| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-May-21 13:06:59 |
| Detected languages |
English - United Kingdom
|
| FileVersion | 2.2.0.0 |
| Comments | http://www.autoitscript.com/autoit3/ |
| FileDescription | Link Discovery for Windows |
| ProductVersion | 3.3.16.1 |
| LegalCopyright | Chris Hall 2010-2015 |
| ProductName | LDWin |
| ProductVersion (#2) | 2.2 |
| OriginalFileName | LDWin.exe |
| ProductName (#2) | LDWin |
| ProductVersion (#3) | 2.2 |
| OriginalFileName (#2) | LDWin.exe |
| ProductName (#3) | LDWin |
| ProductVersion (#4) | 2.2 |
| OriginalFileName (#3) | LDWin.exe |
| ProductName (#4) | LDWin |
| ProductVersion (#5) | 2.2 |
| OriginalFileName (#4) | LDWin.exe |
| ProductName (#5) | LDWin |
| ProductVersion (#6) | 2.2 |
| OriginalFileName (#5) | LDWin.exe |
| Suspicious | PEiD Signature: |
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX -> www.upx.sourceforge.net UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses known Mersenne Twister constants |
| Suspicious | The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable. Unusual section name found: UPX1 Section UPX1 is both writable and executable. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. |
Resource 7 is possibly compressed or encrypted.
Resource 8 is possibly compressed or encrypted. Resource 9 is possibly compressed or encrypted. Resource 10 is possibly compressed or encrypted. Resource 11 is possibly compressed or encrypted. Resource 12 is possibly compressed or encrypted. Resource 313 is possibly compressed or encrypted. Resource SCRIPT is possibly compressed or encrypted. Resources amount for 89.561% of the executable. |
| Malicious | VirusTotal score: 12/68 (Scanned on 2026-11-10 13:53:56) |
APEX:
Malicious
Bkav: W32.Malware.A80D8F4D Cylance: Unsafe Cynet: Malicious (score: 100) Elastic: malicious (moderate confidence) Fortinet: W32/PossibleThreat MaxSecure: Trojan.Malware.3411146.susgen Paloalto: generic.ml Sophos: Generic Reputation PUA (PUA) Symantec: ML.Attribute.HighConfidence Trapmine: malicious.high.ml.score TrendMicro-HouseCall: Trojan.Win32.Gen.TL0101EN26ZB |
| MD5 | ca229a0d267066905a44737814a8c9ac 🔍 |
|---|---|
| SHA1 | 818b49fc83b3abcb1596495009309cfd6f0758b3 🔍 |
| SHA256 | e348ec8fdb8068c73491607bae2d259746ef56356bb8492ab0ee0f9bedba96c0 🔍 |
| SHA3 | 1a00b19dc0f2db833197e2a019fee6d86998821f5e53623a75168977f24ed1bb 🔍 |
| SSDeep | 98304:t+S9bgY1xz1WgRKLobgSdfv3E+rzwUFUOIIqUA:YMcY1xz1WrL8gUfvU+XbUWNA 🔍 |
| Imports Hash | 21371b611d91188d602926b15db6bd48 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2024-May-21 13:06:59 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x5d000 |
| SizeOfInitializedData | 0x30f000 |
| SizeOfUninitializedData | 0x396000 |
| AddressOfEntryPoint | 0x003F3B50 (Section: UPX1) |
| BaseOfCode | 0x397000 |
| BaseOfData | 0x3f4000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x703000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x400000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x400000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x396000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 | 0db5c8373536f8d5000b77464ed3fba1 🔍 |
|---|---|
| SHA1 | 9c30056479f7a9d28237e65e7f17b0e3deec3762 🔍 |
| SHA256 | a0c47fe5afe8b9f9e16b32ce93698a7203ddf9114fb2d81756ed6a8e71a7c546 🔍 |
| SHA3 | 30e7aa3d3d3b601eafb96e33ba9ba1e1e8b75a7992306f18855ae4af93f93297 🔍 |
| VirtualSize | 0x5d000 |
| VirtualAddress | 0x397000 |
| SizeOfRawData | 0x5ce00 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.93637 |
| MD5 | 9f6d5e2b31273c6470fb60b6fda4a56b 🔍 |
|---|---|
| SHA1 | 560a696f1df573ada1799ceb2ca169f1b469de5f 🔍 |
| SHA256 | da3c32f0f3662cfd088eddae2c9b12347e11fab1e5eb8c4257e181f8f01e61e3 🔍 |
| SHA3 | c97de9d07a4f4bcf32b91bc0255b8976b6d9c9a41f3da1a987522c746dd2d909 🔍 |
| VirtualSize | 0x30f000 |
| VirtualAddress | 0x3f4000 |
| SizeOfRawData | 0x30f000 |
| PointerToRawData | 0x5d200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.99975 |
| KERNEL32.DLL |
LoadLibraryA
GetProcAddress VirtualProtect VirtualAlloc VirtualFree ExitProcess |
|---|---|
| ADVAPI32.dll |
GetAce
|
| COMCTL32.dll |
ImageList_Remove
|
| COMDLG32.dll |
GetSaveFileNameW
|
| GDI32.dll |
LineTo
|
| IPHLPAPI.DLL |
IcmpSendEcho
|
| MPR.dll |
WNetGetConnectionW
|
| ole32.dll |
CoGetObject
|
| OLEAUT32.dll |
OleLoadPicture
|
| PSAPI.DLL |
GetProcessMemoryInfo
|
| SHELL32.dll |
DragFinish
|
| USER32.dll |
GetDC
|
| USERENV.dll |
LoadUserProfileW
|
| UxTheme.dll |
IsThemeActive
|
| VERSION.dll |
VerQueryValueW
|
| WININET.dll |
FtpOpenFileW
|
| WINMM.dll |
timeGetTime
|
| WSOCK32.dll |
connect
|
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x128 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.25499 |
| MD5 | ad424f5f5d5ff4460343686c61e4f75e 🔍 |
| SHA1 | 29a1f0faadc42f1b9f9767d8c724fdc58dd165c8 🔍 |
| SHA256 | 245fc49e4e955e1db3975b826dcf27ad2eb32a6831caa4cb6b501a3914bcfaa9 🔍 |
| SHA3 | 4f3a627ee7d533397f7f5c70bb2dafa8857150e674cb31edd96949c7905de509 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.27559 |
| MD5 | afcd6775ace46ee9fe2e49aa340bb834 🔍 |
| SHA1 | 0379fdca2412559b5f6fcb12306d548d8d09b1be 🔍 |
| SHA256 | 1f145d5a8fc290b9a4df1361dc9ef91eea3b5736bf6fefe6f83a948175818a89 🔍 |
| SHA3 | 428c4b4a722f532772cd69d041194bf4b27c6163575bd541eacb7b78badddd6a 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.87208 |
| MD5 | aeb27ecaefb19dfbc734e2f0de8f513f 🔍 |
| SHA1 | 7a8b5720f3f1442b41932040c20e4b4b5343e055 🔍 |
| SHA256 | 412674f507c4d569aca5e817a763b1177ffcf5b431ca715af79cc711b8cb318c 🔍 |
| SHA3 | 412a96b28e3ad95152a3d98adf6b1a3289da23941d9dd1fbb7913241ae2fd861 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x594 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.87857 |
| MD5 | fe653922839d3af3dcdb2784549d2f01 🔍 |
| SHA1 | daac4fcfe66083ee4167fb6ea72b63288a046be8 🔍 |
| SHA256 | 75d554e32b3416074e0dafaca2c3f2882f5094779bcabd2f76c994e4068083e3 🔍 |
| SHA3 | 03724e41ddd22e1e5c0f8cde4732134b207f30d37f9c22d94fe91e35c894d00c 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x68a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.89981 |
| MD5 | e62d183a2fecd52dd3a384b937e6cdc0 🔍 |
| SHA1 | d617c9e3b1bb3673374fd49ddc7ea849cf931167 🔍 |
| SHA256 | 7392de88a94cb1920909825d0c3d58baf40ee859eab36838c75311cc2017e1da 🔍 |
| SHA3 | 7947358b494882211bafa8715c9c4817efe85ba951e21476f0494954c54c4028 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x490 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.84475 |
| MD5 | f2a1e149da7f81413c891a9e2b057835 🔍 |
| SHA1 | f38d0ce8d09a61cd314113133b3ff9fb956e0999 🔍 |
| SHA256 | 3da2f4eb1bb8347f573948b7cdb4451fb2a1994addd9a30f087a484dc0e4c488 🔍 |
| SHA3 | b999ce4af3d5fa8901cfbc19b2e93ae8cdc2ea1dc1bcaf86ed7138cd29482a6f 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x5fc |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.87172 |
| MD5 | 71033fbd02f5e4d3b3095dac796db2f9 🔍 |
| SHA1 | f022a0089d7c83cd2ba8c66b5eb3198185082fa1 🔍 |
| SHA256 | 5dbcb0d5038c2126119c241086f6b05ab7e428c729529ac88d388f0994bd04ba 🔍 |
| SHA3 | 6bbae7270e8a7c026b1926bcaf7dccd9de37625c3a4ddf81ad94e1f417516ad4 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x65c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.89023 |
| MD5 | 4a5226586eea3c242562e6df652a72da 🔍 |
| SHA1 | 2dabfe4b9baea2735a82532cfa7d2c2a73a163dd 🔍 |
| SHA256 | 99cfc9ceb4cc0f29393e34ada8a14455d2f046880d7237a32fc63deb498322d5 🔍 |
| SHA3 | 90dbf792b5d5f0a099d8ecc2243a53f934d93bb788689b503a2e9c460c184a32 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x466 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.82211 |
| MD5 | 47649abe0ab460bc6e8d6560cb6e4cbe 🔍 |
| SHA1 | 1b31d241f936f6b5f490e45c2574b6e5dc8c9871 🔍 |
| SHA256 | c51d3a2d59caa14d4e1ad9304e57fe0a7664fc0be958cac9a9fc06163e835abe 🔍 |
| SHA3 | 30f4980c647d646e7c283b132b74263a07a707ee4e7dc138f8a1ed3dbc63e2e2 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x158 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.41503 |
| MD5 | a6bea48b1c6d6002203c48b1fdf6f936 🔍 |
| SHA1 | c2ee311d767daad05ac68cf5e737029f02251556 🔍 |
| SHA256 | b1ef08bc167873d96a504b4322ea7cf2e39ed488e2fb7c1437537dfb65d75541 🔍 |
| SHA3 | 0df1c4142530e161e09908d1a436259af8bad8ca65983b1e4319b1f838d9eaf0 🔍 |
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | Latin 1 / Western European |
| Size | 0x30c5de |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.99994 |
| MD5 | 009f42a244beeb1a66cdd062097b0c2d 🔍 |
| SHA1 | 63c049db91beb4a4e2b75635813ccc24834b36a2 🔍 |
| SHA256 | 8c43f6af63cec2eb4438014ceca8bf5afd3f968a0f63686957546e949787a870 🔍 |
| SHA3 | 1e9cf8a13917dcc70e463fdefc682e85b75b20f7252e6eb2f796846bc3d2c302 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x22 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.11118 |
| Detected Filetype | Icon file |
| MD5 | 1585a6878dbcc1520f663c593e253ad1 🔍 |
| SHA1 | c21fa55f0eb66d99e41bea49d1e1ae10210b7d9a 🔍 |
| SHA256 | d8ea621ae35addfac7c2acc2c571770138fde4e8872b06bd988153d24e9922fa 🔍 |
| SHA3 | c13411884dfc5430907826b00a8caf8cdc8900822bdf83194e078045f69ad390 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.84274 |
| Detected Filetype | Icon file |
| MD5 | f64c60b749269fcf6659c450dda98486 🔍 |
| SHA1 | 42945c3496bc4e1943a1a05926a9b5ee31d3e450 🔍 |
| SHA256 | ae172a9a2fd008910b537c92a95b38bfba0e5bbdaaca719bf686e6415a7a2ba1 🔍 |
| SHA3 | 443830acdeb37f2b7f844756492b2b11f9fb93e9171617d8c799cebfd05cb37f 🔍 |
| Type |
RT_VERSION
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x53c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.38933 |
| MD5 | 11674696c66b99dd82112af8049ad7be 🔍 |
| SHA1 | f4215f1b448b749758f5a4d358253b3f4810f19b 🔍 |
| SHA256 | e3ba136ac20234aed06c5b30ea94e564d8f2a19b4c166c6ef9e8df9585405c05 🔍 |
| SHA3 | 7e120a0d62c1cf3da92f29005bb72320f4688ad9639e3ed114754ad9d8630527 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United Kingdom |
| Codepage | Latin 1 / Western European |
| Size | 0x65d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.33385 |
| MD5 | f51831972a9ecbd89990e1c18bf7d27b 🔍 |
| SHA1 | 69b42e8354620f1cfffadf2d48cf9d66e7d3f7cc 🔍 |
| SHA256 | 1376cdd3a45280b187926bbc8391cd6fd84c45cb112be1b3e9ce57c548883ebb 🔍 |
| SHA3 | 727b6759d310684f074f276777f7ba79cfb7d44611ec4520a3ee9902af57d60e 🔍 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 2.2.0.0 |
| ProductVersion | 3.3.16.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_UNKNOWN
|
| Language | English - United Kingdom |
| FileVersion (#2) | 2.2.0.0 |
| Comments | http://www.autoitscript.com/autoit3/ |
| FileDescription | Link Discovery for Windows |
| ProductVersion (#2) | 3.3.16.1 |
| LegalCopyright | Chris Hall 2010-2015 |
| ProductName | LDWin |
| ProductVersion (#3) | 2.2 |
| OriginalFileName | LDWin.exe |
| ProductName (#2) | LDWin |
| ProductVersion (#4) | 2.2 |
| OriginalFileName (#2) | LDWin.exe |
| ProductName (#3) | LDWin |
| ProductVersion (#5) | 2.2 |
| OriginalFileName (#3) | LDWin.exe |
| ProductName (#4) | LDWin |
| ProductVersion (#6) | 2.2 |
| OriginalFileName (#4) | LDWin.exe |
| ProductName (#5) | LDWin |
| ProductVersion (#7) | 2.2 |
| OriginalFileName (#5) | LDWin.exe |
| Resource LangID | English - United Kingdom |
|---|
| Size | 0xa0 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x4cc014 |
| SEHandlerTable | 0 |
| SEHandlerCount | 0 |
| XOR Key | 0xfdeda6de |
|---|---|
| Unmarked objects | 0 |
| 241 (40116) | 35 |
| 243 (40116) | 157 |
| 242 (40116) | 35 |
| 199 (41118) | 1 |
| C++ objects (VS 2015/2017 runtime 26706) | 45 |
| C objects (VS 2015/2017 runtime 26706) | 18 |
| ASM objects (VS 2015/2017 runtime 26706) | 21 |
| C objects (VS2008 SP1 build 30729) | 9 |
| Imports (VS2008 SP1 build 30729) | 37 |
| Total imports | 553 |
| C++ objects (POGO O) (27045) | 80 |
| ASM objects (27045) | 1 |
| Resource objects (27045) | 1 |
| 151 | 1 |
| Linker (27045) | 1 |
No comments yet.