Manalyzer :: abc6379205de2618851c4fcbf72112eb

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2005-Jun-28 10:18:57

Plugin Output

Suspicious	The PE is possibly packed.	`Section .text is both writable and executable.` `The PE only has 7 import(s).`
Info	The PE contains common functions which appear in legitimate applications.	`Possibly launches other programs: CreateProcessA`
Suspicious	VirusTotal score: 1/71 (Scanned on 2024-04-24 15:20:51)	`APEX: Malicious`

Hashes

MD5	`abc6379205de2618851c4fcbf72112eb`
SHA1	`1ed7b1e965eab56f55efda975f9f7ade95337267`
SHA256	`22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f`
SHA3	`c18a87756b638ac6f377ca59e37f8ddb02fe5bce3d74a4c6d3bb181b866ce7ca`
SSDeep	`24:eFGSPZMexrSoVjAL5jhsUnqzQhVJx+y/F/mnSBgZpwA:iJr7jALHqzPgESBg`
Imports Hash	`0b9ca80ff295945b3cf5762a07ef3d50`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xc8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`1`
TimeDateStamp	2005-Jun-28 10:18:57
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`7.0`
SizeOfCode	`0x400`
SizeOfInitializedData	`0`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00001100 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x2000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x2000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`1c61defec48fa1f4f80348e35119c7c0`
SHA1	`48e7d9fddfaa932455fc66ae350fba5082e3773d`
SHA256	`c00d7484098b37a4e16a7281b49ebaff4eb4ecc5cdf0c3e3a882e256b1cf9361`
SHA3	`25f46bfce589fe634736d46ffbb7608765d4b9244ce6d098fa46657bcd2b217b`
VirtualSize	`0x2fe`
VirtualAddress	`0x1000`
SizeOfRawData	`0x400`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_LOCKED` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.74215`

Imports

KERNEL32.dll	`GetLastError` `CloseHandle` `WaitForSingleObject` `CreateProcessA` `ExitProcess` `GetCommandLineA`
USER32.dll	`MessageBoxA`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0x8ca84749`
Unmarked objects	`0`
Imports (9210)	`5`
Total imports	`7`
C++ objects (VS2002 (.NET) build 9466)	`1`
Linker (VS2002 (.NET) build 9466)	`1`

Errors

<-- -->