df5ae09a57543c8f8b30061218469e8c

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2019-Aug-06 07:57:19
Detected languages English - United Kingdom

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: Is an AutoIT compiled script:
  • AutoIt Error
  • reserved for AutoIt internal use
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
  • LoadLibraryExW
  • LoadLibraryW
Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowW
Code injection capabilities:
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
  • VirtualAlloc
Code injection capabilities (PowerLoader):
  • FindWindowW
  • GetWindowLongW
Can access the registry:
  • RegisterHotKey
  • RegEnumValueW
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegEnumKeyExW
  • RegSetValueExW
  • RegOpenKeyExW
  • RegCloseKey
  • RegQueryValueExW
  • RegCreateKeyExW
Possibly launches other programs:
  • CreateProcessW
  • CreateProcessAsUserW
  • CreateProcessWithLogonW
  • ShellExecuteW
Can create temporary files:
  • CreateFileW
  • GetTempPathW
Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • AttachThreadInput
  • MapVirtualKeyW
  • GetForegroundWindow
Has Internet access capabilities:
  • InternetQueryDataAvailable
  • InternetCloseHandle
  • InternetOpenW
  • InternetSetOptionW
  • InternetCrackUrlW
  • InternetQueryOptionW
  • InternetOpenUrlW
  • InternetReadFile
  • InternetConnectW
Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
  • DuplicateTokenEx
  • CheckTokenMembership
Enumerates local disk drives:
  • GetDriveTypeW
  • GetVolumeInformationW
Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • ReadProcessMemory
  • Process32FirstW
  • Process32NextW
Can take screenshots:
  • FindWindowW
  • GetDC
  • CreateCompatibleDC
Reads the contents of the clipboard:
  • GetClipboardData
Can shut the system down or lock the screen:
  • ExitWindowsEx
  • InitiateSystemShutdownExW
Info The PE's resources present abnormal characteristics. Resource CELMHRNBFYLOSJR is possibly compressed or encrypted.
Resource DYS is possibly compressed or encrypted.
Resource EJHLYETHBOXTIWGWS is possibly compressed or encrypted.
Resource EWGWRTJTFHSJFFMEYNQ is possibly compressed or encrypted.
Resource TFBOGPTXCXX is possibly compressed or encrypted.
Resource WOQTEFOWINYIEBJH is possibly compressed or encrypted.
Resource XKXLCRRDZQRM is possibly compressed or encrypted.
Resource ZAXHG is possibly compressed or encrypted.
Resource SCRIPT is possibly compressed or encrypted.
Malicious VirusTotal score: 29/66 (Scanned on 2019-08-06 10:16:33) MicroWorld-eScan: AIT:Trojan.Agent.EBPO
Malwarebytes: Trojan.MalPack.AutoIt
BitDefender: AIT:Trojan.Agent.EBPO
Arcabit: AIT:Trojan.Agent.EBPO
ESET-NOD32: a variant of Win32/Injector.Autoit.EEN
APEX: Malicious
Paloalto: generic.ml
Kaspersky: UDS:DangerousObject.Multi.Generic
Alibaba: Trojan:AutoIt/AgentTesla.784ebfbf
Endgame: malicious (high confidence)
DrWeb: Trojan.PWS.Stealer.23680
Invincea: heuristic
McAfee-GW-Edition: BehavesLike.Win32.Downloader.tc
Trapmine: suspicious.low.ml.score
FireEye: Generic.mg.df5ae09a57543c8f
Emsisoft: AIT:Trojan.Agent.EBPO (B)
Ikarus: Trojan.Autoit
Fortinet: AutoIt/Packed.NH!tr
Antiy-AVL: GrayWare/Autoit.RunPE.a
Microsoft: Trojan:AutoIt/AgentTesla.SZ!MTB
ZoneAlarm: UDS:DangerousObject.Multi.Generic
AhnLab-V3: Trojan/Win32.RL_AutoInj.R272810
Acronis: suspicious
MAX: malware (ai score=86)
Ad-Aware: AIT:Trojan.Agent.EBPO
Cylance: Unsafe
SentinelOne: DFI - Suspicious PE
GData: AIT:Trojan.Agent.EBPO (2x)
Qihoo-360: HEUR/QVM10.1.0587.Malware.Gen

Hashes

MD5 df5ae09a57543c8f8b30061218469e8c
SHA1 f943d0754b6693515bf63afaaefc7b7027be4b67
SHA256 ba6f8acbac51ccce2f6c5c7d4e7ae2c674ba251802e6f58baed97ba8ddada2a3
SHA3 9d51d5fa279ab89a21583a5ee93dfd94f6c5b7e0bef2e29afc69d5137d3c64c9
SSDeep 24576:uAHnh+eWsN3skA4RV1Hom2KXMmHaCh9AUGszcud5Nqr5:Zh+ZkldoPK8YaCh9AUGswIHi
Imports Hash fa59358b7f1799307801f91e30d4f889

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2019-Aug-06 07:57:19
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 12.0
SizeOfCode 0x8e000
SizeOfInitializedData 0x90e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0002800A (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8f000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x125000
SizeOfHeaders 0x400
Checksum 0x110619
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x400000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x400000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 310e36668512d53489c005622bb1b4a9
SHA1 8fb8e840c9e17486aac8a936bb9f4b4e97968eba
SHA256 3978cc62b69ced82d20d17cf1a21f3df483172b58e56d5fbd2bc9ea2a2d5d881
SHA3 b1e5f92eaba5ddd0b4b6af72ed26401b9b0935f9aa02f5474cc23639fe9e7bac
VirtualSize 0x8dfdd
VirtualAddress 0x1000
SizeOfRawData 0x8e000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.67525

.rdata

MD5 748cf1ab2605ce1fd72d53d912abb68f
SHA1 b14ea463e0ffca634d7b7ce1f680dcc6cd161f68
SHA256 1c69247833efc222dcaa09342032656ef5b89d7157746ad35a807c8c52eb2799
SHA3 d5369fc84ea2e78a22d37820d1baece6975ea27e02e1e848c8b165a8a86f91ae
VirtualSize 0x2fd8e
VirtualAddress 0x8f000
SizeOfRawData 0x2fe00
PointerToRawData 0x8e400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.76324

.data

MD5 aae9601d920f07080bdfadf43dfeff12
SHA1 3f68d00ffdc01d075cc78b7b0456ef541378b876
SHA256 905f5100fff55d7bc415d0c25c20c531b9ac9ff81d42768131fa05bdc9c43d9b
SHA3 c62d4b67634f28c8f9920beab4377a4aee75951c01df130df7b76ea9931b728d
VirtualSize 0x8f74
VirtualAddress 0xbf000
SizeOfRawData 0x5200
PointerToRawData 0xbe200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.19638

.rsrc

MD5 4a149dd0c972ecf4d138ea4a51ec8594
SHA1 e4dc24d5ddf01031f324a179ff0077ae51eac0f3
SHA256 2bbd78f1f78cd984a01128f212dbb4f8de36a8f92062dd554c19037a147c2451
SHA3 8e99b7c8bdfa10ed94c44cc669617fa36070184faa1a5cd23737acafd19baa27
VirtualSize 0x54a44
VirtualAddress 0xc8000
SizeOfRawData 0x54c00
PointerToRawData 0xc3400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.59066

.reloc

MD5 f04128ad0f87f42830e4a6cdbc38c719
SHA1 fba981637586f66a796fa0725a0a530f39ed875a
SHA256 e3f17f85d044b0544b8d3a536010d95d6d4e26759b2c706ce416fa6250fd8dbd
SHA3 9f7f2d280f703a8d6e9821660783261c959dc443898f90d169a9bcaebd34e9ea
VirtualSize 0x7134
VirtualAddress 0x11d000
SizeOfRawData 0x7200
PointerToRawData 0x118000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.78396

Imports

WSOCK32.dll #116
#23
#12
#21
#15
#17
#10
#9
#115
#151
#18
#1
#13
#2
#3
#111
#16
#20
#19
#11
#52
#57
#4
VERSION.dll GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
WINMM.dll timeGetTime
waveOutSetVolume
mciSendStringW
COMCTL32.dll ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
MPR.dll WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
WININET.dll InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW
PSAPI.DLL GetProcessMemoryInfo
IPHLPAPI.DLL IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
USERENV.dll DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
UxTheme.dll IsThemeActive
KERNEL32.dll DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
SetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
DeleteFileW
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
CloseHandle
GetFullPathNameW
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
FindClose
SetEnvironmentVariableA
USER32.dll AdjustWindowRectEx
CopyImage
SetWindowPos
GetCursorInfo
RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
TrackPopupMenuEx
GetCursorPos
DeleteMenu
SetRect
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
MonitorFromRect
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
DispatchMessageW
TranslateMessage
PeekMessageW
UnregisterHotKey
CheckMenuRadioItem
CharLowerBuffW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
SystemParametersInfoW
LoadImageW
GetClassNameW
GDI32.dll StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
StretchBlt
GetDIBits
LineTo
AngleArc
MoveToEx
Ellipse
DeleteDC
GetPixel
CreateDCW
GetStockObject
GetTextFaceW
CreateFontW
SetTextColor
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
StrokeAndFillPath
COMDLG32.dll GetOpenFileNameW
GetSaveFileNameW
ADVAPI32.dll GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW
SHELL32.dll DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish
ole32.dll CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeSecurity
OLEAUT32.dll #183
#11
#3
#6
#38
#39
#24
#23
#37
#41
#411
#163
#32
#146
#12
#7
#185
#220
#77
#10
#9
#418
#164
#442
#443
#186
#31
#2
#8

Delayed Imports

1

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.66371
MD5 d6f27bf763eb666af934477958acf362
SHA1 f724ee386cda31b32b5c88e08b9abf562c016a57
SHA256 62ba0b2575098d4428c9a99bd060ef7572071698bf9d03b4bd430f5f691378e5
SHA3 6f4a250c7a91ddfcc872e14b8ed1e4aa33a5ebb3280f7d021b47aa46edfb9586

2

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.05883
MD5 78f30e363a0499f530d057b4d639d36e
SHA1 360bd6476101b0cddc23d2c7eade326c1b16ceaf
SHA256 08bcba5aa989c988ea18f8101c84daaee58d4f0b584535a85186c8b98b66147e
SHA3 001ac9f6e8e52f9c3eb7101189fb953e2f4babfdea5b6e26b23b99173af38de4

3

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.25499
MD5 ad424f5f5d5ff4460343686c61e4f75e
SHA1 29a1f0faadc42f1b9f9767d8c724fdc58dd165c8
SHA256 245fc49e4e955e1db3975b826dcf27ad2eb32a6831caa4cb6b501a3914bcfaa9
SHA3 4f3a627ee7d533397f7f5c70bb2dafa8857150e674cb31edd96949c7905de509

4

Type RT_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xeac8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.94283
MD5 aa25c178e862d135ff71f80b3c56635c
SHA1 48624654abbe8db6e281362fdc28bf2f12d57dc9
SHA256 bd2f4a583aff46c5a01a6b6a8046402abcc4857e66603b4b7306582edc66afad
SHA3 4610481a8c2195887432239a3f43e6b4a248f242925159deff8fc2510e141fbe

166

Type RT_MENU
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x50
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68292
MD5 8140596ab00b98a11c13e6977d2d0977
SHA1 58abc231c2b5ac778a543a5dffcfabe867a6758d
SHA256 54f5e2ecbfc4f87380ca7466337676b99d0c4a21f806cf83f69fd48934c857ab
SHA3 7ccd3005ef4a3eccdb793d3b975a2f09338df5922357428238910610c0c59b70

7

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x594
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34702
MD5 d1f824f98742295a66a25225701dd6d8
SHA1 5b2075b778387182bf97314b593e73f30853435d
SHA256 4fe35e21717d34ceb4717f9e9de8fde1b3de80d76a59bb87405910c2f1d6284b
SHA3 294fc9961bf6eddc1dc7c5b525832f8aa8d3e90dac608e6421398510ab9c15b1

8

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x68a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2817
MD5 5beaeebda5346956e395fad21661f382
SHA1 201f2f699e6917e953821d64105b226fdd8b5528
SHA256 9306910d4bb273465765832df77fb1fd78bd6e0bcbf9908636e323c34c92b613
SHA3 d6430a84edfc22e41b15dd4f7cfc2d249bf5a637189d9284f062644b1503f9ee

9

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x490
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28849
MD5 6b12d17c7622d8215889a2288098fa15
SHA1 a511bf459e5043fcb234829bf66a99565c244652
SHA256 e47fa3aec12353f6370b941bc5855e5551530c7b26f925b5a2e2692a0201450c
SHA3 8e3541de418e1046806ffb977c8babecd093b9816c92883261b074d1c47d96fb

10

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x5fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.28373
MD5 949955dbda367f0c790615f7817e7886
SHA1 ee0370fb4ad59a4cebc3dbfc83bb437343fb803b
SHA256 4854e5abce2237256df24b69c9759fc1e8caa423a54bfe661ba7031afd8375eb
SHA3 5e36df684c6f2c4058d1a2507989eb5fc3c873159d006088d40f4da3804f56f2

11

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x65c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26322
MD5 9bc568a6176f738ffb3109e53235b579
SHA1 b97786555bfa05f958f174e294080e235d91b571
SHA256 d38369002e36f73866a0d40b13e069b9ffdbda50957f4c88d52a72fecb9b4e45
SHA3 94318c553eb0928412a92e8cf9913ca5c35a03aa8c24bf151a6764793b2f6f90

12

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x466
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25812
MD5 899b8766aea5f88410c721620925754b
SHA1 53ba98192d7ea4fa9051ac220ed18960ab0507a6
SHA256 58ea125e6b5fa2cbc5a8ed819c7f50c9bca1cfe55f94c7cff3feb60f25ac6073
SHA3 7ad4457a556ba648b1d46e62549fdc4c7d093bbad286f9123daf6a94f0e5af62

313

Type RT_STRING
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x158
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08572
MD5 193a9143563395ad14c6dac83d32e2ad
SHA1 87ca08eb609f9ceabbd8ea7a64263de9a05bbb22
SHA256 b3711acbe8e01fee7fd362112b4e42da05c728e98b85c0a3b4cb075977849cee
SHA3 7634b4daca191c6fa53de1d5964fa47f382afccebf5744e70a702fd179fad715

CELMHRNBFYLOSJR

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9854
MD5 1b38551e1d329647de42ca9ca92da998
SHA1 fa931bfc9400751f34a7187b6f8f6b0a22611759
SHA256 ef2d81662d1c2e1540a2aa66128ac5e1697dcd14b5f64a325b2f6a3cd2cb3071
SHA3 43967ef23faa9015604904ab621c12b73f1216e7d7ab7c4b546d1f94557cd3ab

DYS

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98673
MD5 da412f51f3051ba6019fe5209a6c3271
SHA1 625604a3d0798a9737024efff14b8beb0cf99701
SHA256 4abd1caf12394ab9eb0f78b4dd92ab0c8698cd79ea13b620aeeef4021c7423c7
SHA3 62f9dbaa324ec7d8268c18d6716af0ae1df7b25d06877d28b3313e40ddb9f922

EJHLYETHBOXTIWGWS

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98836
MD5 4f3229ffd7b74d3290ca6c1ff0662bb9
SHA1 9a33990f135c8729cb10888655c44cad05e5ca3f
SHA256 a1d9209a94276e570ac27e31e97a4b9aefe185127822f22432e10f2861e3e773
SHA3 91ffafe5984cdaa4053aa8e553fd04aec29a9f6d1d207480ac8eb25c8656e55a

EWGWRTJTFHSJFFMEYNQ

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.9851
MD5 99d71e1733cc331cd0351ed17757ef4e
SHA1 f3926eb0294fbe0b9c0efc50c5cd9e154cccc889
SHA256 1f8da339aa28612458435bb35feab0bc92eab5cb245df5922bd7c3876354e264
SHA3 62422188bce30031f05da3dabb1f80ab2cc4be3efc72d5fb44c5f94675214530

TFBOGPTXCXX

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98553
MD5 30f717d56143ab31e8776ee4990ae310
SHA1 3f411cb2a0ff85870602759db154b1ce73604a2b
SHA256 15b20237b5fa11f52725e448d2283e6d9746cbb2881826c1a321e9b09d9e7261
SHA3 9857c13791adfd6bff4437b8c908bcc910d3c95ae1d229dbec65253d71d4efae

WOQTEFOWINYIEBJH

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98511
MD5 32d47b4199779101eca7e3a853026e0b
SHA1 74af241c370878a5628f676c7e5bed5ffbcac350
SHA256 38c2bce19a4faff59b7febbb6bd97ff59c3abbad4606e8e91e104877936ec1e5
SHA3 d658cdd980f575b6d8f9d6b33647e203e864f1bf57aa3c4e8e75395a0c75302c

XKXLCRRDZQRM

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98606
MD5 4031b8fea1dea108c3e5ca98e08c1f7d
SHA1 a67d4bdb150b72bad33e8c26e7bf1e567c0e173d
SHA256 dcf1142875c4b52ed19281a151f13f1356e81ad9153281c1f34d30effa2eb554
SHA3 e3643dafd49135cef361fcd817497191fdce63af8b91907921b67d80f0a0dc61

ZAXHG

Type RT_FONT
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x3402
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98813
MD5 fc0a2d60f99fe4c9c714a3d045da9a82
SHA1 5466d0b680feeb5a0c7e21e583e90f09046a8220
SHA256 7843ac9729e40f332f35ea9bdcffe49b770f3a1d8a0bc90fddb755b67b969d60
SHA3 54f59751451ef66b4f793a0c931585fbcaae03016f100bf7bbc78c11ac5eb2a3

SCRIPT

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x28cea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99881
MD5 c753904cd27239267a98dbba884e716e
SHA1 b7affbc883ad6bb93e0800ba3ab562cfc0e6e23e
SHA256 40d3eeb4cb99da66e3b03600006a74f90ba0a484802929891dfd3c1c0381da7b
SHA3 fb7392a7987469d012402cb39d42734589050cbd2ca976eb4fba777556d58748

99

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.97095
Detected Filetype Icon file
MD5 252e838d901112640207d9c9a483a70d
SHA1 26508d097bd626c42cc98732486c5714707f0968
SHA256 6b94a48f0bbda65702ef88aa7633a5b6fef1a4ed30b2eca4ff5bce9a87149bea
SHA3 6794e6a4abf077de4987a8090db52144d6c8fd2adac9d17e5542167212b4d825

162

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.02322
Detected Filetype Icon file
MD5 7a9605cb416b1a091d889b9d9f37ec66
SHA1 866c01641d672b6cd69901c1e055f174f47b35bb
SHA256 6bcce1250099cc08d574211b3debabb0244cd2641f6d960538e7ddc97d319164
SHA3 af43e622bf6c842d1ada2985f8e68920ff7b22d8a0b1a12871968c23b5065651

164

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.84274
Detected Filetype Icon file
MD5 f64c60b749269fcf6659c450dda98486
SHA1 42945c3496bc4e1943a1a05926a9b5ee31d3e450
SHA256 ae172a9a2fd008910b537c92a95b38bfba0e5bbdaaca719bf686e6415a7a2ba1
SHA3 443830acdeb37f2b7f844756492b2b11f9fb93e9171617d8c799cebfd05cb37f

169

Type RT_GROUP_ICON
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.02322
Detected Filetype Icon file
MD5 60f05e3b8ea9e18928923bdbcc112277
SHA1 d97726a6e9c326a37507f879feca7e152157839c
SHA256 7698ef362b288a7e3b96304ca50814b42518cba38598db9dbb36d8b90212d76a
SHA3 390fd88c6012552aecc7f109e733a1bf00339b8b3758127752832484c9f13ce6

1 (#2)

Type RT_VERSION
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0xdc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.77862
MD5 410f594f3ad95b1dd20e08e299b97c51
SHA1 523aa56f00d4d21ffcbd0f82cda655d88349a740
SHA256 ebfbc032f504c40d9098735ecfd8c80d996de100b07130e2855b9125e1f57fe5
SHA3 e785abf691c076cc1fc9cd02b8b7cc3ea433971151b12bd00999ac83071094c5

1 (#3)

Type RT_MANIFEST
Language English - United Kingdom
Codepage Latin 1 / Western European
Size 0x3ef
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.40026
MD5 a8983985aa631a15210e820fc8e1e52e
SHA1 fed4e5d714e5b12f8a61604ba61eaf6e2bee2fbd
SHA256 1bd8139910a81485aadb0bb28586e233768486de8c09f6a565ae457805702d39
SHA3 8582ac809cc76ad6f98d859f53bd4eed751c5aeb31783f353e10875eae68ce64

String Table contents

(Paused)
AutoIt Error
AutoIt has detected the stack has become corrupt.
Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
"EndWith" missing "With".
Badly formatted "Func" statement.
"With" missing "EndWith".
Missing right bracket ')' in expression.
Missing operator in expression.
Unbalanced brackets in expression.
Error in expression.
Error parsing function call.
Incorrect number of parameters in function call.
"ReDim" used without an array variable.
Illegal text at the end of statement (one statement per line).
"If" statement has no matching "EndIf" statement.
"Else" statement with no matching "If" statement.
"EndIf" statement with no matching "If" statement.
Too many "Else" statements for matching "If" statement.
"While" statement has no matching "Wend" statement.
"Wend" statement with no matching "While" statement.
Variable used without being declared.
Array variable has incorrect number of subscripts or subscript dimension range exceeded.
Variable subscript badly formatted.
Subscript used on non-accessible variable.
Too many subscripts used for an array.
Missing subscript dimensions in "Dim" statement.
No variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
Expected a "=" operator in assignment statement.
Invalid keyword at the start of this line.
Array maximum size exceeded.
"Func" statement has no matching "EndFunc".
Duplicate function name.
Unknown function name.
Unknown macro.
Unable to get a list of running processes.
Invalid element in a DllStruct.
Unknown option or bad parameter specified.
Unable to load the internet libraries.
"Struct" statement has no matching "EndStruct".
Unable to open file, the maximum number of open files has been exceeded.
"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.
Expected a variable in user function call.
"Do" statement has no matching "Until" statement.
"Until" statement with no matching "Do" statement.
"For" statement is badly formatted.
"Next" statement with no matching "For" statement.
"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.
"For" statement has no matching "Next" statement.
"Case" statement with no matching "Select"or "Switch" statement.
"EndSelect" statement with no matching "Select" statement.
Recursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Cannot make existing variables static.
Cannot make static variables into regular variables.
Badly formated Enum statement
This keyword cannot be used after a "Then" keyword.
"Select" statement is missing "EndSelect" or "Case" statement.
"If" statements must have a "Then" keyword.
Badly formated Struct statement.
Cannot assign values to constants.
Cannot make existing variables into constants.
Only Object-type variables allowed in a "With" statement.
"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.
Object referenced outside a "With" statement.
Nested "With" statements are not allowed.
Variable must be of type "Object".
The requested action with this object has failed.
Variable appears more than once in function declaration.
ReDim array can not be initialized in this manner.
An array variable can not be used in this manner.
Can not redeclare a constant.
Can not redeclare a parameter inside a user function.
Can pass constants by reference only to parameters with "Const" keyword.
Can not initialize a variable with itself.
Incorrect way to use this parameter.
"EndSwitch" statement with no matching "Switch" statement.
"Switch" statement is missing "EndSwitch" or "Case" statement.
"ContinueCase" statement with no matching "Select"or "Switch" statement.
Assert Failed!
Obsolete function/parameter.
Invalid Exitcode (reserved for AutoIt internal use).
Variable cannot be accessed in this manner.
Func reassign not allowed.
Func reassign on global level not allowed.
Unable to parse line.
Unable to open the script file.
String missing closing quote.
Badly formated variable or macro.
Missing separator character after keyword.

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United Kingdom
Resource LangID English - United Kingdom

IMAGE_DEBUG_TYPE_RESERVED

Characteristics 0
TimeDateStamp 2018-Mar-15 13:14:39
Version 0.0
SizeofData 4
AddressOfRawData 0xb6f18
PointerToRawData 0xb6318

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x4bfd50
SEHandlerTable 0
SEHandlerCount 0

RICH Header

XOR Key 0xc1fc1252
Unmarked objects 0
C++ objects (20806) 2
199 (41118) 1
ASM objects (VS2013 build 21005) 51
C objects (VS2013 build 21005) 177
C++ objects (VS2013 build 21005) 53
C objects (VS2008 SP1 build 30729) 9
Imports (VS2008 SP1 build 30729) 37
Total imports 544
234 (VS2013 UPD5 build 40629) 80
ASM objects (VS2013 UPD5 build 40629) 1
Resource objects (VS2013 build 21005) 1
151 1
Linker (VS2013 UPD5 build 40629) 1

Errors