dead69d07bc33b762abd466fb6f53e11

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2046-Mar-18 18:21:18
Detected languages English - United States
Debug artifacts calc.pdb
CompanyName Microsoft Corporation
FileDescription Windows Calculator
FileVersion 10.0.17763.1 (WinBuild.160101.0800)
InternalName CALC
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename CALC.EXE
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.17763.1

Plugin Output

Info The PE contains common functions which appear in legitimate applications. Possibly launches other programs:
  • ShellExecuteW
Safe VirusTotal score: 0/70 (Scanned on 2020-07-22 14:07:57) All the AVs think this file is safe.

Hashes

MD5 dead69d07bc33b762abd466fb6f53e11
SHA1 f5ed372fd8ec7c455ff66bce73f16ca51cbc0302
SHA256 3091e2abfb55d05d6284b6c4b058b62c8c28afc1d883b699e9a2b5482ec6fd51
SHA3 28f6e5b8a9663b881364e0c292ea46a8ae785980154cbcf14e26b4e98ca0d845
SSDeep 384:S3B2ChTCfxWqHPuOOLE8eWS0YWbiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLi:a2CwxTmOv8zG
Imports Hash 8eeaa9499666119d13b3f44ecd77a729

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2046-Mar-18 18:21:18
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xc00
SizeOfInitializedData 0x6200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001830 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion A.0
ImageVersion A.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0xb000
SizeOfHeaders 0x400
Checksum 0x16a87
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x80000
SizeofStackCommit 0x2000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bf18bc48e53d958ba64050cf75df0202
SHA1 838529d11d4a6b0ff29ccfd8d6209b0d033b4e01
SHA256 63a851169cb2846516f4ebbb5e80655e63d31b24173aaad1b86b8c398afdd222
SHA3 c15a467b9eff8c5db104f72ec09b071b61d4dfe85d8646a1e463847e1871892c
VirtualSize 0xb90
VirtualAddress 0x1000
SizeOfRawData 0xc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.71558

.rdata

MD5 67bd0f60813c579002c9c16bf56ed37c
SHA1 57264fca9e632b46dc571d3acba03b7bc7398113
SHA256 575e3488c48d38195be1e8bd92c8bafe2532b591a65896a9e67c8ba001a44a2b
SHA3 8ed30fb266dd730e108cf8a289648a746bee1fb62ebc570d310063429d924e28
VirtualSize 0xc46
VirtualAddress 0x2000
SizeOfRawData 0xe00
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.87028

.data

MD5 e4b5d248daf9d4c3a3091422861a3886
SHA1 bc23051790484b22458aa30e07790ced41bc8b5f
SHA256 75f3ff0b47a67bbfe6563ce7c246aecf6a5e05a1123d7faf27f7ca77dc6b163f
SHA3 a418e44348dc8c8356668d039ae1308c03c0b8dbac641919915864a34c519a5a
VirtualSize 0x638
VirtualAddress 0x3000
SizeOfRawData 0x200
PointerToRawData 0x1e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.378703

.pdata

MD5 1f10478ea0b91fac59485762fcd89524
SHA1 e3a7d8917e2db32a3d468523ffdef041a63f97a9
SHA256 a8dc2edbd18e0f3d8a4bcf200aa6f98a5dd816ed78db008fb352d5942b1d404f
SHA3 2e2712b860391228f2f2e567568217d62bd9d61c125f9c2660827256e7cec7a6
VirtualSize 0xe4
VirtualAddress 0x4000
SizeOfRawData 0x200
PointerToRawData 0x2000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.88504

.rsrc

MD5 384b5d5604c12acd3c6a45ec98405b63
SHA1 217bb5a48d8b7232ee1c5d29b9d4f2f93c3a3de5
SHA256 1ab0e4afcf4d6921082f361b5a4fe3fc44aa82a932f7bccabb8dab61db61c7b9
SHA3 e0022e1a2e8cbe39d8922d1833d5d671f653081d541a341909480e3459943736
VirtualSize 0x4710
VirtualAddress 0x5000
SizeOfRawData 0x4800
PointerToRawData 0x2200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.81396

.reloc

MD5 fed9ed57a429cdee54838710525626ce
SHA1 80a719e1987ea8f0cbe93dbae106fe0c509534f0
SHA256 7283b26f1b9316c2ae4070ed5682448aa50179d229630f36c2e24230814412c2
SHA3 9cae825ec321fe18f044d9b4de0a2e2d52632d469a2a2d1d0de402f39c74b14a
VirtualSize 0x2c
VirtualAddress 0xa000
SizeOfRawData 0x200
PointerToRawData 0x6a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.471965

Imports

SHELL32.dll ShellExecuteW
KERNEL32.dll GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
GetCurrentProcessId
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
RtlLookupFunctionEntry
msvcrt.dll __setusermatherr
_initterm
__C_specific_handler
_wcmdln
_fmode
_commode
?terminate@@YAXXZ
_cexit
__wgetmainargs
_amsg_exit
_XcptFilter
exit
__set_app_type
_exit
ADVAPI32.dll EventSetInformation
EventWriteTransfer
EventRegister
api-ms-win-core-synch-l1-2-0.dll Sleep
api-ms-win-core-processthreads-l1-1-0.dll GetStartupInfoW
api-ms-win-core-libraryloader-l1-2-0.dll GetModuleHandleW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.39967
MD5 339d6ef766e3e959cb6a80c5a0006077
SHA1 b953e464da91872d0e33ee62b2648a6836b520d4
SHA256 c95bb5bd0d39255df7889d6b29c46dabc694834accba3e64e6559bcf6cc042ee
SHA3 59f83702753d5be567c4e6d5b3c375fd43bd3b22919c338ec346c84d783a21e8

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x218
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.38778
Detected Filetype PNG graphic file
MD5 84ae61b758be82a627ebbd846f988d34
SHA1 cb714a3334049b3fe631469a3bca8398c16e4e6e
SHA256 3e6c7cc4bd5870acb414f9bec4602e4737483fe14947306e0eae8fc3cbccb8f0
SHA3 876fb905f537617ca7012b0fb4b2c1fceeb20d950700245a82ea227ae28dd935

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.75044
MD5 762ddcf4fb3a4f57a4a1849b47324a2c
SHA1 d8aac2dca042e8221d7d02a8af8dc65fae11b6f4
SHA256 0ac0f42771fc0d2245c369f1e8277ba0a3ffe4c78b15093206bdb243aa65b2c5
SHA3 907930b5178ab04b81827056daa4f7c7c8629ccfcce1d4212ea1715c9a50118e

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.16135
MD5 9ee2a3afd25682b394fe54b6db182103
SHA1 8f014d438011dd0d9947d967842351042a493e56
SHA256 d4617e344732a0cf6bc6e8807f77cab668009342ab158cd9ac88d9877de318d9
SHA3 cb1b5b03e89766b7d076cf7bb3e349119943a9f3919e168b492139e3cff9b20d

IDI_CALC_ICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.41382
Detected Filetype Icon file
MD5 0a3aabb4ec6e9901a7e2d57c8b6407c2
SHA1 4a03b455ceefcdd8468d8a9c2128ce6193275987
SHA256 f4813285cef4f96b09578dc599d989c780fc042bc747f26acc9690aefdb73133
SHA3 61cb31e1103c73d4e2b89849731e427f0b1702b9a1ff07b991061ccb08bd9d42

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x384
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.43959
MD5 55b9baa6f08acc1d8077dcbbfe3bf078
SHA1 7d876a09bac976ba034988085cd5eb0fbb612a1e
SHA256 cfa938c32c78cc5a022b30c992c08d08b8a61855897d3f81deabd3acf900e356
SHA3 12c2727524d8e45e9b85282dd466f2c09c35ac7112edd5b0c9f4602d7eee2f00

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x491
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.96894
MD5 ff8bb01700c4ca8639b7077a96159295
SHA1 af31428842b7554e1200c33e2a71ede38b5c5ded
SHA256 9c32df4118c1601d8d06e8a8bbd1ae72202fa81d429ede9218bdb9b8ca7743f2
SHA3 e12148aca1f918cddfbb056629d7c5e546ef351d7df82f84d137a16126cdeee3

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 10.0.17763.1
ProductVersion 10.0.17763.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Microsoft Corporation
FileDescription Windows Calculator
FileVersion (#2) 10.0.17763.1 (WinBuild.160101.0800)
InternalName CALC
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename CALC.EXE
ProductName Microsoft® Windows® Operating System
ProductVersion (#2) 10.0.17763.1
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2046-Mar-18 18:21:18
Version 0.0
SizeofData 33
AddressOfRawData 0x23ec
PointerToRawData 0x13ec
Referenced File calc.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2046-Mar-18 18:21:18
Version 0.0
SizeofData 628
AddressOfRawData 0x2410
PointerToRawData 0x1410

UNKNOWN

Characteristics 0
TimeDateStamp 2046-Mar-18 18:21:18
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

Size 0x108
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140003040
GuardCFCheckFunctionPointer 5368717912
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x8e1068bb
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 6
Total imports 40
Imports (26213) 9
C objects (26213) 17
ASM objects (26213) 2
265 (26213) 2
C++ objects (26213) 2
Resource objects (26213) 1
Linker (26213) 1

Errors