fb822a3fe0c3f2c1b86802eea32a14e6fa8a25c4e00ceb489c7355f47004c4a0

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages English - United States
Comments This installation was built with Inno Setup: http://www.innosetup.com
CompanyName RndLabs, Inc.
FileDescription BaboViolent 2 Setup
FileVersion
LegalCopyright

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Looks for Qemu presence:
  • QemU
 Contains domain names:
  • http://www.innosetup.com
  • innosetup.com
  • www.innosetup.com
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
 Possibly launches other programs:
  • CreateProcessA
 Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 11716347 bytes of data starting at offset 0xcc00.
The overlay data has an entropy of 7.99998 and is possibly compressed or encrypted.
Overlay data amounts for 99.5562% of the executable.
Safe VirusTotal score: 0/69 (Scanned on 2023-03-22 14:11:12) All the AVs think this file is safe.

Hashes

MD5 63e8a58f6c7d910fbda8d53e91a49d75 🔍
SHA1 3aa7745de7a37a7ff5e10efd3e1961321c155cf9 🔍
SHA256 fb822a3fe0c3f2c1b86802eea32a14e6fa8a25c4e00ceb489c7355f47004c4a0 🔍
SHA3 72019316c2224533b5223a4a7aef64ba993c7e1a0547c9f1a41387cc249fc8f4 🔍
SSDeep 196608:zOgRtYiWZ+4TVYP1CZ0Y4+0mm0y1Q/NCAetIXoNur7twlFhVs3b1EKlND:zOgRtC+kVi13T+TK1Q/MAetIXoNOi/uB 🔍
Imports Hash 4fb639b17a439bf0efa713bd4c6e715b 🔍

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x9000
SizeOfInitializedData 0x3800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000098BC (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0xa000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 1.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x13000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 61e836cac9c673512632038dd84ce39d 🔍
SHA1 6eddef5fd230aab076a2fe4f265e8a9f7facccd8 🔍
SHA256 6c7b76ad8d85e432ecbcc28038ddc9eab6a11b6e7adce00185cfba5f5ad52a7b 🔍
SHA3 c20742e53e1b08be487224a3bd26bf763d598fc428ea214b0d6dbb3e55b74dde 🔍
VirtualSize 0x8fe0
VirtualAddress 0x1000
SizeOfRawData 0x9000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.5908

DATA

MD5 1605dbc615f9347957e3d584e5f6343d 🔍
SHA1 a8d55b6b7fbd0c51600e9a9cfba4ce6e0936132a 🔍
SHA256 5b4509aa315345eaeb3df66237b4008991a0677a6b082b7dae8c1dd99331a25d 🔍
SHA3 4fbcf0c9536c136fd60b72b872f802db3ad4486328883b09086b7f39a945480f 🔍
VirtualSize 0x248
VirtualAddress 0xa000
SizeOfRawData 0x400
PointerToRawData 0x9400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.70123

BSS

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xe34
VirtualAddress 0xb000
SizeOfRawData 0
PointerToRawData 0x9800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 bd5bdc394dd9459844ea032b48349bc1 🔍
SHA1 e49e2b7cb13448780832c319b573685a5082edd7 🔍
SHA256 d3eadc1d34bdaa27cf7a8a16117a1452ee66fcc776911d4f71573c6f8572c201 🔍
SHA3 a0899dbb57f244ff0ea00374e29bb07f25beb7aa344376afc0c831507a658826 🔍
VirtualSize 0x950
VirtualAddress 0xc000
SizeOfRawData 0xa00
PointerToRawData 0x9800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.43127

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8
VirtualAddress 0xd000
SizeOfRawData 0
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 d293bf8d4ebe9826d58e1d27c25fe4b6 🔍
SHA1 217e47adc0fbd0a02677f10d9af22bb5dc7739cf 🔍
SHA256 21f8f01e5b5279258979c876c1e7cca51f210129487606de839cb49b9c660e3c 🔍
SHA3 9b3bcd863ad22ba575bcfab6605df9ec60d34b6cb5efbf0ea614b0ae63541d86 🔍
VirtualSize 0x18
VirtualAddress 0xe000
SizeOfRawData 0x200
PointerToRawData 0xa200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 0.199108

.reloc

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x8a8
VirtualAddress 0xf000
SizeOfRawData 0
PointerToRawData 0xa400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED

.rsrc

MD5 ddf17d0da1d179a6a0ff6f5c77a6b6dd 🔍
SHA1 a0781ee18d7259f49cdb7c6f9c366a202a5326e6 🔍
SHA256 095e6df945a2159d47171033bc27eed0fcf1d3362f19b2e4e89360e7b6366d8b 🔍
SHA3 9f2be80a7176d7be8072977bae496e5aa623e584d0482d5a30bee8de359fca16 🔍
VirtualSize 0x2800
VirtualAddress 0x10000
SizeOfRawData 0x2800
PointerToRawData 0xa400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
Entropy 3.83141

Imports

kernel32.dll DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
WideCharToMultiByte
TlsSetValue
TlsGetValue
MultiByteToWideChar
GetModuleHandleA
GetLastError
GetCommandLineA
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetSystemTime
GetFileType
ExitProcess
CreateFileA
CloseHandle
user32.dll MessageBoxA
oleaut32.dll VariantChangeTypeEx
VariantCopyInd
VariantClear
SysStringLen
SysAllocStringLen
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
kernel32.dll (#2) DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
WideCharToMultiByte
TlsSetValue
TlsGetValue
MultiByteToWideChar
GetModuleHandleA
GetLastError
GetCommandLineA
WriteFile
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetSystemTime
GetFileType
ExitProcess
CreateFileA
CloseHandle
user32.dll (#2) MessageBoxA
comctl32.dll InitCommonControls
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.44783
MD5 a30bdc8fc895071918577e4ca8f1b70e 🔍
SHA1 41ae86ce129d01431bdb3a9d59226d94bce41e4b 🔍
SHA256 8043d0af0a9ff06ae30ba6948c8204b13aca3c0b6b2961a7db3cfedd6574b893 🔍
SHA3 9f8ac4629fa9faf2326ee11c6fbc1a36059541d2f20788a9433ac7fb5356079e 🔍

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.04674
MD5 fc05474083da55a0fd6d8410f88fe85b 🔍
SHA1 ee53af56440f5d7e7093bc4f1fc8545df1bce7a4 🔍
SHA256 afc42142df5a49198727823531a83abd7c67635bcb707d379de3fdb51a335417 🔍
SHA3 7b92265c2517874875fe1cbfd4338d9f1a7c199de9d0fcee8498cf6b16542a2d 🔍

4089

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2f2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.21823
MD5 bbf4b644f9dd284b35eb31573d0df2f7 🔍
SHA1 4f9885ae629e83464e313af5254ef86f01accd0b 🔍
SHA256 2c0d32398e3c95657a577c044cc32fe24fa058d0c32e13099b26fd678de8354f 🔍
SHA3 ebed2e4a929600c1460761d462143feb092840986b31c9748d3aeb8174d4205e 🔍

4090

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x30c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.31515
MD5 ac2a0551cb90f91d779ee8622682dfb1 🔍
SHA1 ff0db7d2f48d85ceb3539b21ebe9d0ca3443f1da 🔍
SHA256 840989e0a92f2746ae60b8e3efc1a39bcca17e82df3634c1643d76141fc75bb3 🔍
SHA3 58a85f5c53df73aa79e5f5a36aa151ca0d9da4d450ebc2975a3ee827b46342a5 🔍

4091

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2ce
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25024
MD5 c99b474c52df3049dfb38b5308f2827d 🔍
SHA1 7375e693629ce6bbd1a0419621d094bcd2c67bb7 🔍
SHA256 26bda4da3649a575157a6466468a0a86944756643855954120fd715f3c9c7f78 🔍
SHA3 c6013febd14dd876e3b81111ec17dd2724dbf4147b0ad7be9d03259bcb59fef3 🔍

4093

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.86149
MD5 aec4e28ea9db1361160cde225d158108 🔍
SHA1 249013a10cde021c713ba2dc8912f9e05be35735 🔍
SHA256 d786490af7fe66042fb4a7d52023f5a1442f9b5e65d067b9093d1a128a6af34c 🔍
SHA3 a067c4d88d719ed8d568951acb776bd798b691a8b153f8d94ba0574ede1fbf4c 🔍

4094

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.20731
MD5 c76a8843204c0572bca24ada35abe8c7 🔍
SHA1 066052030d0a32310da8cb5a51d0590960a65f32 🔍
SHA256 00a0794f0a493c167f64ed8b119d49bdc59f76bb35e5c295dc047095958ee2fd 🔍
SHA3 07523cf88b3803ea41acfeb3c9c0c4b5b4b9fb6f9a3232802491d8de1b6c9166 🔍

4095

Type RT_STRING
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04592
MD5 4bd4f3f6d918ba49d8800ad83d277a86 🔍
SHA1 1f5e4c73965fea1d1f729efbe7568dcd081a2168 🔍
SHA256 34973a8a33b90ec734bd328198311f579666d5aeb04c94f469ebb822689de3c3 🔍
SHA3 2d01c56a5bf0b390addf4fb5b6ae02f9a64bd03ffd300d3763615bbb8ec911fe 🔍

11111

Type RT_RCDATA
Language UNKNOWN
Codepage Latin 1 / Western European
Size 0x2c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.50366
MD5 773106b1e6bda53f5d975d80a3cdd397 🔍
SHA1 dd51ad2ee86576884c87773127b0b4dfe4c4843e 🔍
SHA256 4d9459a2ab3ae16b32f4303bd2d8c5a1497f4cb44e3a2c15da16786a0a622531 🔍
SHA3 68ac4ebe9b95710267fda642506feb04e263f2ff0eaba6cfadc3fc6f88e9ce29 🔍

MAINICON

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.94059
Detected Filetype Icon file
MD5 644fbabc6eab8939ca07b65904243a4b 🔍
SHA1 1502c84950d9690db5eec6da3ba7a1bc34a0f8ba 🔍
SHA256 3114a28528631a61497eee68a591c0b74a9de6eb15df219696efcaf98226bda7 🔍
SHA3 ba3f30a436c62d4badae32f3115c63e5c292b29f4c5d4e3324cc989cfa58870a 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x3fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.75095
MD5 cdf5803854b527231669cc536985ed60 🔍
SHA1 4eb21aa6a0d16fda2f82556ec7ce438473f238b2 🔍
SHA256 be4b627a3868aef4c206eade9790e240cd204fb318b6315500bbccabf4b56a73 🔍
SHA3 ca479e81b623611e973fc0ea21c5e9d66f3edb5b4bf71870748a0887ea1c68bf 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x289
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.86458
MD5 c047a23817cac3cf4b6ade2cce0f2452 🔍
SHA1 901d01bf4040d01986ed704587cb1c989d7f3b93 🔍
SHA256 6cc41297efef410e2c23b74b2333cafa10b1e93e7dbcf4c683f37ad49ac1e92a 🔍
SHA3 cb2d67d5ef885493afacc32414adf6365f77c70c9f6d130722f91ce208142528 🔍

String Table contents

'%s' is not a valid integer value
'%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time
'%s' is not a valid date and time
Invalid argument to time encode
Invalid argument to date encode
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow
Invalid floating point operation
Floating point division by zero
Floating point overflow
Floating point underflow
Invalid pointer operation
Invalid class typecast
Access violation at address %p. %s of address %p
Stack overflow
Control-C hit
Privileged instruction
Operation aborted
Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'
Invalid variant type conversion
Invalid variant operation
Variant method calls not supported
Read
Write
Format result longer than 4096 characters
Format string too long
Error creating variant array
Variant is not an array
Variant array index out of bounds
External exception %x
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
January
February
March
April
May
June
July
August
September
October
November
December
Sun
Mon
Tue
Wed
Thu
Fri
Sat
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments This installation was built with Inno Setup: http://www.innosetup.com
CompanyName RndLabs, Inc.
FileDescription BaboViolent 2 Setup
FileVersion (#2)
LegalCopyright
Resource LangID English - United States

TLS Callbacks

StartAddressOfRawData 0x40d000
EndAddressOfRawData 0x40d008
AddressOfIndex 0x40b3d0
AddressOfCallbacks 0x40e010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: directory 5 has a size of 0! This PE may have been manually crafted! [*] Warning: Section BSS has a size of 0! [*] Warning: Section .tls has a size of 0! [*] Warning: Section .reloc has a size of 0!
Leave a comment

No comments yet.