ff03e53ccdf82e9310f15ec4796819e3

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages English - United States
Russian - Russia

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: .itext
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExA
  • GetProcAddress
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • FindWindowA
Code injection capabilities (process hollowing):
  • WriteProcessMemory
  • SetThreadContext
  • ResumeThread
Code injection capabilities (PowerLoader):
  • GetWindowLongW
  • GetWindowLongA
  • FindWindowA
Can access the registry:
  • RegQueryValueExA
  • RegOpenKeyExA
  • RegCloseKey
  • RegFlushKey
Possibly launches other programs:
  • CreateProcessA
Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • CallNextHookEx
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtectEx
  • VirtualAllocEx
Manipulates other processes:
  • WriteProcessMemory
  • ReadProcessMemory
Can take screenshots:
  • GetDCEx
  • GetDC
  • FindWindowA
  • CreateCompatibleDC
  • BitBlt
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2016-Oct-04 02:59:34
Suspicious The file contains overlay data. 585746 bytes of data starting at offset 0x62600.
The overlay data has an entropy of 7.99764 and is possibly compressed or encrypted.
Malicious VirusTotal score: 48/71 (Scanned on 2019-08-05 18:43:33) MicroWorld-eScan: Trojan.GenericKD.41521576
FireEye: Generic.mg.ff03e53ccdf82e93
CAT-QuickHeal: Trojan.Zebrocy
McAfee: RDN/Generic.grp
Cylance: Unsafe
Alibaba: Trojan:Win32/Zebrocy.4448f0ff
K7GW: Trojan ( 005546741 )
K7AntiVirus: Trojan ( 005546741 )
Invincea: heuristic
F-Prot: W32/DelfInject.A.gen!Eldorado
Symantec: Trojan.Gen.MBT
Avast: Win32:Trojan-gen
Kaspersky: Trojan.Win32.Zebrocy.p
BitDefender: Trojan.GenericKD.41521576
NANO-Antivirus: Trojan.Win32.Bifrose.iswp
Paloalto: generic.ml
AegisLab: Trojan.Win32.Zebrocy.4!c
Tencent: Win32.Trojan.Zebrocy.Edxb
Emsisoft: Trojan.GenericKD.41521576 (B)
F-Secure: Dropper.DR/Delphi.Gen
TrendMicro: TROJ_GEN.R002C0DGV19
McAfee-GW-Edition: BehavesLike.Win32.Pluto.dc
Trapmine: malicious.moderate.ml.score
Sophos: Mal/Behav-328
SentinelOne: DFI - Malicious PE
Cyren: W32/DelfInject.A.gen!Eldorado
Avira: DR/Delphi.Gen
Fortinet: W32/Injector.fam!tr
Antiy-AVL: Trojan/Win32.Zebrocy
Arcabit: Trojan.Generic.D27991A8
ZoneAlarm: Trojan.Win32.Zebrocy.p
Microsoft: VirTool:Win32/DelfInject.gen!BV
TACHYON: Trojan/W32.DP-Zebrocy.988690
VBA32: BScope.Trojan.Packed
ALYac: Trojan.GenericKD.41521576
MAX: malware (ai score=100)
Ad-Aware: Trojan.GenericKD.41521576
Malwarebytes: Trojan.Sednit
ESET-NOD32: Win32/Sednit.DH
TrendMicro-HouseCall: TROJ_GEN.R002C0DGV19
Ikarus: Trojan.Win32.Buzus
GData: Trojan.GenericKD.41521576
MaxSecure: Trojan.Malware.300983.susgen
AVG: Win32:Trojan-gen
Cybereason: malicious.95e152
Panda: Trj/GdSda.A
CrowdStrike: win/malicious_confidence_70% (W)
Qihoo-360: Win32/Trojan.cc1

Hashes

MD5 ff03e53ccdf82e9310f15ec4796819e3
SHA1 0ad2e1495e15246e87621bb90d6cc44355750c30
SHA256 89aca57aecfd4132fdcd5039f3a1b52d90f8bdccc3ec50a23fa2e20c335e7228
SHA3 fb7ba2d6fe8d356963a1ab4f0664c440d1faa5f52cef0e845f43de9ef0956b0a
SSDeep 24576:oe7dTWX3U6+rre7ZNgf+nV2KnJptNwYuRhhaFXl84e0w0:onrpSkV2K3wvRhUFX/D
Imports Hash d8ff26f7307cb1e9ff1594c3098ea5a3

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 9
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x54200
SizeOfInitializedData 0xe000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000556D8 (Section: .itext)
BaseOfCode 0x1000
BaseOfData 0x56000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x6c000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 bd25307bf5ab3c40cd50c5971e16260a
SHA1 7db2b13b4fe07f830acddc8355f0e5e3a8170fb1
SHA256 b9f4972399c33b038a4ee5d667ca107adaaa396222c595d0f1763bb2412e0d34
SHA3 5e27995f56dbf0c215bfbd5035ba54eb5ca1b4b657afc30aed62024bb7906b4c
VirtualSize 0x5395c
VirtualAddress 0x1000
SizeOfRawData 0x53a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.5498

.itext

MD5 97fcc0a553cc893ea0f857e6bf17d57e
SHA1 dca999d0275a76b30006bd67a3d7276ae0e7f2e6
SHA256 d18873232d6485306fffd1ed3a976e994a8c6f33dccc840888a15cbb82be4fbf
SHA3 18407a7b29943198c9666fa512394a19467be39b38fd0bd1423067ddb94f1a1b
VirtualSize 0x7d0
VirtualAddress 0x55000
SizeOfRawData 0x800
PointerToRawData 0x53e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.17998

.data

MD5 ee1e3c1ebad717339d6ed0bf58cd0cd6
SHA1 c8da5bb5049fa5c382a4eaf6d80544bddfbc9d3b
SHA256 fb78ca677f3e0c9eec0c8cf4438abcab7fca8ec92213858de9c7c7edced4852e
SHA3 04787378479a5a5554f33bd37d611b3b503079002e98fdab17cfac5b27270a05
VirtualSize 0x272c
VirtualAddress 0x56000
SizeOfRawData 0x2800
PointerToRawData 0x54600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.28

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x35a8
VirtualAddress 0x59000
SizeOfRawData 0
PointerToRawData 0x56e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 e7e6c58ae4d672af4579a507d54c07fa
SHA1 a0d2f7c444db54195b86bcc5a053dd5a2225c79b
SHA256 149056ffd403344a4dcc307060ad91bd80f09ba040eeda1519b2f380e6bb2c1f
SHA3 70e85f0e394e87818d670c699c22d108377793ac10d4d55ffc4002299b70f55c
VirtualSize 0x25d4
VirtualAddress 0x5d000
SizeOfRawData 0x2600
PointerToRawData 0x56e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.19587

.tls

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x34
VirtualAddress 0x60000
SizeOfRawData 0
PointerToRawData 0x59400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata

MD5 8ea198a23b777bb3a420980f4fe35994
SHA1 e95451470247b8b0b647ac39c968fbc173c39dea
SHA256 fad2f0e9eae9423da57c5e5057b1c95ef5941307cf238bf3a273c43e116204ce
SHA3 5fbcceb6de619a11bf1be3f1a556b389dddd86a2909e4d1053dada0dcbfa5f0c
VirtualSize 0x18
VirtualAddress 0x61000
SizeOfRawData 0x200
PointerToRawData 0x59400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.170146

.reloc

MD5 963d51170901758793248deac5b3b296
SHA1 098d1abd8b9a2c5af4a97ce0d6ec251f5562c1b6
SHA256 cb082762b67eb74776eaf089007e9c47467eb8e669e247e935c436fea70d91e8
SHA3 253dbd0402ab9382cb5fe83b7cbd6e45668ca4981e1525339f3e00dae7ad508d
VirtualSize 0x5838
VirtualAddress 0x62000
SizeOfRawData 0x5a00
PointerToRawData 0x59600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.65393

.rsrc

MD5 d16feecc3fc7a50fab22b904145b638b
SHA1 a79f6e75b504d655c47920bf8763da072435b1fb
SHA256 86de56417cccf9dbf7ab4c277f01138e01f4f8a02b66f5f41ca0295e94a7f84c
SHA3 2db33370661b9e0d14d5caa05ba1a44bc6c032e6d80a945b728cef57fc07c041
VirtualSize 0x3600
VirtualAddress 0x68000
SizeOfRawData 0x3600
PointerToRawData 0x5f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.91172

Imports

oleaut32.dll SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32.dll RegQueryValueExA
RegOpenKeyExA
RegCloseKey
user32.dll GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
kernel32.dll GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
kernel32.dll (#2) GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll (#2) GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
gdi32.dll UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
BitBlt
version.dll VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
kernel32.dll (#3) GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32.dll (#2) RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll (#4) GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
oleaut32.dll (#2) SysFreeString
SysReAllocStringLen
SysAllocStringLen
comctl32.dll _TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

Delayed Imports

1

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.6633
MD5 ff4e5862f26ea666373e5fab2bddfb11
SHA1 cfa13c0ab30f1bbd566900dee3631902f9b6451c
SHA256 b8e6fc93d423931acbddae3c27dd3c4eb2a394005d746951a971cb700e0ee510
SHA3 91dae12a9f43c5443e0661091a336f882fa1482f75fa9a57c9298d1d70c8ae69

2

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.80231
MD5 2e87b3c111e3073a841775c1f8ec5a90
SHA1 20292304fa2ef1bfdc4a1000e90a1c16d4765a96
SHA256 ce19ace18e87b572e6912306776226af5b8e63959c61cde70a8ff05b3bbdcc41
SHA3 9527f09e739c2064835800a7e5c317cb422bdd7237f00fca079a1c62f58a2612

3

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.00046
MD5 a04c3c368cb37c07bd5f63e7e6841ebd
SHA1 699300bceaa1256818c43fecfc8cad93a59156b2
SHA256 ee1c9c194199c320c893b367602ccc7ee7270bd4395d029f727e097634f47f8c
SHA3 58722e3138aad1382e284c1605ecd665ced536de4906749ac8d6e11252cc9558

4

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.56318
MD5 9929115b21c2c59348058d4190392e75
SHA1 626fba1825d572ea441d36363307c9935de3c565
SHA256 9d9edf87ca203ecc60b246cc783d54218dd0ce77d3a025d0bafc580995a4abd8
SHA3 fea156e872544252c625076a6bf3baa733ee5b3d5399716e156734af7a841369

5

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.6949
MD5 f321ad13d1c3f35a05d67773b4bc27d6
SHA1 30aded8525417e2531d5eb88bf2f868172945baa
SHA256 99676c52310db365580965ea646ece86c62951bfd97ec0aae9f738a202a90593
SHA3 04c839da98a8c50a36697076af5bc6d527560a69153b2f718f065908fd4fe3ad

6

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.62527
MD5 5ca217e52bdc6f23b43c7b6a23171e6e
SHA1 d99dc22ec1b655a42c475431cc3259742d0957a4
SHA256 11726dcf1eebe23a1df5eb0ee2af39196b702eddd69083d646e4475335130b28
SHA3 b358d8a5b0f400dd2671956ec45486ae1035556837b5289df5f418fe69348b3f

7

Type RT_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x134
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.91604
MD5 6be7031995bb891cb8a787b9052f6069
SHA1 487eb59fd083cf4df02ce59d9b079755077ba1b5
SHA256 6f938aab0a03120de4ef8b27aff6ba5146226c92a056a6f04e5ec8d513ce5f9d
SHA3 0f1c6c0378a3646c9fbf3678bbeeccf929d32192f02d1ea9d6ba0be5c769e6ab

1 (#2)

Type RT_ICON
Language Russian - Russia
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.85232
MD5 8738b36430a86192c6c538a84908b4dc
SHA1 d6fc4edac0bdb9cf081ad178589b59506906516f
SHA256 b4a3b4a9e090438c0822540d2807121a7e5734515d6cd1123b3a5df836ea7029
SHA3 fc72bd50b22d47998d3718e4de691971447984af8f6e0fbdeb6836def494449d

4084

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x108
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.95096
MD5 a203faa90a4e6e98883a7aede88637fb
SHA1 6d322f97665c5242f34451050ae2244959e01b61
SHA256 1a3b2845e0e4216aedcb75ffc2bbf7fe2a0ea3668a33ecf9bf99aca8aba8da63
SHA3 67f2f120f082b3127ecbeaa1f07308c6fbd609ba72df4fdeba56d7c9735c20e0

4085

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x2c4
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.36695
MD5 8d3e5fc0c6dfa451e98c1beded90f0a4
SHA1 0c83389283a72e05bd2bce00f3c84ef2b1e3c4be
SHA256 979371fd4574a7bf1ed234fb2480b9866d1fd90a58490697ad2e6792f644c8a5
SHA3 c885dd4eabdef6d8a097f391186a62bacbcefc9699b546f9dd039d5cb66b5bda

4086

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xc8
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.46036
MD5 2e43be7336cf21c48536610f6c33bed9
SHA1 5ec4fca0e2e09ed8c852f76d674673d00fc61b87
SHA256 d6829857dc01d1ee8953dc7839e86f729a29e609f1b394720d82e82540de82db
SHA3 61772bfc198a19b49c182e66bd7b161901127beb2a8751cd306b54b1036b1297

4087

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x270
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.37285
MD5 8dac24e1bd5d7a6252d5a2c884a04f12
SHA1 aa64f63fbbe4006b8b6028986e07dc28a9343b53
SHA256 73f6f47f4b9a59d3e0b480407cf10a3314a9dc89fc5c2f608f511e3266de9d91
SHA3 6f4173433b7c4ceae92952f9ae5c5be5ff8d875c929b3f40bf5a8af177754073

4088

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3ec
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.29525
MD5 56ac81df2b75a2dde767fc00eb15d7d4
SHA1 39a73a459864e209588d09a516e33e5c4d22fd28
SHA256 79ee62b748adb861928cc17bbc9adbe40457c0c65283c7c0ae09c335bd68c210
SHA3 6dc61f62e01ddd6ac4d4335e25efbb8809e6d659ad0035639286ec3ab3a30fc6

4089

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x340
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.24312
MD5 52f7d6c47b8e879dd877671da562bda8
SHA1 f8929d7c12968d39e9bd2caf96c2211900adec15
SHA256 b639c88322aa414766037d5d47b3dab9e573d54baf636f21a992195a73a30a9c
SHA3 bf0d246acbc281541216907994eb062f977a639a88be0558a89c104a2490e112

4090

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3cc
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.30897
MD5 2ff6bcc921d0cab45268750d108e69a7
SHA1 29f52de905f9d5e8a20dfca4fc0e9c1dd3529529
SHA256 087600d3c31fce113162d59f3d624b445147a2673643f7c49f98d3872bad8ef2
SHA3 c5ef146e0384144ce42fb9540fc76efe2c3829e3467465f5e387a9c1f79bbcf1

4091

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x214
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.36965
MD5 f47bffa834e57da05fb11629df61304f
SHA1 081551ac187c830537ec96cd3d59ca1c9bb919ab
SHA256 4d674818463c06668afec8d5f0a8a6030d1c305c9c67d92d7d9944049879a373
SHA3 75a40f5f677126c9d820a9b14b17bae3debd820e85052c84ea6659c4c35db812

4092

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0xcc
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.33625
MD5 cc22f1ac30dcdeae9cd72ed8abbb02cc
SHA1 9ed70b6c75879d40481e525a275d4b99d75abc56
SHA256 93aef43aba52d60e77b3bbd23dda80f9fe6e1be314a87b02feca051426a10ba7
SHA3 8a7657f317d99f5180257945fed83bf07fa87ee81355373bedd142df395b9a6e

4093

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x194
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.40367
MD5 9ce62fb7054fbf904693dcb512ce2774
SHA1 fee9df4d7a19a4cfdff18952ab1e09bfc4c5117e
SHA256 b29ed2e2012cfb9d05450a66efdde177aa99c3b1285123b59dc968e61cc62d5b
SHA3 7c0dc1f311399709a21f9a77c62012bcb5b01964285dfb4b39afdfad80e858ad

4094

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x3c4
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.27129
MD5 f7e7144c4fdf02bd6e4215699f257c5e
SHA1 57899d0450e159decb918dd60256dc0cc50ada4e
SHA256 7740574ac0c927564e0349f625185a83541479859cd49c2601ecd67cfc0dad36
SHA3 cde60323c2d249b0e497f83e8d0fc7799a89408b89d42fe9d5ef8f1ebb27fddb

4095

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x338
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.35594
MD5 bc06ca47ee6f8d20c4389834f53a44f4
SHA1 102cf0807762abbf7250c533692c282d045a5239
SHA256 e78299e236878f8931b75a5cb1ef7a566f6d2e204d6a3ab5a40d01df44709545
SHA3 c9ace61db2f1daf8a5203b1d42290d62e58289f030e2946a1e32b002ccdf530c

4096

Type RT_STRING
Language UNKNOWN
Codepage UNKNOWN
Size 0x294
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 3.29371
MD5 0a399d0f0d06f3807ce2b2bb95a277c8
SHA1 5142268d23a5b4e39d181255166bb1ef41141548
SHA256 b48888f35b371cfb0451cb3a85d8eaafdd440c96c3631acd94b1855c34a25b64
SHA3 3867a5cc562325ef1216b90bf3f340d06f0ef28dcbd9d3191ea47617856abe85

DVCLAL

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x10
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 4
MD5 d8090aba7197fbf9c7e2631c750965a8
SHA1 04f73efb0801b18f6984b14cd057fb56519cd31b
SHA256 88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610
SHA3 a5a67ad8166061d38fc75cfb2c227911de631166c6531a6664cd49cfb207e8bb

PACKAGEINFO

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x20c
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 5.22538
MD5 ee9ee2c0406fe5d1e837d7e23be4cec1
SHA1 9da0cda533f0289a731e813d3f83f21fe69d7526
SHA256 f6ba68bf87d9f1b5032b025cdc047c3f130030c48741dad157b387410b79b4a2
SHA3 888a26b2fc87a734a2b65e856faee6348c5e3facb603da77e3719a2061f31432

32761

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 1.83876
Detected Filetype Cursor file
MD5 a2baa01ccdea3190e4998a54dbc202a4
SHA1 e8217df98038141ab4e449cb979b1c3bbea12da3
SHA256 c53efa8085835ba129c1909beaff8a67b45f50837707f22dfff0f24d8cd26710
SHA3 8874564c406835306368adf5e869422e1bb97109b97c1499caa8af219990e8dc
Preview

32762

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 1.91924
Detected Filetype Cursor file
MD5 aff0f5e372bd49ceb9f615b9a04c97df
SHA1 e3205724d7ee695f027ab5ea8d8e1a453aaad0dd
SHA256 b07e022f8ef0a8e5fd3f56986b2e5bf06df07054e9ea9177996b0a6c27d74d7c
SHA3 9cb042121a5269b80d18c3c5a94c0e453890686aedade960097752377dfa9712
Preview

32763

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.01924
Detected Filetype Cursor file
MD5 48e064acaba0088aa097b52394887587
SHA1 310b283d52aa218e77c0c08db694c970378b481d
SHA256 43f40dd5140804309a4c901ec3c85b54481316e67a6fe18beb9d5c0ce3a42c3a
SHA3 38753084b0ada40269914e80dbacf7656dc94764048bd5dff649b08b700f3ed5
Preview

32764

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.01924
Detected Filetype Cursor file
MD5 1ae28d964ba1a2b1b73cd813a32d4b40
SHA1 8883cd93b8ef7c15928177de37711f95f9e4cd22
SHA256 ff47a48c11c234903a7d625cb8b62101909f735ad84266c98dd4834549452c39
SHA3 a85dadd416ce2d22aa291c0794c45766a0613b853c6e3b884a2b05fc791427b8
Preview

32765

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.01924
Detected Filetype Cursor file
MD5 0893f6ba80d82936ebe7a8216546cd9a
SHA1 0754cbdf56c53de9ed7fbd47859d20b788c6f056
SHA256 a0adcedb82b57089f64e2857f97cefd6cf25f4d27eefc6648bda83fd5fef66bb
SHA3 ce6148ade08ef9b829f83cb13b4c650d9d4a7012bfd1ab697a7870a05f4104f8
Preview

32766

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.01924
Detected Filetype Cursor file
MD5 dcaa3c032fe97281b125d0d8f677c219
SHA1 58fe36409f932549e2f101515abee7a40cf47b2c
SHA256 6e1e7738a1b6373d8829f817915822ef415a1727bb5bb7cfe809e31b3c143ac5
SHA3 02ef292e1b4a70e439e362af6b4fa213e3816ade45222b78dabab712b6afba54
Preview

32767

Type RT_GROUP_CURSOR
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.01924
Detected Filetype Cursor file
MD5 a95c7c78d0a0b30b87e3c4976e473508
SHA1 b19f3999f1b302a2d28977cb18a3416c918d486c
SHA256 326c048595bbc72e3f989cb3b95fbf09dc83739ced3cb13eb6f03336f95d74f1
SHA3 8157b4e6afa7ed2e2ffc174d655bec9fb81db609e4c5864faa5ead931ff60689
Preview

MAINICON

Type RT_GROUP_ICON
Language Russian - Russia
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2016-Oct-04 02:59:34
Entropy 2.06096
Detected Filetype Icon file
MD5 59517c0a5976f364558b42dbb1cabbc8
SHA1 cf9a68a0b175f131381d3d29245441a6f9d53e3d
SHA256 ff04c16f07007618c7723eb538f879f89e297950bfa77ed55d1a19776f312a37
SHA3 5b15005fa45f38fa9716594a7860ddc29a2ef7e6921e99c6e8f3ac5bef203fd6

String Table contents

No help found for %s
No context-sensitive help installed
No help found for context
No topic-based help system installed
Up
Right
Down
Ins
Del
Shift+
Ctrl+
Alt+
Clipboard does not support Icons
Menu '%s' is already being used by another form
Docked control must have a name
Error removing control from dock tree
- Dock zone not found
- Dock zone has no control
Error loading dock zone from the stream. Expecting version %d, but found %d.
Unable to find a Table of Contents
&Abort
&Retry
&Ignore
&All
N&o to All
Yes to &All
BkSp
Tab
Esc
Enter
Space
PgUp
PgDn
End
Home
Left
Menu inserted twice
Sub-menu is not in menu
Not enough timers available
GroupIndex cannot be less than a previous menu item's GroupIndex
Cannot create form. No MDI forms are currently active
A control cannot have itself as its parent
Cannot drag a form
Warning
Error
Information
Confirm
&Yes
&No
OK
Cancel
&Help
Unsupported clipboard format
Out of system resources
Canvas does not allow drawing
Invalid image size
Invalid ImageList
Invalid ImageList Index
Failed to read ImageList data from stream
Failed to write ImageList data to stream
Error creating window device context
Error creating window class
Cannot focus a disabled or invisible window
Control '%s' has no parent window
Cannot hide an MDI Child Form
Cannot change Visible in OnShow or OnHide
Cannot make a visible window modal
Menu index out of range
Error reading %s%s%s: %s
Stream read error
Property is read-only
Failed to get data for '%s'
Resource %s not found
%s.Seek not implemented
Operation not allowed on sorted list
%s not in a class registration group
Property %s does not exist
Stream write error
Invalid buffer size for decryption
Stream read error
Stream write error
Bitmap image is not valid
Icon image is not valid
Cannot change the size of an icon
Class %s not found
A class named %s already exists
List does not allow duplicates ($0%x)
A component named %s already exists
String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format
''%s'' is not a valid component name
Invalid property path
Invalid property value
Invalid data type for '%s'
List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)
Out of memory while expanding memory stream
Wed
Thu
Fri
Sat
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range
Can't write to a read-only resource stream
CheckSynchronize called from thread $%x, which is NOT the main thread
Dec
January
February
March
April
May
June
July
August
September
October
November
December
Sun
Mon
Tue
%s (%s, line %d)
Abstract Error
Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
%s
A call to an OS function failed
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation
Invalid variant operation (%s%.8x)
%s
Could not convert variant of type (%s) into type (%s)
Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
Floating point underflow
Invalid pointer operation
Invalid class typecast
Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction
Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'
Variant method calls not supported
Read
Write
Error creating variant or safe array
'%s' is not a valid integer value
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow
Invalid floating point operation
Floating point division by zero
Floating point overflow

Version Info

TLS Callbacks

StartAddressOfRawData 0x460000
EndAddressOfRawData 0x460034
AddressOfIndex 0x45678c
AddressOfCallbacks 0x461010
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0! [*] Warning: Section .tls has a size of 0!