f05ad9e9c2cab20ef3ccdb4f083027ff1193437116be7a6b8a6ba9eaae6ccbb2

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2019-Jul-30 08:52:45

Plugin Output

Info Matching compiler(s): MASM/TASM - sig2(h)
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
  • LoadLibraryW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 d9bcd01bf8e41fd8b2ce6d96275007ee
SHA1 8d751b2406c1e046a0072a6fe4058817c8c661bc
SHA256 f05ad9e9c2cab20ef3ccdb4f083027ff1193437116be7a6b8a6ba9eaae6ccbb2
SHA3 691bccf8f0ef77b07a46f7deceb20fd556dc908f91dd1962a2dae4115a0b3a1b
SSDeep 1536:n7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfTwpeOF:77DhdC6kzWypvaQ0FxyNTBfT4
Imports Hash 2c5f2513605e48f2d8ea5440a870cb9e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2019-Jul-30 08:52:45
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x11400
SizeOfInitializedData 0x4c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001000 (Section: .code)
BaseOfCode 0x1000
BaseOfData 0x13000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x1a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.code

MD5 46da2c5018752470fd3127bf22d63b95
SHA1 79689d07d23e494c8a40e425f6b58b6fcfcee935
SHA256 dde5c88b25500cafc481c699e30ea58342b107228ef6f3a08d3361a60203430b
SHA3 dae8493b3d4a31fe01cf730bafbd7390586ff0f116fa5ded8284d0382b858c3e
VirtualSize 0x387e
VirtualAddress 0x1000
SizeOfRawData 0x3a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.52922

.text

MD5 e1a026e66953c410d7f60b1f1e3c560f
SHA1 838d55d26dd9efd6b0506c9c55f064f69bff3a1d
SHA256 97f61efc9684f623eae30fcce8a8b3035003d341200579275f19f5468d496a75
SHA3 cf24a88fe26c2aa2d32468714671eaf669efc73ed42178d15681551c2967b390
VirtualSize 0xd962
VirtualAddress 0x5000
SizeOfRawData 0xda00
PointerToRawData 0x3e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.56249

.rdata

MD5 a16842a34a5da6feda9533bb3e83c3c1
SHA1 597bcd6908d7d29b813201e8506c5ae636de4377
SHA256 e7aa3b9a2637a54058211b802f96742faf19c341e604e483c54b9da022bf7a4d
SHA3 054e5f2439e80e489d6f8f42717ee344b2492bc8230b9d42ef3816c922b51cc1
VirtualSize 0x33a5
VirtualAddress 0x13000
SizeOfRawData 0x3400
PointerToRawData 0x11800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.11184

.data

MD5 a5c78107096aa549fee864f1076d1a32
SHA1 7cbbeef91ae6f99fc0c2448774dd957382265d1b
SHA256 9f03545a9ca036d3c341ae05a9d1b73177659b6ca008ec9468ce3d3b3662fab0
SHA3 ffa898be1800d2aa85084e28f7b8ff9e584772a593c2006b14a66d1c921ca68d
VirtualSize 0x178c
VirtualAddress 0x17000
SizeOfRawData 0x1200
PointerToRawData 0x14c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.10273

.rsrc

MD5 1b87bbee853788cb291e520e6f832f4e
SHA1 e6e1bbac0675f6a138a76f5592fb67862ea15f37
SHA256 5bcaef336ae424652015b6845348682a7cf82269a14d7ca6dfe4a1fcf47d3f28
SHA3 6e952ed85cd10a8ee9a29604a43529043239d84ea9d495188833d941a635ab30
VirtualSize 0x4b4
VirtualAddress 0x19000
SizeOfRawData 0x600
PointerToRawData 0x15e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.13037

Imports

MSVCRT.dll memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc
KERNEL32.dll GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetNativeSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
GetProcAddress
GetVersionExW
Sleep
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
SetUnhandledExceptionFilter
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
USER32.DLL CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
DestroyWindow
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
EnableWindow
GetSystemMetrics
CreateWindowExW
SetWindowLongW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
GDI32.DLL GetStockObject
COMCTL32.DLL InitCommonControlsEx
SHELL32.DLL ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
WINMM.DLL timeBeginPeriod
OLE32.DLL CoInitialize
CoTaskMemFree
SHLWAPI.DLL PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW

Delayed Imports

08C15EC2CF96FC63F23CF266172CB4C04C9D263A

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xa
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32193
MD5 982c0b9b16efd9a7f65005ea1c91d8a1
SHA1 258ebdf649594ae3f3eb22f5122a0c5a0c6379b5
SHA256 fe6508c9247ac6c4cad3f4a1b4c87c86735db9ef5b446fbaebe599189d23ff65
SHA3 e57aa3594a4cf79fddcc88cfe5872b4d15257f1e8a698c918ef7f016bc8a9fce

5BD4E46278

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA3 2767f15c8af2f2c7225d5273fdd683edc714110a987d1054697c348aed4e6cc7

68D68302F5BB63B67F6491DDFA0A5088

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xe
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23593
MD5 7bb55e591962edd967c9a3039407256c
SHA1 e84642313805d66ef70fdada202992d040a1c2cc
SHA256 8fcbd3ba77d0af716d0b3f342b877539512ba665a6c5ad7999a531bff05a6a91
SHA3 116f25e12adcabbb7a50c5223cf85536391d06d1114f226b2e5d018f6907ff91

7524EF9CFEF6007A7066E470D9BD263C

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x13
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.24793
MD5 1e84b7ef09c63045ba8e6e2a32355900
SHA1 b3d61d99dde93d46e12e52924b22505ebeb1747e
SHA256 d5ec1d9b83cc541cbb28cda0d4fbb61a171841e9f5138a92e8f9346355c28d85
SHA3 f620e738a947ba7061309176f0fd70aeca1d5a39793cafb46904d39fae59280e

1

Type RT_MANIFEST
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x263
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.92322
MD5 841795bb3b61ebd511249778aa26af77
SHA1 59f426938522ef9906b0740821e8cc270d1ca897
SHA256 be809cba9d14bfb52a969d766992832b10e99e133babcdd99dc6d1bba5597cf7
SHA3 5fa5c36711cc5c3661248b1180ce35543201ff1dc77d158129b844f03a2144c9

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.