Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2024-Jun-10 21:24:32 |
Detected languages |
English - United States
|
Comments | This installation was built with Inno Setup. |
CompanyName | MeldaProduction |
FileDescription | MeldaProduction MCompleteBundle |
FileVersion | 17.0.0 |
LegalCopyright | © MeldaProduction |
OriginalFileName | |
ProductName | MeldaProduction MCompleteBundle |
ProductVersion | 17.0.0 |
Info | Interesting strings found in the binary: |
Contains domain names:
|
Suspicious | The PE is possibly packed. |
Unusual section name found: .itext
Unusual section name found: .didata |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Suspicious | The file contains overlay data. | 2525487 bytes of data starting at offset 0xd0c00. |
Malicious | VirusTotal score: 3/73 (Scanned on 2024-10-21 20:21:41) |
Bkav:
W32.AIDetectMalware
Trapmine: suspicious.low.ml.score Webroot: W32.Adware.Gen |
e_magic | MZ |
---|---|
e_cblp | 0x50 |
e_cp | 0x2 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0xf |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0x1a |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x100 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 10 |
TimeDateStamp | 2024-Jun-10 21:24:32 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Magic | PE32 |
---|---|
LinkerVersion | 2.0 |
SizeOfCode | 0xbf200 |
SizeOfInitializedData | 0x11600 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x000C0004 (Section: .itext) |
BaseOfCode | 0x1000 |
BaseOfData | 0xc1000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 6.1 |
ImageVersion | 0.0 |
SubsystemVersion | 6.1 |
Win32VersionValue | 0 |
SizeOfImage | 0xe1000 |
SizeOfHeaders | 0x400 |
Checksum | 0xdbf18 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x4000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
kernel32.dll |
GetACP
GetExitCodeProcess LocalFree CloseHandle SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage GetModuleFileNameA lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime GetEnvironmentVariableW WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
---|---|
comctl32.dll |
InitCommonControls
|
version.dll |
GetFileVersionInfoSizeW
VerQueryValueW GetFileVersionInfoW |
user32.dll |
CreateWindowExW
TranslateMessage CharLowerBuffW CallWindowProcW CharUpperW PeekMessageW GetSystemMetrics SetWindowLongW MessageBoxA MessageBoxW DestroyWindow CharUpperBuffW CharNextW MsgWaitForMultipleObjects LoadStringW ExitWindowsEx DispatchMessageW |
oleaut32.dll |
SysAllocStringLen
SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate |
netapi32.dll |
NetWkstaGetInfo
NetApiBufferFree |
advapi32.dll |
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW OpenProcessToken FreeSid AllocateAndInitializeSid EqualSid RegQueryValueExW GetTokenInformation ConvertSidToStringSidW RegCloseKey |
kernel32.dll (delay-loaded) |
GetACP
GetExitCodeProcess LocalFree CloseHandle SizeofResource VirtualProtect QueryPerformanceFrequency VirtualFree GetFullPathNameW ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle GetModuleHandleW FreeLibrary HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent GetVolumeInformationW GetVersion GetDriveTypeW RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority SetThreadPriority GetCurrentProcess VirtualAlloc GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage GetModuleFileNameA lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetLocalTime GetEnvironmentVariableW WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale |
Attributes | 0x1 |
---|---|
Name | kernel32.dll |
ModuleHandle | 0xd1080 |
DelayImportAddressTable | 0xd1090 |
DelayImportNameTable | 0xd10b4 |
BoundDelayImportTable | 0xd10d8 |
UnloadDelayImportTable | 0xd10f0 |
TimeStamp | 1970-Jan-01 00:00:00 |
Ordinal | 1 |
---|---|
Address | 0xc863c |
Ordinal | 2 |
---|---|
Address | 0xf628 |
Ordinal | 3 |
---|---|
Address | 0x5747c |
Windows Server 2016 |
Windows Server 2019 |
Windows 8 |
Windows 8.1 |
Windows 10 |
Observer is not supported |
Cannot have multiple single cast observers added to the observers collection |
The object does not implement the observer interface |
No single cast observer with ID %d was added to the observer collection |
No multi cast observer with ID %d was added to the observer collection |
Must wait on at least one event |
Cannot call BeginInvoke on a TComponent in the process of destruction |
VAR and OUT arguments must match parameter type exactly |
%s (Version %d.%d, Build %d, %5:s) |
%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s) |
32-bit Edition |
64-bit Edition |
Windows |
Windows Vista |
Windows Server 2008 |
Windows 7 |
Windows Server 2008 R2 |
Windows 2000 |
Windows XP |
Windows Server 2003 |
Windows Server 2003 R2 |
Windows Server 2012 |
Windows Server 2012 R2 |
Property is read-only |
%s.Seek not implemented |
Property %s does not exist |
Stream write error |
Thread creation error: %s |
Thread Error: %s (%d) |
Cannot terminate an externally created thread |
Cannot wait for an externally created thread |
Cannot call Start on a running or suspended thread |
Invalid argument |
Source and Destination arrays must not be the same |
Argument out of range |
Duplicates not allowed |
Insufficient RTTI available to support this operation |
Parameter count mismatch |
Type '%s' is not declared in the interface section of a unit |
Cannot assign a %s to a %s |
CheckSynchronize called from thread $%x, which is NOT the main thread |
Class %s not found |
List does not allow duplicates ($0%x) |
A component named %s already exists |
''%s'' is not a valid component name |
Invalid property value |
Invalid property path |
Invalid property value |
List capacity out of bounds (%d) |
List count out of bounds (%d) |
List index out of bounds (%d) |
Out of memory while expanding memory stream |
%s has not been registered as a COM class |
Error reading %s%s%s: %s |
Stream read error |
Monday |
Tuesday |
Wednesday |
Thursday |
Friday |
Saturday |
Invalid source array |
Invalid destination array |
Character index out of bounds (%d) |
Start index out of bounds (%d) |
Invalid count (%d) |
Invalid destination index (%d) |
Invalid code page |
No mapping for the Unicode character exists in the target multi-byte code page |
Invalid StringBaseIndex |
Ancestor for '%s' not found |
May |
June |
July |
August |
September |
October |
November |
December |
Sun |
Mon |
Tue |
Wed |
Thu |
Fri |
Sat |
Sunday |
Jan |
Feb |
Mar |
Apr |
May |
Jun |
Jul |
Aug |
Sep |
Oct |
Nov |
Dec |
January |
February |
March |
April |
Invalid variant type |
Operation not supported |
Unexpected variant error |
External exception %x |
Assertion failed |
Interface not supported |
Exception in safecall method |
Object lock not owned |
Monitor support function not initialized |
Feature not implemented |
Method called on disposed object |
%s (%s, line %d) |
Abstract Error |
Access violation at address %p in module '%s'. %s of address %p |
System Error. Code: %d. |
%s%s |
A call to an OS function failed |
Variant method calls not supported |
Read |
Write |
Execution |
Invalid access |
Error creating variant or safe array |
Variant or safe array index out of bounds |
Variant or safe array is locked |
Invalid variant type conversion |
Invalid variant operation |
Invalid NULL variant operation |
Invalid variant operation (%s%.8x) |
%s |
Could not convert variant of type (%s) into type (%s) |
Overflow while converting variant of type (%s) into type (%s) |
Variant overflow |
Invalid argument |
Invalid floating point operation |
Floating point division by zero |
Floating point overflow |
Floating point underflow |
Invalid pointer operation |
Invalid class typecast |
Access violation at address %p. %s of address %p |
Access violation |
Stack overflow |
Control-C hit |
Privileged instruction |
Operation aborted |
Exception %s in module %s at %p. |
%s%s |
Application Error |
Format '%s' invalid or incompatible with argument |
No argument for format '%s' |
'%s' is not a valid integer value |
'%d.%d' is not a valid timestamp |
Invalid argument to time encode |
Invalid argument to date encode |
Out of memory |
I/O error %d |
File not found |
Invalid filename |
Too many open files |
File access denied |
Read beyond end of file |
Disk full |
Invalid numeric input |
Division by zero |
Range check error |
Integer overflow |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 17.0.0.0 |
ProductVersion | 17.0.0.0 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | UNKNOWN |
Comments | This installation was built with Inno Setup. |
CompanyName | MeldaProduction |
FileDescription | MeldaProduction MCompleteBundle |
FileVersion (#2) | 17.0.0 |
LegalCopyright | © MeldaProduction |
OriginalFileName | |
ProductName | MeldaProduction MCompleteBundle |
ProductVersion (#2) | 17.0.0 |
Resource LangID | English - United States |
---|
StartAddressOfRawData | 0x4d3000 |
---|---|
EndAddressOfRawData | 0x4d3018 |
AddressOfIndex | 0x4c1c1c |
AddressOfCallbacks | 0x4d4010 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_TYPE_REG
|
Callbacks | (EMPTY) |