dcd68e3b83518dd62c854b26dd33044f
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2009-Jul-23 08:54:42 |
| Detected languages |
Process Default Language
|
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for Qemu presence:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
28541317 bytes of data starting at offset 0x31600.
The overlay data has an entropy of 7.99992 and is possibly compressed or encrypted. Overlay data amounts for 99.2964% of the executable. |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2009-Jul-23 08:54:42 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x2a600 |
| SizeOfInitializedData | 0x58600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00028E02 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2c000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 6.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x86000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| KERNEL32.dll |
GetExitCodeProcess
lstrcpynA WaitForSingleObject GetCommandLineA GetDateFormatA GetSystemDirectoryA GetVersionExA CreateMutexA GetPrivateProfileIntA GetPrivateProfileStringA lstrcmpA GetSystemTime LocalFree LocalAlloc GetVersion GetWindowsDirectoryA GetSystemInfo GetComputerNameA SetEndOfFile LCMapStringA GetStringTypeW GetStringTypeA GetModuleFileNameA GetACP GetCPInfo GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter HeapSize HeapReAlloc VirtualAlloc VirtualFree HeapCreate HeapDestroy GetStartupInfoA RtlUnwind TerminateProcess HeapAlloc HeapFree SetFileTime GlobalMemoryStatus GetShortPathNameA LoadLibraryExA WritePrivateProfileStringA WritePrivateProfileSectionA CreateProcessA MoveFileExA GetCurrentProcess ExitProcess WideCharToMultiByte RemoveDirectoryA GetFileTime VerLanguageNameA CompareFileTime MoveFileA CopyFileA GetFileSize DeviceIoControl GetLogicalDriveStringsA FreeLibrary GetCurrentDirectoryA SetCurrentDirectoryA SetErrorMode MultiByteToWideChar SetFileAttributesA GetTempPathA GetFileAttributesA CreateDirectoryA GetLocaleInfoA FindFirstFileA lstrcmpiA FindNextFileA LCMapStringW FindClose GetDriveTypeA lstrcatA GetModuleHandleA LoadLibraryA GetProcAddress GetTickCount Sleep GetCurrentThread QueryPerformanceFrequency QueryPerformanceCounter GetThreadPriority SetThreadPriority GlobalReAlloc GlobalUnlock GlobalFree GlobalAlloc GlobalLock GetUserDefaultLangID MulDiv lstrlenA GetLastError FormatMessageA WriteFile ReadFile lstrcpyA SetFilePointer CreateFileA CloseHandle GetOEMCP DeleteFileA |
|---|---|
| USER32.dll |
IsIconic
RegisterClassW RegisterClassA SetRectEmpty CharUpperA ExitWindowsEx PeekMessageA MsgWaitForMultipleObjects GetMessageA TranslateMessage OffsetRect FillRect SetWindowPos GetActiveWindow EndDialog EnableWindow LoadBitmapA CreateDialogParamA PostMessageA SendDlgItemMessageW SetDlgItemTextA CallWindowProcA IsWindowEnabled GetSystemMetrics FindWindowA RegisterClassExW CreateWindowExW GetClassInfoExA RegisterClassExA GetClientRect SetTimer IsWindowVisible PtInRect SetCursor InvalidateRect GetDlgItemTextA PostQuitMessage LoadIconA LoadImageA GetSysColor KillTimer GetWindowTextLengthA WaitMessage IsDialogMessageA MessageBoxA MessageBoxW CopyRect SetWindowTextW DrawEdge SendDlgItemMessageA GetDlgItem ReleaseDC GetDC DestroyWindow DefWindowProcA EnumDisplaySettingsA SendMessageW GetClassInfoExW DefWindowProcW GetWindowRect GetDesktopWindow SystemParametersInfoA GetFocus GetWindowLongA GetWindowTextA DrawTextA SetForegroundWindow DialogBoxParamA SendMessageA ScreenToClient DrawFocusRect CreateWindowExA SetWindowLongA MoveWindow SetFocus GetSystemMenu DeleteMenu AppendMenuA ShowWindow SetWindowTextA LoadCursorA GetCursorPos DispatchMessageA |
| GDI32.dll |
SetMapMode
SetViewportOrgEx RestoreDC StartDocA StartPage EndPage EndDoc RemoveFontResourceA CreateScalableFontResourceA AddFontResourceA CreatePalette CreateDIBitmap CreateBitmap GetTextExtentPoint32W TextOutW StretchDIBits CreateCompatibleBitmap SetBkColor CreateCompatibleDC GetStockObject CreateSolidBrush SetTextColor GetTextExtentPoint32A TextOutA SetBkMode SelectObject CreateFontA GetDeviceCaps BitBlt DeleteDC SaveDC SetTextAlign DeleteObject |
| comdlg32.dll |
PrintDlgA
GetOpenFileNameA |
| ADVAPI32.dll |
SetSecurityDescriptorDacl
RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyExA OpenThreadToken DuplicateToken AllocateAndInitializeSid InitializeSecurityDescriptor GetLengthSid InitializeAcl AddAccessAllowedAce RegCloseKey SetSecurityDescriptorGroup SetSecurityDescriptorOwner IsValidSecurityDescriptor AccessCheck FreeSid GetUserNameA RegSetValueExA RegCreateKeyExA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges |
| SHELL32.dll |
SHChangeNotify
ShellExecuteExA SHFileOperationA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc ShellExecuteA SHGetSpecialFolderLocation |
| ole32.dll |
CoCreateInstance
CoUninitialize OleInitialize OleUninitialize CoInitialize |
| OLEAUT32.dll |
#161
#163 |
| WINMM.dll |
midiOutGetNumDevs
joyGetPos waveOutGetNumDevs |
| COMCTL32.dll |
ImageList_Create
ImageList_Add #17 |
| VERSION.dll |
GetFileVersionInfoSizeA
GetFileVersionInfoA VerQueryValueA |
Delayed Imports
2
127
1
18
114
138
154
152
2000
1 (#2)
Version Info
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0xce3250a |
|---|---|
| Unmarked objects | 0 |
| 12 (7291) | 5 |
| C++ objects (VS98 build 8168) | 3 |
| 14 (7299) | 23 |
| C objects (VS98 build 8168) | 45 |
| C++ objects (9178) | 1 |
| 19 (8022) | 4 |
| Unmarked objects (#2) | 8 |
| 19 (8034) | 19 |
| Total imports | 276 |
| C++ objects (VC++ 6.0 SP5 imp/exp build 8447) | 36 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |