f1f38c597274f84546fe88f49aea2d1a

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-05 00:42:40
Detected languages Chinese - PRC
English - United States
Debug artifacts d:\QQPCDownloader_proj\PackageTools\product\win32\dbginfo\kpacket.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ 8
Microsoft Visual C++ 8.0
MSVC++ v.8 (procedure 1 recognized - h)
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The file headers were tampered with. The RICH header checksum is invalid.
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryA
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
  • CreateFileA
Info The PE is digitally signed. Signer: Tencent Technology(Shenzhen) Company Limited
Issuer: VeriSign Class 3 Code Signing 2010 CA
Suspicious VirusTotal score: 1/68 (Scanned on 2017-12-17 11:43:23) ESET-NOD32: a variant of Win32/Tencent.E potentially unwanted

Hashes

MD5 f1f38c597274f84546fe88f49aea2d1a
SHA1 1ab400faf14581e0267ad4d9d4e405b2630d1d2c
SHA256 278ce41f098cbb09e9877ffdab435178e16d9df92e700402343383eb009168c6
SHA3 50772b78e8cdf8a5565698ac0dfd3d980e814f5e35df776e37dc6a2068040cf7
SSDeep 49152:vp/LoLvlmHQoqow5T+OhD4BAsj9+CMVF03R0hqvT:R/LoLvlmHaow5JhD4BAsR+XVu3h
Imports Hash 33b8550790a7e95c4234631fba9862f7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 1970-Jan-05 00:42:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x3e000
SizeOfInitializedData 0x16000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0002C5A9 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x3f000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x59000
SizeOfHeaders 0x1000
Checksum 0x1866c4
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 8939b791b2deb9e34cfde9e51bc348cc
SHA1 81a4293b94f4c31556312794a96d34f7ce875201
SHA256 3f48e68e3bc1e0546488082303e966841421f4795b745b06994380cef04cbe85
SHA3 8742990e9661790c407417d0816b029009d52e151cf428ec4eaba8e3d9331ee8
VirtualSize 0x3d831
VirtualAddress 0x1000
SizeOfRawData 0x3e000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.64776

.rdata

MD5 7925ecee436fe7e5fefedb529fb7da1d
SHA1 182a4e53469e3bcf34dbd5f4b48c452b15184446
SHA256 bca4e8704dce7a2046023e541938335b5ee2e0d5db24cafdeba283abf50e63a7
SHA3 ce18f6e365ed729afa4a7d9210d33d478c6ea9e67a9cd7d70c3d14a704a02728
VirtualSize 0xda4e
VirtualAddress 0x3f000
SizeOfRawData 0xe000
PointerToRawData 0x3f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.74422

.data

MD5 6680e279818bc2d97354b0a09a5e04d0
SHA1 1567a16ba3288265c519afd9fd6df663d1763b98
SHA256 cee24dd308de6d8440d8c7a527d695ae602adcf3136e619f2821bb8dd1502071
SHA3 b2d58839d23d007160791801b39ea4e77e3d59ba8485899f4f5c0ba4106c73fa
VirtualSize 0x6e80
VirtualAddress 0x4d000
SizeOfRawData 0x3000
PointerToRawData 0x4d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.23546

.rsrc

MD5 407346a89b0144f77f48d3528fc9911a
SHA1 3eb73ead8dd1cc24354c7dff782d49e08b8d3bd7
SHA256 66e8a8c9ef13e21f015132beefcd3714a3a4aa9c0566d8ba0b836f7931114bb2
SHA3 0dd63b48edc0dd70392ef5bfc1915d596266d480058963195ac99cc1076cddd0
VirtualSize 0x4f20
VirtualAddress 0x54000
SizeOfRawData 0x5000
PointerToRawData 0x50000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.05587

Imports

KERNEL32.dll ReadFile
GetModuleFileNameW
CreateProcessW
WaitForSingleObject
GetSystemDirectoryW
CloseHandle
LoadLibraryW
GetProcAddress
FindResourceW
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
GetTempPathW
CreateFileW
FindResourceExW
GetCurrentProcess
GetFileSize
TerminateProcess
FindFirstFileW
lstrcmpW
SetFileAttributesW
DeleteFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
VirtualFree
VirtualAlloc
RemoveDirectoryW
DeleteCriticalSection
SetEvent
InitializeCriticalSection
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
CreateEventW
WriteFile
GetStdHandle
CopyFileW
SetFileTime
MoveFileW
GetCurrentDirectoryW
GetTempFileNameW
GetSystemInfo
SystemTimeToFileTime
LocalFileTimeToFileTime
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
CreateFileA
SetFilePointer
FindClose
GetLastError
GetTickCount
FindNextFileW
CreateDirectoryW
GetFileAttributesW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedIncrement
InterlockedDecrement
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapCreate
GetModuleFileNameA
SetHandleCount
GetFileType
USER32.dll CharLowerW
CharUpperW
UnregisterClassA
ole32.dll CoUninitialize
CoInitialize
OLEAUT32.dll #6
#2
#9
#10
SHLWAPI.dll PathAddBackslashW

Delayed Imports

1

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.61212
MD5 3df06392ad18984a0064f578b501fa90
SHA1 3dd80d25c510deae821f8519c4cda970cfbfe3e2
SHA256 67ac6994a2f429e851b657799f591351e11a2fb355ac0146d76ada656eca9adc
SHA3 0d788cf113b4f6da2dc5bc9d72ae0b65ce10c9437cb1c935d4fa72b73a05ab6a

2

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04211
MD5 379b073f16ce7dc8917078051b8e4f04
SHA1 9db66cf91e8e83fcfb654c2956fa3a328dad337d
SHA256 804383813f40fa0d51f517cdc81d04dd69ae8611aba96cb6b1caa35b044cccf0
SHA3 f238e799e700976ac794aea4bbf352e939ea3fec189135c0e81902571db45b40

3

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.75499
MD5 be6715d464727b9d2f924db0acfe6464
SHA1 55839a366fc7be95e16df4172aa17673db27fd6d
SHA256 7f481e1f8e479ae872dec2443f7d1bb559094fcaaa2e937f3619e02f5e6dce55
SHA3 08150dd6a2e0e1a163e5493535979f3f9d0f387eef46b18a8bc12b64fcd1bdca

4

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.02798
MD5 bde2fe303984725a0a6aff394a093769
SHA1 3070381c8ba71ad0994decddf0f02fd4d922d731
SHA256 da2bc2e9eb6654cae62fe7dbf996d7df42107ec6e985505c258a8afd7e7d8e62
SHA3 39935096dc25a22cd5cf8ca7c36eb8fbc3e31d3d5c327fc9c4b6280c8c5abfd7

5

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25238
MD5 ce8b7542dcebf82eb91a6666d503d557
SHA1 81ee31aaab9199d2b0a9f9a2b8617887143ed6c5
SHA256 c90faa20544b25d3a03284084c0da6b05a1751f8c76823a7b8c6f20ebef4564d
SHA3 1cbe4e0c9292037673bf713baf20a69efc22e9a8f9a8fe3dc7c48943d752e4e3

6

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.60151
MD5 c13e13e44c499a7506c0d7093b1a450b
SHA1 0c63c8fae58b73a329bd0fe4b83368d3d3ba657b
SHA256 65dcd0060206ad694ffcbcad81a84ff47171a43fa8041d88440a71648fcaa3a2
SHA3 dea02dfc50bf2abe42608d1da21e0d9fda559692bf41c09ee3bdceeb9f5ea31d

101

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.69653
Detected Filetype Icon file
MD5 ee39773e4f61f7a7ae151f53aa35f048
SHA1 efcdaa04adcdb24b41e9eafe70c6d8cb6cc8a005
SHA256 cfd47014b258a78cf61b05cf2b553c3bdb0ce4824b2c12184a03003219df9f01
SHA3 c0f20f645b39eb7dd67bc50e5831766b10e6395aeb6d9ecf2461d9765e24e571

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x2fb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.08691
MD5 5752f1422717de9331d0495640e2697e
SHA1 5a110e7a77e7ea17b26dc6c1102067d4c87c9c27
SHA256 26d9b436f8f83f694d823aadbc15d7108ee5cbcb0dbdefd593b70d37b3301bcb
SHA3 af20712185171b798c0dede327bc6c32943cf03a7374557a7c9b63403a75e4b6

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2014-May-15 07:43:39
Version 0.0
SizeofData 94
AddressOfRawData 0x456a8
PointerToRawData 0x456a8
Referenced File d:\QQPCDownloader_proj\PackageTools\product\win32\dbginfo\kpacket.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x44d104
SEHandlerTable 0x448290
SEHandlerCount 174

RICH Header

XOR Key 0xa0932074
Unmarked objects 0
126 (50327) 1
ASM objects (VS2012 build 50727 / VS2005 build 50727) 25
C objects (VS2012 build 50727 / VS2005 build 50727) 158
C++ objects (VS2012 build 50727 / VS2005 build 50727) 68
C objects (VS2003 (.NET) build 4035) 1
Imports (VS2003 (.NET) build 4035) 17
Total imports 185
114 (VS2012 build 50727 / VS2005 build 50727) 93
Resource objects (VS2012 build 50727 / VS2005 build 50727) 1
Linker (VS2012 build 50727 / VS2005 build 50727) 1

Errors

<-- -->