wsprintfW` `PostQuitMessage`
GDI32.dll	`SelectObject` `SetBkMode` `CreateFontIndirectW` `SetTextColor` `DeleteObject` `GetDeviceCaps` `CreateBrushIndirect` `SetBkColor`
SHELL32.dll	`SHGetSpecialFolderLocation` `ShellExecuteExW` `SHGetPathFromIDListW` `SHBrowseForFolderW` `SHGetFileInfoW` `SHFileOperationW`
ADVAPI32.dll	`AdjustTokenPrivileges` `RegCreateKeyExW` `RegOpenKeyExW` `SetFileSecurityW` `OpenProcessToken` `LookupPrivilegeValueW` `RegEnumValueW` `RegDeleteKeyW` `RegDeleteValueW` `RegCloseKey` `RegSetValueExW` `RegQueryValueExW` `RegEnumKeyW`
COMCTL32.dll	`ImageList_Create` `ImageList_AddMasked` `ImageList_Destroy` `#17`
ole32.dll	`OleUninitialize` `OleInitialize` `CoTaskMemFree` `CoCreateInstance`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x2654`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.94864`
Detected Filetype	PNG graphic file
MD5	`374c411de27772bb6db07d6d4648a5b2 🔍`
SHA1	`2e463f7dd92cbf6e201ce8a1c467a2ec671045e2 🔍`
SHA256	`4945ea8c5de3673a8e6c6d3e942c907ae44e158407187e4f366161ea0ecff664 🔍`
SHA3	`d9a1a168c26fb2a09d64bd36581f711dedebf03ab24f681ebe55a74aad427e1a 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x127c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.93789`
Detected Filetype	PNG graphic file
MD5	`88ad40bba164fd84338fc2876bd2f6a1 🔍`
SHA1	`789437e6a8f7db3cff96c9a5cb74101710901a04 🔍`
SHA256	`751935e18065d2e6b8b693732fc73059342deb893d1a46314296e0550b70a020 🔍`
SHA3	`c763cc43d4ae60f3defa38b203ebdb95b1574e7e1d5f1e3b96f1e5d9858b844b 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x8f5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.89271`
Detected Filetype	PNG graphic file
MD5	`39bfe5bce2163656d69f98efa412a632 🔍`
SHA1	`cc56d000b0dc58e83015c9b4b4920c7e0776c850 🔍`
SHA256	`e43b2032cb9c9fa416c3bc258322022728e60e0b664029a462c4d5c1a12ca7a0 🔍`
SHA3	`381f9e3247016afb416ea0212a027cf0547d780e16d097adbb8093633bb2a68d 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6ec`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.86355`
Detected Filetype	PNG graphic file
MD5	`e6a599945699117cd3a60f562bfe3f46 🔍`
SHA1	`c77ec0d9999abb05076682cb2b9a7ed75685339e 🔍`
SHA256	`05a77a7ab5a290413257a89a908a613a33018afef1876784d8c6aeb108b485e5 🔍`
SHA3	`8207c44ca3f9065b157cd919a812ecad89a7f3b3c3475eb293934aa5dc44ab19 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4b2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.80883`
Detected Filetype	PNG graphic file
MD5	`91274837e7523bfdff9d8f400d023818 🔍`
SHA1	`5feff11378b52fc18856c78739cab3bfd2a6845f 🔍`
SHA256	`e7c3bb90ee872ab7b32cbf9067db0499d5e3a4337ac7fabf977a9bf9297b6b9c 🔍`
SHA3	`1e4cea3d4f2247356973a198dc82e7a842a3271a0399ea7c327da3ea1addbaf2 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x353`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.74714`
Detected Filetype	PNG graphic file
MD5	`bd8da3c45ad06a0087e5fc28622b0575 🔍`
SHA1	`9a25f8300d5e79f9dd4a4e6ca34806dbed1aa912 🔍`
SHA256	`1ef61761b19997a14984e49e943b7b50831cd21f5862e7e0752fa668040fc685 🔍`
SHA3	`4b4ce4f860cfac98e2301baa9d928a1c4358858ecc6a39ae642231aa9d0155f9 🔍`

7

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x254`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.53783`
Detected Filetype	PNG graphic file
MD5	`71b796644976e52ffdc9f4df9ca46ebe 🔍`
SHA1	`65a0e70f33a53c1ecb5d82156ceea71c525fb905 🔍`
SHA256	`972a0c3e52d2c2f0ab056b0c91a50ac1c4bf74a966c55df58183d3c7a448b4e4 🔍`
SHA3	`485e9817f97972760f285d5f421b99f38836c0c573b452426563bd6b71c185b7 🔍`

105

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x100`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.66174`
MD5	`3409f314895161597f3c395cc5f65525 🔍`
SHA1	`1a99d016d65e567f24449d9362afb6ac44006d0b 🔍`
SHA256	`fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96 🔍`
SHA3	`b3b19241cc6454389e45833e50b742ae1927a5f161017350a99f2cbc66914f26 🔍`

111

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x60`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.48825`
MD5	`6be4e1387d369cf86e68eacbdd0e81dd 🔍`
SHA1	`351970fe2681b9b35b5d59ad052011ed96a96e17 🔍`
SHA256	`85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0 🔍`
SHA3	`45e552e173141e06d113209b6cc915042ad0b4d5531464b8dbe5637029f489cb 🔍`

103

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.64573`
Detected Filetype	Icon file
MD5	`fb6c7fbe9cf1883b5ceb7137f6c139c9 🔍`
SHA1	`bdaadc2cf1ff070e4643fd4a2e9e81c483313ef9 🔍`
SHA256	`b68de0532eeab1986e5ebd1d6b904ba9f2c25127e86491ffc0273c8e42dd41f8 🔍`
SHA3	`03594e44851d40be2f291d09033bea307f057c5c9634607011862e7918086d0c 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x349`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.28733`
MD5	`defd2da5199b41d7c8e8080a1679fb14 🔍`
SHA1	`c37b52739bdb19bd388e73913f20ff34221212ac 🔍`
SHA256	`2473bb3042f961f2a019afee5a56b9485997d4b09e5a04236b99b1db528728b2 🔍`
SHA3	`b6cdf4265ea79e893ae0df096314c51643fce1965969d78b43092a98488afc89 🔍`

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xd26650e9`
Unmarked objects	`0`
C objects (VS2003 (.NET) build 4035)	`2`
Total imports	`165`
Imports (VS2003 (.NET) build 4035)	`15`
48 (9044)	`10`
Resource objects (VS98 SP6 cvtres build 1736)	`1`

Errors

[*] Warning: Section .ndata has a size of 0!

Leave a comment

No comments yet.