f6e83f24a180b7dedc07a57b73391d780963d6833e34b72c6ec8c7afa621e34c

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jun-29 13:47:47
Detected languages English - United States
Comments Comfort Products v9.6.2.0 [HookDLL] - H Hayat
CompanyName Microsoft Corporation
FileDescription Version Checking and File Installation Libraries
FileVersion 1.0.0.0
InternalName version
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename VERSION.DLL
ProductName Microsoft® Windows® Operating System
ProductVersion 1.0.0.0

Plugin Output

Suspicious PEiD Signature: UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser
Suspicious The PE is packed with UPX Unusual section name found: UPX0
Section UPX0 is both writable and executable.
Unusual section name found: UPX1
Section UPX1 is both writable and executable.
The PE only has 6 import(s).
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Malicious VirusTotal score: 8/70 (Scanned on 2026-08-13 16:02:44) Bkav: W32.Malware.12D8D4E5
CrowdStrike: win/malicious_confidence_100% (W)
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
SentinelOne: Static AI - Suspicious PE
Skyhigh: BehavesLike.Win32.Fake.kc
TrendMicro-HouseCall: Trojan.Win32.Gen.TL0101G526ZX

Hashes

MD5 eef5890a86bb76014782cdd8d94ebc62 🔍
SHA1 fdf13b3e914619760578bfb30124bc09048339c5 🔍
SHA256 f6e83f24a180b7dedc07a57b73391d780963d6833e34b72c6ec8c7afa621e34c 🔍
SHA3 ee4dba77840b654e62ebed1a12558f934f270a2147a7063ebcb490b0caa193f0 🔍
SSDeep 1536:bfqCwErOVeWtg0IZuGs6xajgvZc4AgN9r5zpj1c/cmckVPxIiTCayP9rG8B:bfOVeWnIJs6vhggDNVC/7ckVPxIiTCa 🔍
Imports Hash d0f61150fa7ec1e33bf3903b0d1ca8cf 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2026-Jun-29 13:47:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0xf000
SizeOfInitializedData 0x1000
SizeOfUninitializedData 0x7000
AddressOfEntryPoint 0x00016190 (Section: UPX1)
BaseOfCode 0x8000
BaseOfData 0x17000
ImageBase 0x10000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x18000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

UPX0

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x7000
VirtualAddress 0x1000
SizeOfRawData 0
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1

MD5 7a03d562c2a84a8a5d50fc8c65712bb6 🔍
SHA1 d1c778e0bdb23f41141b8b85fafa9b7be3377378 🔍
SHA256 9de54c6d6b68c19b8baaac7b29efe8865e416749c1cad10eb6094c638bb78a72 🔍
SHA3 d4d71d22fbb7fbeccfb6a08cc6b0d00f60370e4b48309fb7f673ba4f16f1f5e4 🔍
VirtualSize 0xf000
VirtualAddress 0x8000
SizeOfRawData 0xe600
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.86899

.rsrc

MD5 fee8153edf513458a57d42eba25f60c9 🔍
SHA1 18bc390d677a3e57287102e0b5a19a905eb7a322 🔍
SHA256 a17bd57932b3d7500eb2f794bd3a2bce508912294ec0213f1ada87394b63c64e 🔍
SHA3 b103361680a47381870b941968309be6848331c16438152e79d57c966e47bae0 🔍
VirtualSize 0x1000
VirtualAddress 0x17000
SizeOfRawData 0xe00
PointerToRawData 0xe800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.57165

Imports

api-ms-win-crt-runtime-l1-1-0.dll _cexit
KERNEL32.DLL LoadLibraryA
GetProcAddress
VirtualProtect
SHLWAPI.dll StrStrIW
VCRUNTIME140.dll memset

Delayed Imports

GetFileVersionInfoA

Ordinal 1
Address 0x1795f
ForwardName C:\Windows\System32\version.GetFileVersionInfoA

GetFileVersionInfoByHandle

Ordinal 2
Address 0x1798f
ForwardName C:\Windows\System32\version.GetFileVersionInfoByHandle

GetFileVersionInfoExA

Ordinal 3
Address 0x179c6
ForwardName C:\Windows\System32\version.GetFileVersionInfoExA

GetFileVersionInfoExW

Ordinal 4
Address 0x179f8
ForwardName C:\Windows\System32\version.GetFileVersionInfoExW

GetFileVersionInfoSizeA

Ordinal 5
Address 0x17a2a
ForwardName C:\Windows\System32\version.GetFileVersionInfoSizeA

GetFileVersionInfoSizeExA

Ordinal 6
Address 0x17a5e
ForwardName C:\Windows\System32\version.GetFileVersionInfoSizeExA

GetFileVersionInfoSizeExW

Ordinal 7
Address 0x17a94
ForwardName C:\Windows\System32\version.GetFileVersionInfoSizeExW

GetFileVersionInfoSizeW

Ordinal 8
Address 0x17aca
ForwardName C:\Windows\System32\version.GetFileVersionInfoSizeW

GetFileVersionInfoW

Ordinal 9
Address 0x17afe
ForwardName C:\Windows\System32\version.GetFileVersionInfoW

VerFindFileA

Ordinal 10
Address 0x17b2e
ForwardName C:\Windows\System32\version.VerFindFileA

VerFindFileW

Ordinal 11
Address 0x17b57
ForwardName C:\Windows\System32\version.VerFindFileW

VerInstallFileA

Ordinal 12
Address 0x17b80
ForwardName C:\Windows\System32\version.VerInstallFileA

VerInstallFileW

Ordinal 13
Address 0x17bac
ForwardName C:\Windows\System32\version.VerInstallFileW

VerLanguageNameA

Ordinal 14
Address 0x17bd8
ForwardName C:\Windows\System32\version.VerLanguageNameA

VerLanguageNameW

Ordinal 15
Address 0x17c05
ForwardName C:\Windows\System32\version.VerLanguageNameW

VerQueryValueA

Ordinal 16
Address 0x17c32
ForwardName C:\Windows\System32\version.VerQueryValueA

VerQueryValueW

Ordinal 17
Address 0x17c5d
ForwardName C:\Windows\System32\version.VerQueryValueW

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x3e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.41795
MD5 1660d82078312923d53de1b45565d6e1 🔍
SHA1 edd4bfa0c780874997e9704c3d45e13fd75bde9c 🔍
SHA256 c18fc0dfd8fd505cb17c5b72c84ee18e2f31e7b2a289ef89aa0ff81da3148c82 🔍
SHA3 c8d22cc9d67bfecfc8c8fe79960648f35634bea5f4137feaae852ee971e84189 🔍

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
Comments Comfort Products v9.6.2.0 [HookDLL] - H Hayat
CompanyName Microsoft Corporation
FileDescription Version Checking and File Installation Libraries
FileVersion (#2) 1.0.0.0
InternalName version
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename VERSION.DLL
ProductName Microsoft® Windows® Operating System
ProductVersion (#2) 1.0.0.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0xbc
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x10004004
SEHandlerTable 0x10012790
SEHandlerCount 1

RICH Header

Errors

[*] Warning: Section UPX0 has a size of 0!
Leave a comment

No comments yet.