ed9e6d927be0b5f365eef259b4bc6c0aea7c85607fca68c915fb3df943ad3e6f

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1998-Jun-16 15:27:16
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can access the registry:
  • RegQueryValueA
  • RegOpenKeyA
  • RegCloseKey
Suspicious The file contains overlay data. 6906 bytes of data starting at offset 0x1e00.
The overlay data has an entropy of 7.97254 and is possibly compressed or encrypted.
Suspicious VirusTotal score: 1/71 (Scanned on 2024-01-27 04:08:51) MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 bf3186c4431348fe6af145279f6dd702
SHA1 0e89e7ad01529a8c62cc8af12972eaffccb066b5
SHA256 ed9e6d927be0b5f365eef259b4bc6c0aea7c85607fca68c915fb3df943ad3e6f
SHA3 ff88668db164e842be40d8295256c369106eef75ab6f62bee0d1e43ce62a4576
SSDeep 192:hkXiN9UU/URSlKaIrW28vTcdNo2rxFRkMAmf1SC6eOMFz:Qi/U9K2B8vA3dxsMAQ6uFz
Imports Hash 208bd77ce42c2f2815c3279bdb7a44d9

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xb8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 1998-Jun-16 15:27:16
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 5.0
SizeOfCode 0xa00
SizeOfInitializedData 0x1400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001760 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x5000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 df90bfbd75b69b1df94c2c61e6d5a272
SHA1 013cdd6d3440c733c812c1dbb5863d71365ac9d8
SHA256 cdfb2e4cafa58f9cf1008f5b11701cde0042ad219bd041ceab4cf8f584f4fb1d
SHA3 f4dc9563ab769bce06bc9368a66556b95f710f8c43026fbf15a3bd48fb60b159
VirtualSize 0x96c
VirtualAddress 0x1000
SizeOfRawData 0xa00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.86797

.rdata

MD5 001178bb7e21dfd8d113bb293f389ccf
SHA1 9af941b71f4e3ca30f619cf40f61f86d046e956a
SHA256 83b6ff50b3b6778dd71cc2e459a914a71fdfacaa0f220f091cce8e0f9f17d352
SHA3 dd7a5b9945a5e3cd21f8264950920af0f9ca57db252bf24093a3c8ad1ffae225
VirtualSize 0x458
VirtualAddress 0x2000
SizeOfRawData 0x600
PointerToRawData 0xe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.83587

.data

MD5 fc195313635a38763a2f520706ee2518
SHA1 29740bff16f303e77cb4f1ca4bdf65659e6a19ba
SHA256 4bb592d504ebd17d26005f54ab71f79179476a4c67d67af2e0783689daec5683
SHA3 3e241a9dd47a50e068917287de71e8fce4e15cdaba06221af29084fc023847c3
VirtualSize 0x600
VirtualAddress 0x3000
SizeOfRawData 0x200
PointerToRawData 0x1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.47159

.rsrc

MD5 cdbede7e0b04beec0b0812c4bc531a4e
SHA1 2db1575915d19b79b444be94dfc8cf12b4f70c8f
SHA256 e48e0d7f3113250e2b22e1cda8f3c27243070e86becaa0ebe7c5fa0042975872
SHA3 504db62253a9a0e5f41ff0eee2b7c55ac1dcf62f990ac40dc765c9e3039c9bd6
VirtualSize 0x7d9
VirtualAddress 0x4000
SizeOfRawData 0x800
PointerToRawData 0x1600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.07808

Imports

MSVCRT.dll __set_app_type
__p__fmode
_adjust_fdiv
_controlfp
_access
__p__commode
__setusermatherr
_initterm
__getmainargs
__p__acmdln
exit
_XcptFilter
_exit
_mbschr
strtok
_mbsicmp
_mbsrchr
_mbsncpy
_pctype
_isctype
__mb_cur_max
_except_handler3
KERNEL32.dll GetStartupInfoA
GetModuleHandleA
_llseek
_lread
_lopen
_lclose
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetCurrentDirectoryA
GetSystemDirectoryA
lstrcatA
lstrcpyA
USER32.dll wsprintfA
MessageBoxA
LoadStringA
ADVAPI32.dll RegQueryValueA
RegOpenKeyA
RegCloseKey

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25196
MD5 43267a73f142929b24a610d48ae5359c
SHA1 e2743b858a8b0c5474341a207123788c6447a961
SHA256 04ee775586ec56d27cebe64f71bd3643d5347bdefc52b12af4e29f5a5815f4bf
SHA3 203b021616d6e2a4e827ee5de3986db50fe96f6eacf90d00657456df4b23acea

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.05126
MD5 adb0344b2b353883c467e625b4799b69
SHA1 ff588803c1fdbfe4c3eb0f53f167761fc5ec058f
SHA256 190ce2661ff69a47763815d1dcf2370857cc335f9ee1e878c3d1017247c67a63
SHA3 a31f1c8bd162185e60c27b904d93aa8ca5a21a7bcf5e284f1676bda0d342f90b

1 (#2)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x18c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.35681
MD5 7b485faa27b3670d2af9eb2a07383c32
SHA1 1b9158a62d9b9dab4109a6ef633111f4a953ac93
SHA256 c787ce3b458fb8855d4b75d86e7c7170183d5ebf70b0850c7312bc8a53e494de
SHA3 f5480548f700159336efff279d4e68edf2b5cd0f783bc2e6c3ab71ba59311dd4

15000

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.37086
Detected Filetype Icon file
MD5 c1c122f0803bda39a0a478b7f6f75954
SHA1 69dc2bcb5214afae0d924867d59ece9c0c0f1f64
SHA256 62b460dcfdda934b386205e7f4a16da00a73c2ca7f4ea9a396fb25537fb33b76
SHA3 ffeff2838ef20f5e9b000b10f6538617dbf201bb6d23fa2831e24c8652fc93c5

String Table contents

VFP6.EXE
VFP6R.DLL
VFP6R.TSL
Microsoft Visual FoxPro
Cannot locate the Microsoft Visual FoxPro support library.
The %s file is invalid or damaged.
Cannot run the file %s.
Error code 0xlX.

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x885b41af
Unmarked objects 0
Unmarked objects (#2) 65
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

Leave a comment

No comments yet.