f1f38c597274f84546fe88f49aea2d1a

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-05 00:42:40
Detected languages Chinese - PRC
English - United States
Debug artifacts d:\QQPCDownloader_proj\PackageTools\product\win32\dbginfo\kpacket.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ 8
Microsoft Visual C++ 8.0
MSVC++ v.8 (procedure 1 recognized - h)
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to SHA1
Uses constants related to SHA256
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryA
Possibly launches other programs:
  • CreateProcessW
Can create temporary files:
  • GetTempPathW
  • CreateFileW
  • CreateFileA
Info The PE is digitally signed. Signer: Tencent Technology(Shenzhen) Company Limited.
Issuer: VeriSign Class 3 Code Signing 2010 CA.
Suspicious VirusTotal score: 1/68 (Scanned on 2017-12-17 11:43:23) ESET-NOD32: a variant of Win32/Tencent.E potentially unwanted

Hashes

MD5 f1f38c597274f84546fe88f49aea2d1a
SHA1 1ab400faf14581e0267ad4d9d4e405b2630d1d2c
SHA256 278ce41f098cbb09e9877ffdab435178e16d9df92e700402343383eb009168c6
SHA3 06d6fb291f3d66be7b3c692aaf94447084af9a56268d7e23fe835b3a7a20589f
SSDeep 49152:vp/LoLvlmHQoqow5T+OhD4BAsj9+CMVF03R0hqvT:R/LoLvlmHaow5JhD4BAsR+XVu3h
Imports Hash 33b8550790a7e95c4234631fba9862f7

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 1970-Jan-05 00:42:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x3e000
SizeOfInitializedData 0x16000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x2c5a9 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x3f000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x59000
SizeOfHeaders 0x1000
Checksum 0x1866c4
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics (EMPTY)
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 8939b791b2deb9e34cfde9e51bc348cc
SHA1 81a4293b94f4c31556312794a96d34f7ce875201
SHA256 3f48e68e3bc1e0546488082303e966841421f4795b745b06994380cef04cbe85
SHA3 ccf0c4626e788c196cbd65bfbb1046bba62c70ce942c757e0a33016331ce321d
VirtualSize 0x3d831
VirtualAddress 0x1000
SizeOfRawData 0x3e000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.64776

.rdata

MD5 7925ecee436fe7e5fefedb529fb7da1d
SHA1 182a4e53469e3bcf34dbd5f4b48c452b15184446
SHA256 bca4e8704dce7a2046023e541938335b5ee2e0d5db24cafdeba283abf50e63a7
SHA3 9385ce3983e40f4e16433e15ae2a61fb1bad75432d70688bb486b1637fbad079
VirtualSize 0xda4e
VirtualAddress 0x3f000
SizeOfRawData 0xe000
PointerToRawData 0x3f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.74422

.data

MD5 6680e279818bc2d97354b0a09a5e04d0
SHA1 1567a16ba3288265c519afd9fd6df663d1763b98
SHA256 cee24dd308de6d8440d8c7a527d695ae602adcf3136e619f2821bb8dd1502071
SHA3 06574912a0de9d71d397abd0532f644df1cd11bfb6cc9122b080a4e7575d6e2f
VirtualSize 0x6e80
VirtualAddress 0x4d000
SizeOfRawData 0x3000
PointerToRawData 0x4d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.23546

.rsrc

MD5 407346a89b0144f77f48d3528fc9911a
SHA1 3eb73ead8dd1cc24354c7dff782d49e08b8d3bd7
SHA256 66e8a8c9ef13e21f015132beefcd3714a3a4aa9c0566d8ba0b836f7931114bb2
SHA3 5dc817d8ccb0bea27fb6abfade793658baf4c2541c5ed64096fd718e6d7192b3
VirtualSize 0x4f20
VirtualAddress 0x54000
SizeOfRawData 0x5000
PointerToRawData 0x50000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.05587

Imports

KERNEL32.dll ReadFile
GetModuleFileNameW
CreateProcessW
WaitForSingleObject
GetSystemDirectoryW
CloseHandle
LoadLibraryW
GetProcAddress
FindResourceW
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
GetTempPathW
CreateFileW
FindResourceExW
GetCurrentProcess
GetFileSize
TerminateProcess
FindFirstFileW
lstrcmpW
SetFileAttributesW
DeleteFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
VirtualFree
VirtualAlloc
RemoveDirectoryW
DeleteCriticalSection
SetEvent
InitializeCriticalSection
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
CreateEventW
WriteFile
GetStdHandle
CopyFileW
SetFileTime
MoveFileW
GetCurrentDirectoryW
GetTempFileNameW
GetSystemInfo
SystemTimeToFileTime
LocalFileTimeToFileTime
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
CreateFileA
SetFilePointer
FindClose
GetLastError
GetTickCount
FindNextFileW
CreateDirectoryW
GetFileAttributesW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedIncrement
InterlockedDecrement
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapCreate
GetModuleFileNameA
SetHandleCount
GetFileType
USER32.dll CharLowerW
CharUpperW
UnregisterClassA
ole32.dll CoUninitialize
CoInitialize
OLEAUT32.dll #6
#2
#9
#10
SHLWAPI.dll PathAddBackslashW

Delayed Imports

1

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x128
Entropy 2.61212
MD5 3df06392ad18984a0064f578b501fa90
SHA1 3dd80d25c510deae821f8519c4cda970cfbfe3e2
SHA256 67ac6994a2f429e851b657799f591351e11a2fb355ac0146d76ada656eca9adc
SHA3 12434d633749321c32ba908561729864f50d77c7217595b6aaf33a3edef8189f

2

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x8a8
Entropy 3.04211
MD5 379b073f16ce7dc8917078051b8e4f04
SHA1 9db66cf91e8e83fcfb654c2956fa3a328dad337d
SHA256 804383813f40fa0d51f517cdc81d04dd69ae8611aba96cb6b1caa35b044cccf0
SHA3 9e4abcbc7ad6f190af41189cb43449367db1982eb28a10e7d49819192311443f

3

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x568
Entropy 2.75499
MD5 be6715d464727b9d2f924db0acfe6464
SHA1 55839a366fc7be95e16df4172aa17673db27fd6d
SHA256 7f481e1f8e479ae872dec2443f7d1bb559094fcaaa2e937f3619e02f5e6dce55
SHA3 2884e62ddeabd3f544e511d2da671fb7d0cfaf95608aaa557bda6b378708ef9e

4

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x25a8
Entropy 3.02798
MD5 bde2fe303984725a0a6aff394a093769
SHA1 3070381c8ba71ad0994decddf0f02fd4d922d731
SHA256 da2bc2e9eb6654cae62fe7dbf996d7df42107ec6e985505c258a8afd7e7d8e62
SHA3 44b509bdcae4db6139153317b5d4dff0f74bb27d491bda836ae57fac9b096487

5

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x10a8
Entropy 3.25238
MD5 ce8b7542dcebf82eb91a6666d503d557
SHA1 81ee31aaab9199d2b0a9f9a2b8617887143ed6c5
SHA256 c90faa20544b25d3a03284084c0da6b05a1751f8c76823a7b8c6f20ebef4564d
SHA3 82552b15faa074a3e9e979beff7825edf22512e01a9716e1067008cc03f168dc

6

Type RT_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x468
Entropy 4.60151
MD5 c13e13e44c499a7506c0d7093b1a450b
SHA1 0c63c8fae58b73a329bd0fe4b83368d3d3ba657b
SHA256 65dcd0060206ad694ffcbcad81a84ff47171a43fa8041d88440a71648fcaa3a2
SHA3 218309e25c4c633d4772377e88f4d40a0d00f0feafd6a5febb618b6196863b6e

101

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x5a
Entropy 2.69653
Detected Filetype Icon file
MD5 ee39773e4f61f7a7ae151f53aa35f048
SHA1 efcdaa04adcdb24b41e9eafe70c6d8cb6cc8a005
SHA256 cfd47014b258a78cf61b05cf2b553c3bdb0ce4824b2c12184a03003219df9f01
SHA3 5fbcf732bc4155a83b5d4d280cddb6c67ae1b6d3fa2fd789688706654006e0e0

1 (#2)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x2fb
Entropy 5.08691
MD5 5752f1422717de9331d0495640e2697e
SHA1 5a110e7a77e7ea17b26dc6c1102067d4c87c9c27
SHA256 26d9b436f8f83f694d823aadbc15d7108ee5cbcb0dbdefd593b70d37b3301bcb
SHA3 07006c14c5a2cfc111f406013d3050cecf4532b19f5ef3c190d57c6db2ad207e

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2014-May-15 07:43:39
Version 0.0
SizeofData 94
AddressOfRawData 0x456a8
PointerToRawData 0x456a8
Referenced File d:\QQPCDownloader_proj\PackageTools\product\win32\dbginfo\kpacket.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x44d104
SEHandlerTable 0x448290
SEHandlerCount 174

Errors