dcd68e3b83518dd62c854b26dd33044f

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Jul-23 08:54:42
Detected languages Process Default Language

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • QEmU
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • LoadLibraryA
  • GetProcAddress
Functions which can be used for anti-debugging purposes:
  • FindWindowA
Code injection capabilities (PowerLoader):
  • FindWindowA
  • GetWindowLongA
Possibly launches other programs:
  • CreateProcessA
  • ShellExecuteA
Can create temporary files:
  • GetTempPathA
  • CreateFileA
Functions related to the privilege level:
  • DuplicateToken
  • OpenProcessToken
  • AdjustTokenPrivileges
Enumerates local disk drives:
  • GetLogicalDriveStringsA
  • GetDriveTypeA
Can take screenshots:
  • FindWindowA
  • GetDC
  • CreateCompatibleDC
  • BitBlt
Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 dcd68e3b83518dd62c854b26dd33044f
SHA1 cf0b0a43dccf7f3a4a64437d58fb7ba913e40754
SHA256 c7518e4415f9520d8ac457ae75f0f29ed91f1b1e3f10f20282320ce7828c290b
SHA3 c7657d9353edd297c2280420d5352dbddfbe9b206b807f139242201077a764a6
SSDeep 786432:5zzegYbxztW47mMyiWFbZl7a8m2wP6bhBe4uHGPFp:peg6htWH7/7a8bwP6bhk4uGX
Imports Hash 6a8c517136f230ad3ae17fece9173e61

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2009-Jul-23 08:54:42
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x2a600
SizeOfInitializedData 0x58600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00028E02 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2c000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x86000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 30fc2ffb20f83fd993942f27b8c89d35
SHA1 412db23aeb928e013b62ef602526460100e8b45a
SHA256 5317a466124b9bad62ad40778e4d747a78d21ce5abb8b1dc31c84b576d7f0ecf
SHA3 b8e38fdc0dd4823bd78ab27c529985439eb8bac88530edd83b346d49f7419c61
VirtualSize 0x2a507
VirtualAddress 0x1000
SizeOfRawData 0x2a600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.60662

.rdata

MD5 3ab9a34f086c7bcc861f170b4a1dc548
SHA1 d1e3fb6ad41792cb1bbc52149bf4c5ecc1e16276
SHA256 b48b89bc6b61a00ffc2ede13c0c4708f111399124df1d1b09df156cd7808dfba
SHA3 4b8281d4fe3991992f71566ec2315ea210e74498afc4b23a788d9d8ba77c0c6b
VirtualSize 0x247a
VirtualAddress 0x2c000
SizeOfRawData 0x2600
PointerToRawData 0x2aa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.63958

.data

MD5 961beca59dab6091c0bec2019f44d7d0
SHA1 993c7de3f5090611e02531805c55f58877657cf3
SHA256 bb9f9145e7a89978a5a74b7b371049507af9c74f02e39ff3e5c1329fa1ffa1ef
SHA3 f5f6206e6bfb118fccd3af376973951adb222245ac2025c27f7bef4967ffbbe2
VirtualSize 0x54d38
VirtualAddress 0x2f000
SizeOfRawData 0x3400
PointerToRawData 0x2d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.60665

.rsrc

MD5 fddb6a43011f069a74b918fb08042a71
SHA1 06ade20d7e47134d9e1df2b55373399368818ec3
SHA256 fc002cdeb9e33c7683db89ff35f1527c28ee85c8acb852ed57982762c860da10
SHA3 e5e9782b1a9457949d2d48f1acf83472dd1d2acb1dad5f41a242c5566d7e368e
VirtualSize 0x10d0
VirtualAddress 0x84000
SizeOfRawData 0x1200
PointerToRawData 0x30400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.28327

Imports

KERNEL32.dll GetExitCodeProcess
lstrcpynA
WaitForSingleObject
GetCommandLineA
GetDateFormatA
GetSystemDirectoryA
GetVersionExA
CreateMutexA
GetPrivateProfileIntA
GetPrivateProfileStringA
lstrcmpA
GetSystemTime
LocalFree
LocalAlloc
GetVersion
GetWindowsDirectoryA
GetSystemInfo
GetComputerNameA
SetEndOfFile
LCMapStringA
GetStringTypeW
GetStringTypeA
GetModuleFileNameA
GetACP
GetCPInfo
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
RtlUnwind
TerminateProcess
HeapAlloc
HeapFree
SetFileTime
GlobalMemoryStatus
GetShortPathNameA
LoadLibraryExA
WritePrivateProfileStringA
WritePrivateProfileSectionA
CreateProcessA
MoveFileExA
GetCurrentProcess
ExitProcess
WideCharToMultiByte
RemoveDirectoryA
GetFileTime
VerLanguageNameA
CompareFileTime
MoveFileA
CopyFileA
GetFileSize
DeviceIoControl
GetLogicalDriveStringsA
FreeLibrary
GetCurrentDirectoryA
SetCurrentDirectoryA
SetErrorMode
MultiByteToWideChar
SetFileAttributesA
GetTempPathA
GetFileAttributesA
CreateDirectoryA
GetLocaleInfoA
FindFirstFileA
lstrcmpiA
FindNextFileA
LCMapStringW
FindClose
GetDriveTypeA
lstrcatA
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetTickCount
Sleep
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
GetThreadPriority
SetThreadPriority
GlobalReAlloc
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
GetUserDefaultLangID
MulDiv
lstrlenA
GetLastError
FormatMessageA
WriteFile
ReadFile
lstrcpyA
SetFilePointer
CreateFileA
CloseHandle
GetOEMCP
DeleteFileA
USER32.dll IsIconic
RegisterClassW
RegisterClassA
SetRectEmpty
CharUpperA
ExitWindowsEx
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
TranslateMessage
OffsetRect
FillRect
SetWindowPos
GetActiveWindow
EndDialog
EnableWindow
LoadBitmapA
CreateDialogParamA
PostMessageA
SendDlgItemMessageW
SetDlgItemTextA
CallWindowProcA
IsWindowEnabled
GetSystemMetrics
FindWindowA
RegisterClassExW
CreateWindowExW
GetClassInfoExA
RegisterClassExA
GetClientRect
SetTimer
IsWindowVisible
PtInRect
SetCursor
InvalidateRect
GetDlgItemTextA
PostQuitMessage
LoadIconA
LoadImageA
GetSysColor
KillTimer
GetWindowTextLengthA
WaitMessage
IsDialogMessageA
MessageBoxA
MessageBoxW
CopyRect
SetWindowTextW
DrawEdge
SendDlgItemMessageA
GetDlgItem
ReleaseDC
GetDC
DestroyWindow
DefWindowProcA
EnumDisplaySettingsA
SendMessageW
GetClassInfoExW
DefWindowProcW
GetWindowRect
GetDesktopWindow
SystemParametersInfoA
GetFocus
GetWindowLongA
GetWindowTextA
DrawTextA
SetForegroundWindow
DialogBoxParamA
SendMessageA
ScreenToClient
DrawFocusRect
CreateWindowExA
SetWindowLongA
MoveWindow
SetFocus
GetSystemMenu
DeleteMenu
AppendMenuA
ShowWindow
SetWindowTextA
LoadCursorA
GetCursorPos
DispatchMessageA
GDI32.dll SetMapMode
SetViewportOrgEx
RestoreDC
StartDocA
StartPage
EndPage
EndDoc
RemoveFontResourceA
CreateScalableFontResourceA
AddFontResourceA
CreatePalette
CreateDIBitmap
CreateBitmap
GetTextExtentPoint32W
TextOutW
StretchDIBits
CreateCompatibleBitmap
SetBkColor
CreateCompatibleDC
GetStockObject
CreateSolidBrush
SetTextColor
GetTextExtentPoint32A
TextOutA
SetBkMode
SelectObject
CreateFontA
GetDeviceCaps
BitBlt
DeleteDC
SaveDC
SetTextAlign
DeleteObject
comdlg32.dll PrintDlgA
GetOpenFileNameA
ADVAPI32.dll SetSecurityDescriptorDacl
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumKeyExA
OpenThreadToken
DuplicateToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
RegCloseKey
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
FreeSid
GetUserNameA
RegSetValueExA
RegCreateKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SHELL32.dll SHChangeNotify
ShellExecuteExA
SHFileOperationA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
SHGetSpecialFolderLocation
ole32.dll CoCreateInstance
CoUninitialize
OleInitialize
OleUninitialize
CoInitialize
OLEAUT32.dll #161
#163
WINMM.dll midiOutGetNumDevs
joyGetPos
waveOutGetNumDevs
COMCTL32.dll ImageList_Create
ImageList_Add
#17
VERSION.dll GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Delayed Imports

2

Type RT_CURSOR
Language Process Default Language
Codepage UNKNOWN
Size 0x134
Entropy 2.59572
MD5 5eda44171a239586bd6adce2d8692994
SHA1 125f95574828cf9910c3ac70a3bca98004bf2c29
SHA256 dc72b2c4e8fe887c26fb57c00eb21139f7799e297bdf74b2b4db3474fee90509
SHA3 5ffd0743cdf549b78fd79d50947640fc8a29191d587102e7ad977c2421a7e3bd

127

Type RT_BITMAP
Language Process Default Language
Codepage UNKNOWN
Size 0x1d4
Entropy 3.4905
MD5 86302956a7e6a46262e449697995be4e
SHA1 6e5af57ffa4049952874984a3dd93cb320ab25f9
SHA256 72848a9db7e29a4671343bd2f2830fbce13835f1d6530427734d7ea45116208f
SHA3 1fd2e7a1afee49a0739888fddeb3a4b28641f1f5bab3eb99cd1700f0e6f09249
Preview

1

Type RT_ICON
Language Process Default Language
Codepage UNKNOWN
Size 0x2e8
Entropy 3.49439
MD5 1c939cd27f43766a88390bb51166736b
SHA1 8acc0235bdf3b51061802a3c6da9520172691a8e
SHA256 6f07b81878ae14770e9759882dbd96fa4e2bf3fe7525fbcabf8b84a3d14870a5
SHA3 715fe9616a0426fc9fc96e0a85e669079508a75b9123ca9a7ea7ff86b8d53faa

18

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0xf0
Entropy 3.26469
MD5 07c6ad7eb1fba27875e07316bf7ccdbc
SHA1 45232d59cc89c452d72b43b42f5839f10d494a77
SHA256 a767c603eaa3b4f1910673447ab41b035a4e81999b4de7b21ccb4dd9e5a1e790
SHA3 4881c5db53ad1805004344ab48a624b5d660058eb0c1b6855e3cf25a69e8ee7d

114

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0x1e0
Entropy 3.41754
MD5 0e23649a47a12b2ba53353f2dd88f1f9
SHA1 e87dc6acea7bb0a7de1a830830efa7bf38d977c2
SHA256 50e8be1c9c233802873b90278af2dca3c7b9d4038e7ed7ef5e819a9faf864e3a
SHA3 f3b2d17e17d05ae286fe14a27493ac6dfd4d40a3ae58a44ac1b777fc8bf52812

138

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0xa6
Entropy 2.69978
MD5 fa55835de496a4232ad49d9b9401f4d3
SHA1 e511943697cd9d379d23ce9ea7abaec05e68763c
SHA256 388ffe294d6ead69d527f10edfcb26e73c7f60921c96ceb0346497cf74b33cc6
SHA3 d2c6cc808c8a6c70c3ba57415a0475ab9f0e500efbe439cb9c73ca92bc16a0dd

154

Type RT_DIALOG
Language Process Default Language
Codepage UNKNOWN
Size 0xb6
Entropy 3.02015
MD5 3b0eced673a8a4c24c846ddc72367159
SHA1 25b1ec83820778e223ce01ece4cf0e88fca729c1
SHA256 ad52b410226d1c18f993de6a9b45bf19758921674595ad8ef55b8361ba99c359
SHA3 a3902b1907306b6e2a1608a829a1b015e8f91565005d483048efbde13e974c34

152

Type RT_GROUP_CURSOR
Language Process Default Language
Codepage UNKNOWN
Size 0x14
Entropy 1.91924
Detected Filetype Cursor file
MD5 aff0f5e372bd49ceb9f615b9a04c97df
SHA1 e3205724d7ee695f027ab5ea8d8e1a453aaad0dd
SHA256 b07e022f8ef0a8e5fd3f56986b2e5bf06df07054e9ea9177996b0a6c27d74d7c
SHA3 8177402f46c3117dab4e38a1288f1e4ceddc76252c744ade470a1c2d5ff05381

2000

Type RT_GROUP_ICON
Language Process Default Language
Codepage UNKNOWN
Size 0x14
Entropy 2.16096
Detected Filetype Icon file
MD5 42cf62b780813706e75fb9f2b2e8c258
SHA1 a022d5c1cfdd8aace0089f3e72f2eedd41bda464
SHA256 a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf
SHA3 a78d0bb09556eee7a004dacd0febac0e4fe852f566165c2e9a80f2f156fd91ce

1 (#2)

Type RT_MANIFEST
Language Process Default Language
Codepage UNKNOWN
Size 0x3d2
Entropy 4.8344
MD5 c1dd50829f70c46ca0c88ac975f08b24
SHA1 5590e7003bcab9003b624413469b591fb33fed7c
SHA256 5c812b24ccdacb92c43e0b38bc25822911a36122e2a1e27b17f37440c3017fab
SHA3 85152ad96a68916b1ff910028d940c756c3f384705ef14f9271fe9db2526e017

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xce3250a
Unmarked objects 0
12 (7291) 5
C++ objects (VS98 build 8168) 3
14 (7299) 23
C objects (VS98 build 8168) 45
C++ objects (9178) 1
19 (8022) 4
Unmarked objects (#2) 8
19 (8034) 19
Total imports 276
C++ objects (VC++ 6.0 SP5 imp/exp build 8447) 36
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors