| Architecture |
IMAGE_FILE_MACHINE_I386
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date |
2005-Nov-12 09:30:44
|
| Detected languages |
English - United States
|
|
Suspicious
|
PEiD Signature: |
UPX -> www.upx.sourceforge.net
|
|
Suspicious
|
The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
|
|
Suspicious
|
The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
- LoadLibraryA
- GetProcAddress
Can take screenshots:
|
|
Suspicious
|
The PE header may have been manually modified. |
The resource timestamps differ from the PE header:
|
|
Suspicious
|
VirusTotal score: 1/69 (Scanned on 2026-07-15 13:56:48) |
APEX:
Malicious
|
| MD5 |
5556f0c6d397b4348a25a2f396f6591b
🔍
|
| SHA1 |
48a32a9f4e52dfc24a4cd840b0f188e677b2e602
🔍
|
| SHA256 |
e139648070ec1de00c7cbb135db664dd725c1cdb6d2ecad3108b8b9f906cf4de
🔍
|
| SHA3 |
382ff3d28d609b01e114be84e82abae74b0f057d117a321db5763ce2cd891ff5
🔍
|
| SSDeep |
6144:tPD32witO8bchiGb4fyxrpfUB6wgrdDPW9ePXm+g/:1mwkO3E0425wgRDO0P2+
🔍
|
| Imports Hash |
d2f3d50ab2a0dd6db22b4597b991bde3
🔍
|
| e_magic |
MZ
|
| e_cblp |
0x90
|
| e_cp |
0x3
|
| e_crlc |
0
|
| e_cparhdr |
0x4
|
| e_minalloc |
0
|
| e_maxalloc |
0xffff
|
| e_ss |
0
|
| e_sp |
0xb8
|
| e_csum |
0
|
| e_ip |
0
|
| e_cs |
0
|
| e_ovno |
0
|
| e_oemid |
0
|
| e_oeminfo |
0
|
| e_lfanew |
0x80
|
| Signature |
PE
|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections |
3
|
| TimeDateStamp |
2005-Nov-12 09:30:44
|
| PointerToSymbolTable |
0
|
| NumberOfSymbols |
0
|
| SizeOfOptionalHeader |
0xe0
|
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic |
PE32
|
| LinkerVersion |
2.0
|
| SizeOfCode |
0x46000
|
| SizeOfInitializedData |
0x1000
|
| SizeOfUninitializedData |
0xb0000
|
| AddressOfEntryPoint |
0x000F5F10 (Section: UPX1)
|
| BaseOfCode |
0xb1000
|
| BaseOfData |
0xf7000
|
| ImageBase |
0x400000
|
| SectionAlignment |
0x1000
|
| FileAlignment |
0x200
|
| OperatingSystemVersion |
4.0
|
| ImageVersion |
1.0
|
| SubsystemVersion |
4.0
|
| Win32VersionValue |
0
|
| SizeOfImage |
0xf8000
|
| SizeOfHeaders |
0x1000
|
| Checksum |
0
|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve |
0x200000
|
| SizeofStackCommit |
0x1000
|
| SizeofHeapReserve |
0x100000
|
| SizeofHeapCommit |
0x1000
|
| LoaderFlags |
0
|
| NumberOfRvaAndSizes |
16
|
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
🔍
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
🔍
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
🔍
|
| SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
🔍
|
| VirtualSize |
0xb0000
|
| VirtualAddress |
0x1000
|
| SizeOfRawData |
0
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 |
35136e8bd7b8b74a747b40c132fce087
🔍
|
| SHA1 |
fa41227884fd120bc9c0e25b78333e17c5c73308
🔍
|
| SHA256 |
d0d558eec163c4d8d684a40ab1b947a4ec809c5d1b1e33d046adaa45608216fe
🔍
|
| SHA3 |
8d2c402df3979c30936dbb67eb63aeb4d06ab42f375cd8e1e2571bc8bfe8a0be
🔍
|
| VirtualSize |
0x46000
|
| VirtualAddress |
0xb1000
|
| SizeOfRawData |
0x45200
|
| PointerToRawData |
0x200
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
7.92838
|
| MD5 |
808b3db42de252f419ad38e605b0f952
🔍
|
| SHA1 |
7a097aaf93245cc8953bf3683dd7e67591ca47a3
🔍
|
| SHA256 |
5825b16b1543229be28fc5641e494443755eeabb1c71ab46a397fe8a9c293215
🔍
|
| SHA3 |
98489cd90bfaf29c3f2d14f97196daa553a08778713052d6fc4eb940b2f85008
🔍
|
| VirtualSize |
0x1000
|
| VirtualAddress |
0xf7000
|
| SizeOfRawData |
0x600
|
| PointerToRawData |
0x45400
|
| PointerToRelocations |
0
|
| PointerToLineNumbers |
0
|
| NumberOfLineNumbers |
0
|
| NumberOfRelocations |
0
|
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy |
4.07347
|
| KERNEL32.DLL |
LoadLibraryA
GetProcAddress
ExitProcess
|
| ddraw.dll |
DirectDrawCreate
|
| dinput.dll |
DirectInputCreateA
|
| dsound.dll |
DirectSoundCreate
|
| GDI32.dll |
BitBlt
|
| msvcrt.dll |
pow
|
| OLE32.dll |
CoInitialize
|
| USER32.dll |
GetDC
|
| WINMM.DLL |
joyGetPosEx
|
| Type |
RT_ICON
|
| Language |
English - United States
|
| Codepage |
UNKNOWN
|
| Size |
0x2e8
|
| TimeDateStamp |
2013-Aug-23 06:29:14
|
| Entropy |
3.55971
|
| MD5 |
a54821a7420471fb8b35f5b73dcbf057
🔍
|
| SHA1 |
3fd7ca0053913552d98373fa9b803c049a465a64
🔍
|
| SHA256 |
7809f492aeb094ecdce046b3400bccf8d94dca085b9e39e1c5e4990547712c2a
🔍
|
| SHA3 |
ff762519d814b1f7acc6ddbc594a7991931f3bbde659725bb1603288fff7a3cf
🔍
|
| Type |
RT_GROUP_ICON
|
| Language |
English - United States
|
| Codepage |
UNKNOWN
|
| Size |
0x14
|
| TimeDateStamp |
2013-Aug-23 06:29:14
|
| Entropy |
1.67095
|
| Detected Filetype |
Icon file
|
| MD5 |
35913758d9456cf8b35f5170eecc9e06
🔍
|
| SHA1 |
0778ef6972099657029fb7e768530dc954c8647b
🔍
|
| SHA256 |
a4e1b5d39d55c4667e8a436af75bf5916b1bd7bd4b9fd0bbdeb3af1844fe27c6
🔍
|
| SHA3 |
5dd302f02c66e2a914d744def9c5ec34b8bc3f723d3f62a93a845cceb0666c27
🔍
|
[*] Warning: Section UPX0 has a size of 0!
e139648070ec1de00c7cbb135db664dd725c1cdb6d2ecad3108b8b9f906cf4de