e139648070ec1de00c7cbb135db664dd725c1cdb6d2ecad3108b8b9f906cf4de

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2005-Nov-12 09:30:44
Detected languages English - United States

Plugin Output

Suspicious PEiD Signature: UPX -> www.upx.sourceforge.net
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can take screenshots:
  • BitBlt
  • GetDC
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2013-Aug-23 06:29:14
Suspicious VirusTotal score: 1/69 (Scanned on 2026-07-15 13:56:48) APEX: Malicious

Hashes

MD5 5556f0c6d397b4348a25a2f396f6591b
SHA1 48a32a9f4e52dfc24a4cd840b0f188e677b2e602
SHA256 e139648070ec1de00c7cbb135db664dd725c1cdb6d2ecad3108b8b9f906cf4de
SHA3 382ff3d28d609b01e114be84e82abae74b0f057d117a321db5763ce2cd891ff5
SSDeep 6144:tPD32witO8bchiGb4fyxrpfUB6wgrdDPW9ePXm+g/:1mwkO3E0425wgRDO0P2+
Imports Hash d2f3d50ab2a0dd6db22b4597b991bde3

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2005-Nov-12 09:30:44
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x46000
SizeOfInitializedData 0x1000
SizeOfUninitializedData 0xb0000
AddressOfEntryPoint 0x000F5F10 (Section: UPX1)
BaseOfCode 0xb1000
BaseOfData 0xf7000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xf8000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0xb0000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 35136e8bd7b8b74a747b40c132fce087
SHA1 fa41227884fd120bc9c0e25b78333e17c5c73308
SHA256 d0d558eec163c4d8d684a40ab1b947a4ec809c5d1b1e33d046adaa45608216fe
SHA3 8d2c402df3979c30936dbb67eb63aeb4d06ab42f375cd8e1e2571bc8bfe8a0be
VirtualSize 0x46000
VirtualAddress 0xb1000
SizeOfRawData 0x45200
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.92838

.rsrc

MD5 808b3db42de252f419ad38e605b0f952
SHA1 7a097aaf93245cc8953bf3683dd7e67591ca47a3
SHA256 5825b16b1543229be28fc5641e494443755eeabb1c71ab46a397fe8a9c293215
SHA3 98489cd90bfaf29c3f2d14f97196daa553a08778713052d6fc4eb940b2f85008
VirtualSize 0x1000
VirtualAddress 0xf7000
SizeOfRawData 0x600
PointerToRawData 0x45400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.07347

Imports

KERNEL32.DLL LoadLibraryA
GetProcAddress
ExitProcess
ddraw.dll DirectDrawCreate
dinput.dll DirectInputCreateA
dsound.dll DirectSoundCreate
GDI32.dll BitBlt
msvcrt.dll pow
OLE32.dll CoInitialize
USER32.dll GetDC
WINMM.DLL joyGetPosEx

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 2013-Aug-23 06:29:14
Entropy 3.55971
MD5 a54821a7420471fb8b35f5b73dcbf057
SHA1 3fd7ca0053913552d98373fa9b803c049a465a64
SHA256 7809f492aeb094ecdce046b3400bccf8d94dca085b9e39e1c5e4990547712c2a
SHA3 ff762519d814b1f7acc6ddbc594a7991931f3bbde659725bb1603288fff7a3cf

ALLEGRO_ICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2013-Aug-23 06:29:14
Entropy 1.67095
Detected Filetype Icon file
MD5 35913758d9456cf8b35f5170eecc9e06
SHA1 0778ef6972099657029fb7e768530dc954c8647b
SHA256 a4e1b5d39d55c4667e8a436af75bf5916b1bd7bd4b9fd0bbdeb3af1844fe27c6
SHA3 5dd302f02c66e2a914d744def9c5ec34b8bc3f723d3f62a93a845cceb0666c27

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section UPX0 has a size of 0!
Leave a comment

No comments yet.