b0b4f12e53cdcfb16aec3f10baf7a2c8dba3efedd8031bd65108948148ff01f3
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2017-Jun-05 07:54:43 |
| Detected languages |
English - United States
French - France |
Plugin Output
| Suspicious | The PE is packed with UPX |
Unusual section name found: UPX0
Section UPX0 is both writable and executable. Unusual section name found: UPX1 Section UPX1 is both writable and executable. The PE only has 7 import(s). |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. |
Resource 110 is possibly compressed or encrypted.
Resource 139 is possibly compressed or encrypted. Resource 140 is possibly compressed or encrypted. Resource 141 is possibly compressed or encrypted. Resource 149 is possibly compressed or encrypted. Resource 150 is possibly compressed or encrypted. Resource 151 is possibly compressed or encrypted. Resource 101 is possibly compressed or encrypted. |
| Suspicious | VirusTotal score: 2/61 (Scanned on 2017-06-05 22:44:35) |
Bkav:
HW64.packed.D555
ESET-NOD32: a variant of Win32/Packed.VMProtect.ABD |
Hashes
| MD5 | eb4d2382c25c887ebc7775d56c417c6a 🔍 |
|---|---|
| SHA1 | ea57175c19a391c4cc3f6736a066c69ee2853e39 🔍 |
| SHA256 | b0b4f12e53cdcfb16aec3f10baf7a2c8dba3efedd8031bd65108948148ff01f3 🔍 |
| SHA3 | 6db7a59a599b7706adacd56d38e209ab22efaef8cc7ff7a65985576d53a86ba6 🔍 |
| SSDeep | 49152:5lAcYdnRvkDxCMPW2aRecqx1M+hlLMkSplHxQWp/SSV2Q98W7YpDqMNFcfhY+2d:5lAcYdnRKsD9R/q/MYxMk4RJpqivkKY 🔍 |
| Imports Hash | 1cc939866e9697745ea7b7a61c18e481 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 3 |
| TimeDateStamp | 2017-Jun-05 07:54:43 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 12.0 |
| SizeOfCode | 0x29c000 |
| SizeOfInitializedData | 0x1a000 |
| SizeOfUninitializedData | 0x59000 |
| AddressOfEntryPoint | 0x00000000002F5240 (Section: UPX1) |
| BaseOfCode | 0x5a000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x310000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
UPX0
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x59000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
UPX1
| MD5 | cc5f3d0cbf51ef69846e6eb391dce0f1 🔍 |
|---|---|
| SHA1 | 89dee712abd1c21d4e98ef79405e2c3e84465f93 🔍 |
| SHA256 | da3751a3c4cd244afaa613368c0bef4830957b111549494d8134fc4a4347ddad 🔍 |
| SHA3 | 8635d320167fb9aa3c87adb2b741ed99c0522611151f0950c0e1134b6e0b0658 🔍 |
| VirtualSize | 0x29c000 |
| VirtualAddress | 0x5a000 |
| SizeOfRawData | 0x29b600 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.89174 |
.rsrc
| MD5 | 40ead3c7c95bdddad7b92aa7d80ff29f 🔍 |
|---|---|
| SHA1 | f8751c70a64a325f924130e6d356d1f975100701 🔍 |
| SHA256 | 906b70a28a09f14242040819abc2685b1f09693dd2e1592117343a2f3dfefd02 🔍 |
| SHA3 | a11f3207342c2835f4b49714d353aece6b174136001472dc7134e5a37d4c81be 🔍 |
| VirtualSize | 0x1a000 |
| VirtualAddress | 0x2f6000 |
| SizeOfRawData | 0x19600 |
| PointerToRawData | 0x29ba00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 6.11761 |
Imports
| ADVAPI32.dll |
RegCloseKey
|
|---|---|
| GDI32.dll |
BitBlt
|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess GetProcAddress VirtualProtect |
| USER32.dll |
EndPaint
|
Delayed Imports
110
| Type |
RT_BITMAP
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0xb41aa |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.92073 |
| MD5 | 64d691f5a86dea64026761519d98b6c0 🔍 |
| SHA1 | 6721b906d09361523731b1fc0abb41c8ce2f1966 🔍 |
| SHA256 | f2c1b4df7819eec260fcce885c10161ee3ca45455439d2a01f6e63202a994a2c 🔍 |
| SHA3 | 99244795d754a7ea9d3626b7b4f5f9e2bfaa133dbd0dd51f9c7c4d3f9892d5b8 🔍 |
| Preview |
|
139
| Type |
RT_BITMAP
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x266a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.77399 |
| MD5 | 4883708e2aace153d7f9d2506c241910 🔍 |
| SHA1 | 361eb1505e547594ec35c58d1bd44589a38453b8 🔍 |
| SHA256 | 9d73f0ae675500ad3d849cda8d3e8550b20a7b966f96a8cf2c87039a0f3a983f 🔍 |
| SHA3 | 4175563b591d3df8dfd1b486532fb29ed5bfe772d79a0a1a904164e77e51b4b8 🔍 |
| Preview |
|
140
| Type |
RT_BITMAP
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x266a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.8053 |
| MD5 | 03925b2fc11e707edd163c0a822625fe 🔍 |
| SHA1 | a447071d1afd8665aca89a82fe160db52d820c1a 🔍 |
| SHA256 | acb8f00c2ce21c8fdc0d983482869f44cc6924416aaca7bfaddbd4873c12112a 🔍 |
| SHA3 | add9ba15af15a74f84420e7a7d21640f2bc9f0a8f679fa228fd8c6610ee98ea4 🔍 |
| Preview |
|
141
| Type |
RT_BITMAP
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x266a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.8456 |
| MD5 | 8ff0dbc0e9a768be6a100f05a0e2151e 🔍 |
| SHA1 | 3cfbd28ae8d6768ba6aab6a8ce2ce1a8e6713003 🔍 |
| SHA256 | 32da2359c0461d5b9fd04fe788eb96dca2de09e68923e6ff50b225d30926709a 🔍 |
| SHA3 | de267442e6a42f1206269b74049f50b965c26c7cb11a626222f1b9cf583acdbb 🔍 |
| Preview |
|
149
| Type |
RT_BITMAP
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x266a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.82588 |
| MD5 | 826ab374b4f8e4bc88c698106c2d84c0 🔍 |
| SHA1 | d7f2b297d5a988eef02f964336936d3bb8ff45b0 🔍 |
| SHA256 | b30582b622235ab7c6226fadbc2d9bac06324cf130b2d6cffb10ea4000ec7728 🔍 |
| SHA3 | f41da1b7d56aa4c869c24e2bcea692f204cf9edc27d9328b32f85afe20d82bed 🔍 |
| Preview |
|
150
| Type |
RT_BITMAP
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x266a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.8469 |
| MD5 | 984d3a8b3bf74028aea467d558315cea 🔍 |
| SHA1 | 790ba0638fad6f7f302d4986f9b47d372e91ee01 🔍 |
| SHA256 | 13651d4acf28fea7b958be56c5135293c8b3a4e17bad301dd6c6106a7586dc87 🔍 |
| SHA3 | 1dcb9f5249f5ed4923652564e86735440946b019fd494bac210f5cc28ff1cf15 🔍 |
| Preview |
|
151
| Type |
RT_BITMAP
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x266a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.86756 |
| MD5 | 7e61153acd4ebc74cb59a21343453dd7 🔍 |
| SHA1 | 5f14cd92adbb1f0105d7bb043fcbe3c96b657a82 🔍 |
| SHA256 | 42817dd2f895df0cea3da2db1a66395eb500c98684345e36aa18a17e35daf103 🔍 |
| SHA3 | 2419813d9b53c570614f85d050c91d9bf15afa948e09c4025f441b9cff3fdbe2 🔍 |
| Preview |
|
1
| Type |
RT_ICON
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.09201 |
| MD5 | 7e1689c4e7421edfa60da66d90385c6e 🔍 |
| SHA1 | 41c08ec2ea0ebb85896d4a5877173fd7efa2b63b 🔍 |
| SHA256 | 7fa30be594bfc8ae35a849ff9a76479197bc44d6b423366b9c007e64dc1c3b41 🔍 |
| SHA3 | df9206f482bdfc95dd2e97d46fd7fa11df546bf6c794ee43ed525082472c44ad 🔍 |
2
| Type |
RT_ICON
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.0998 |
| MD5 | 12b2c2a90fe93c5202d12a2b41d25967 🔍 |
| SHA1 | 427f9ade06933628555eb465432e9c2cc1d9cacb 🔍 |
| SHA256 | 5c73ef630874eecb9f01addb063a9d928d66d9269afe721a22a857c449218dea 🔍 |
| SHA3 | 1920effe2ee7462e77963cbd84ca830d0bbcea8a4482fb9f4f607549a1d6d7be 🔍 |
3
| Type |
RT_ICON
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.82448 |
| MD5 | 3d4a4e9ef674afcc69966247a94f3eba 🔍 |
| SHA1 | 41de5171f8dbdae51577ca3ae55b37701715846b 🔍 |
| SHA256 | 7b5057741eb3a148404e3ff26a888849ab73c66dc7ef6d7e63a60e2b102f988f 🔍 |
| SHA3 | a6d38187831ed4f3f0947d07f3f0a9a9a1914dedc41509644a715fbb9b26a871 🔍 |
4
| Type |
RT_ICON
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.10317 |
| MD5 | 7008ae5d9c09725b0218e535725b1839 🔍 |
| SHA1 | 15cd7202130e4a43383995c8d12ddae2524484a9 🔍 |
| SHA256 | ef3a98bcf9e317a3a0c388c85dd253a7fd4b56896539b897c5f51c69bc6c6c55 🔍 |
| SHA3 | 6591502f98664d2484050cacec8e954255c240a5987a11786aaaffbf00180481 🔍 |
5
| Type |
RT_ICON
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.10012 |
| MD5 | c1f810353e3a0cecd0f41f6cd87135e7 🔍 |
| SHA1 | 485f22e27e480d1003036e3ed298ea1050648af9 🔍 |
| SHA256 | 2b53f0b91d233a66764f9fcdc268f7be515723af12a95c72b529a5b285f1a814 🔍 |
| SHA3 | a9b3dc29f5d35166e6f8d21d15f960bf0b4b837dbf27da6fc45dc288f8051072 🔍 |
6
| Type |
RT_ICON
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 6.02584 |
| MD5 | 72eca9a185fc507836e4e8adce5f4ce4 🔍 |
| SHA1 | ccb0b83dbdd7bdcfdcd84b624b94d8eb724e517d 🔍 |
| SHA256 | d83235df95b3f967a951a364fe76574511844cfc8f7e9b9e15f3fc8c87f737de 🔍 |
| SHA3 | 77cf7ed3052e82097f1174dd28585c4844b24e241594e2b4b9e182db2603c569 🔍 |
101
| Type |
RT_DIALOG
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x216 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.12662 |
| MD5 | c575a539990b2dae78eaa78dec424968 🔍 |
| SHA1 | 67889cac8068f87f2e0e273af9f51814a86a84fe 🔍 |
| SHA256 | 40b75a24170b57c2d6d8cd43cd3d6310974ca515617be37e25f053e92dac918a 🔍 |
| SHA3 | 2d0124c33c14d07da18064b7bcc822c3cebb35697f67d0d386e1c84f24eb5209 🔍 |
138
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | French - France |
| Codepage | UNKNOWN |
| Size | 0x5a |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.93166 |
| Detected Filetype | Icon file |
| MD5 | f5723686d1bc0634fadf4b72bed38ddb 🔍 |
| SHA1 | 2f1c87a1f075c02c90f1e67e6f0d799bb84bea25 🔍 |
| SHA256 | d6311f34aa7ac66fbf4c140f18e7266a64b5e5146bbc668b6fb0497f453b0733 🔍 |
| SHA3 | 9bac55d51c4b09ca8b830988a8c5a0b5da93bec4b6b4ac8033ffc2b7bd94cb09 🔍 |
1 (#2)
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
Version Info
TLS Callbacks
Load Configuration
| Size | 0x70 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140017000 |
RICH Header
| XOR Key | 0xbe1f99e7 |
|---|---|
| Unmarked objects | 0 |
| C++ objects (20806) | 30 |
| C objects (20806) | 104 |
| ASM objects (20806) | 8 |
| Imports (65501) | 9 |
| Total imports | 109 |
| 229 (VS2013 build 21005) | 6 |
| Resource objects (VS2013 build 21005) | 1 |
| 151 | 1 |
| Linker (VS2013 build 21005) | 1 |
Errors
[*] Warning: Section UPX0 has a size of 0!
Leave a comment
No comments yet.