d88289b0fc4ffc7214bb5521c923bda6
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2004-Apr-06 20:17:29 |
| Detected languages |
English - United Kingdom
|
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: _rwcseg
Unusual section name found: .exc Unusual section name found: .asrc Unusual section name found: _TEXT_HA Unusual section name found: _rwdseg Unusual section name found: .xxxxx |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | VirusTotal score: 1/44 (Scanned on 2026-02-05 03:21:56) | Trapmine: suspicious.low.ml.score |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 12 |
| TimeDateStamp | 2004-Apr-06 20:17:29 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 3.0 |
| SizeOfCode | 0x26d800 |
| SizeOfInitializedData | 0x1ce600 |
| SizeOfUninitializedData | 0xb800 |
| AddressOfEntryPoint | 0x0024A380 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x270000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x450000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
_rwcseg
.rdata
.exc
.data
.CRT
.asrc
_TEXT_HA
.idata
_rwdseg
.bss
.xxxxx
Imports
| ADVAPI32.dll |
RegOpenKeyExA
RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueExA |
|---|---|
| DINPUT8.dll |
DirectInput8Create
|
| KERNEL32.dll |
GetLastError
IsBadReadPtr CreateEventA CloseHandle ReadFile GetOverlappedResult CreateFileA GetVersion IsBadCodePtr IsBadWritePtr GetFileAttributesA CreateDirectoryA OutputDebugStringA LoadLibraryA GetProcAddress FreeLibrary GetCommandLineA SetErrorMode GetModuleHandleA GetModuleFileNameA GetCurrentThread GetTickCount GetUserDefaultLangID SetFileAttributesA DeleteFileA GetDiskFreeSpaceExA GetDiskFreeSpaceA SetFilePointer WriteFile GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToSystemTime EnterCriticalSection LeaveCriticalSection TlsAlloc TlsFree TlsGetValue TlsSetValue InitializeCriticalSection DeleteCriticalSection ExitProcess GetStartupInfoA GlobalAlloc GlobalFree GetCurrentDirectoryA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetStdHandle SetCurrentDirectoryA SetEnvironmentVariableA GetLocalTime GetTimeZoneInformation RtlUnwind FindNextFileA GetEnvironmentStrings FreeEnvironmentStringsA |
| USER32.dll |
SetWindowTextA
MessageBoxA ShowCursor ClientToScreen SetCursorPos LoadCursorA RegisterClassA FindWindowA SetForegroundWindow AdjustWindowRect CreateWindowExA GetWindowRect SetWindowPos SendMessageA ShowWindow GetDlgItem SetFocus EndDialog SetCursor ReleaseCapture GetWindowPlacement SetCapture DefWindowProcA KillTimer ClipCursor PostQuitMessage GetSystemMetrics DialogBoxParamA GetClientRect UpdateWindow SystemParametersInfoA DestroyWindow SetWindowLongA PeekMessageA TranslateMessage DispatchMessageA WaitMessage MapVirtualKeyA AdjustWindowRectEx GetMenu GetWindowLongA IsIconic |
| WINMM.dll |
timeGetTime
|
| binkw32.dll |
_BinkCopyToBufferRect@44
_BinkWait@4 _BinkDoFrame@4 _BinkNextFrame@4 _BinkOpen@8 _BinkBufferOpen@16 _BinkSetVolume@12 _BinkOpenMiles@4 _BinkSetSoundSystem@8 |
| d3d8.dll |
Direct3DCreate8
|
| mss32.dll |
_AIL_enumerate_3D_providers@12
_AIL_release_3D_sample_handle@4 _AIL_close_3D_provider@4 _AIL_set_3D_provider_preference@12 _AIL_open_3D_provider@4 _AIL_3D_room_type@4 _AIL_set_3D_room_type@8 _AIL_3D_provider_attribute@12 _AIL_allocate_3D_sample_handle@4 _AIL_set_3D_sample_effects_level@8 _AIL_set_redist_directory@4 _AIL_startup@0 _AIL_set_preference@8 _AIL_open_digital_driver@16 _AIL_set_3D_sample_info@8 _AIL_set_3D_sample_loop_count@8 _AIL_close_digital_driver@4 _AIL_shutdown@0 _AIL_set_3D_sample_volume@8 _AIL_set_3D_position@16 _AIL_set_3D_sample_distances@12 _AIL_set_3D_sample_playback_rate@8 _AIL_set_3D_sample_loop_block@12 _AIL_3D_sample_status@4 _AIL_start_3D_sample@4 _AIL_end_3D_sample@4 _AIL_stop_3D_sample@4 _AIL_3D_sample_offset@4 _AIL_3D_sample_length@4 _AIL_resume_3D_sample@4 _AIL_set_3D_sample_occlusion@8 _AIL_process_digital_audio@24 _AIL_ms_count@0 |
| ole32.dll | (EMPTY) |
Delayed Imports
MB_PICTURE
1
104
111
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
[*] Warning: Section .bss has a size of 0!
[*] Warning: Yara callback received an unhandled message (6).