| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2002-Feb-27 20:58:08 |
| Detected languages |
English - United States
|
| CompanyName | Barking Dog Studios |
| FileDescription | Global Operations Client |
| FileVersion | 1, 16, 0, 29 |
| InternalName | CShell.dll |
| LegalCopyright | Copyright (C) 2002 |
| OriginalFilename | CShell.dll |
| ProductName | Global Operations Client |
| ProductVersion | 1, 0, 0, 0 |
| Suspicious | PEiD Signature: |
SafeDisc v4
SafeDisc 4 |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .exc
Unusual section name found: stxt774 Section stxt774 is both writable and executable. Unusual section name found: stxt371 Section stxt371 is both writable and executable. |
| Info | The PE contains common functions which appear in legitimate applications. |
Can access the registry:
|
| Suspicious | The file contains overlay data. |
858861 bytes of data starting at offset 0x140000.
The overlay data has an entropy of 7.99959 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 5/72 (Scanned on 2025-12-27 13:07:02) |
APEX:
Malicious
MaxSecure: Trojan.Malware.300983.susgen Paloalto: generic.ml VBA32: BScope.Trojan.MulDrop Zoner: Probably Heur.ExeHeaderL |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 7 |
| TimeDateStamp | 2002-Feb-27 20:58:08 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x11d000 |
| SizeOfInitializedData | 0xa2000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001BC052 (Section: stxt371) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x119000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1c0000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetModuleHandleA
GetProcAddress GlobalAlloc GlobalFree ExitProcess |
|---|---|
| USER32.dll |
MessageBoxA
|
| DDRAW.dll |
DirectDrawCreateEx
|
| WINMM.dll |
timeGetTime
|
| DINPUT8.dll |
DirectInput8Create
|
| GDI32.dll |
GetStockObject
|
| ADVAPI32.dll |
RegQueryValueExA
|
| ole32.dll |
CoCreateInstance
|
| mss32.dll |
_AIL_digital_handle_reacquire@4
|
| VERSION.dll |
VerQueryValueA
|
| WSOCK32.dll |
gethostname
|
| d3d8.dll |
Direct3DCreate8
|
| Ordinal | 1 |
|---|---|
| Address | 0x5b8c0 |
| Open |
| Save As |
| All Files (*.*) |
| Untitled |
| an unnamed file |
| &Hide |
| No error message is available. |
| An unsupported operation was attempted. |
| A required resource was unavailable. |
| Out of memory. |
| An unknown error has occurred. |
| Invalid filename. |
| Failed to open document. |
| Failed to save document. |
| Save changes to %1? |
| Failed to create empty document. |
| The file is too large to open. |
| Could not start print job. |
| Failed to launch help. |
| Internal application error. |
| Command failed. |
| Insufficient memory to perform operation. |
| System registry entries have been removed and the INI file (if any) was deleted. |
| Not all of the system registry entries (or INI file) were removed. |
| This program requires the file %s, which was not found on this system. |
| This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s. |
| Please enter an integer. |
| Please enter a number. |
| Please enter an integer between %1 and %2. |
| Please enter a number between %1 and %2. |
| Please enter no more than %1 characters. |
| Please select a button. |
| Please enter an integer between 0 and 255. |
| Please enter a positive integer. |
| Please enter a date and/or time. |
| Please enter a currency. |
| Unexpected file format. |
| %1 |
| Cannot find this file. |
| Please verify that the correct path and file name are given. |
| Destination disk drive is full. |
| Unable to read from %1, it is opened by someone else. |
| Unable to write to %1, it is read-only or opened by someone else. |
| An unexpected error occurred while reading %1. |
| An unexpected error occurred while writing %1. |
| Unable to read write-only property. |
| Unable to write read-only property. |
| Unable to load mail system support. |
| Mail system DLL is invalid. |
| Send Mail failed to send message. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| %1 was not found. |
| %1 contains an invalid path. |
| %1 could not be opened because there are too many open files. |
| Access to %1 was denied. |
| An invalid file handle was associated with %1. |
| %1 could not be removed because it is the current directory. |
| %1 could not be created because the directory is full. |
| Seek failed on %1 |
| A hardware I/O error was reported while accessing %1. |
| A sharing violation occurred while accessing %1. |
| A locking violation occurred while accessing %1. |
| Disk full while accessing %1. |
| An attempt was made to access %1 past its end. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| An attempt was made to write to the reading %1. |
| An attempt was made to access %1 past its end. |
| An attempt was made to read from the writing %1. |
| %1 has a bad format. |
| %1 contained an unexpected object. |
| %1 contains an incorrect schema. |
| pixels |
| XOR Key | 0xb9d723c6 |
|---|---|
| Unmarked objects | 0 |
| 12 (7291) | 6 |
| C objects (VS98 build 8168) | 162 |
| 14 (7299) | 39 |
| C objects (8799) | 1 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 88 |
| Unmarked objects (#2) | 5 |
| C objects (8830) | 1 |
| 19 (8034) | 16 |
| C++ objects (8830) | 58 |
| Total imports | 210 |
| 37 (8755) | 14 |
| C++ objects (VS98 build 8168) | 270 |
| Resource objects (VS98 cvtres build 1720) | 1 |
| Linker (VS98 build 8168) | 1 |
No comments yet.