1ec12808e428810cb20bf27212a09ed031408c17f633e3d0e116c364b300d2d6

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Sep-25 21:56:47
Detected languages English - United States
FileDescription Baso Network
FileVersion 2.1.0
LegalCopyright
ProductName Baso Network
ProductVersion 2.1.0

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Can access the registry:
  • RegCreateKeyExW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegEnumValueW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Changes object ACLs:
  • SetFileSecurityW
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 24217274 bytes of data starting at offset 0x35e00.
The overlay data has an entropy of 7.99999 and is possibly compressed or encrypted.
Overlay data amounts for 99.097% of the executable.
Safe VirusTotal score: 0/69 (Scanned on 2026-08-19 15:43:29) All the AVs think this file is safe.

Hashes

MD5 e2a921847791443a96fa1df2384bad58 🔍
SHA1 68c491d1dbde98dc62e1cbeec6b6555be3fdf3d3 🔍
SHA256 1ec12808e428810cb20bf27212a09ed031408c17f633e3d0e116c364b300d2d6 🔍
SHA3 5060e3ff38e8512a51987396f798adc76cd815cc634dbcf4cb9caba5e4aa1e9a 🔍
SSDeep 393216:wpe3HFuyduzXD9yenRFva9juM4BxyrcEhRE3e1D6scd623taeTV00A8Hp7y5Uttz:wA1uyduzXnR04BxyoujEscd66JW8HM5i 🔍
Imports Hash 61259b55b8912888e90f516ca08dc514 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2021-Sep-25 21:56:47
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6800
SizeOfInitializedData 0x22a00
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x00003640 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x86000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6f5abe9eeda26ee84b3c1ed1a6c82001 🔍
SHA1 55517dc6ad93689679677d152abfdd1ce20f1135 🔍
SHA256 6683c31450d22725f8046313577f87ed284052143421d41ca971ebf03a732b4a 🔍
SHA3 0166ffe9450ef9b8cd85513de36173358cc6d06134a32f515f12aa858073020f 🔍
VirtualSize 0x6676
VirtualAddress 0x1000
SizeOfRawData 0x6800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.41746

.rdata

MD5 8c5edfd8ff9cc0135e197611be38ca18 🔍
SHA1 dc4f14d019cad6646b38852dfb7370532acafebc 🔍
SHA256 95df72950424a97746c83c619f9aa736879b408a87751927b5d41994e8183a9c 🔍
SHA3 b74f8f6ea5fb7e429da44419f9d163743fd38ce97f3b9819fb2397744d42dad2 🔍
VirtualSize 0x139a
VirtualAddress 0x8000
SizeOfRawData 0x1400
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.14107

.data

MD5 4b2421975c21b032f7ea000f5e7f9fbf 🔍
SHA1 f45486287d474fdcafc99c24e37c4eb61bf613b3 🔍
SHA256 f05daf3c91cc357d04794a740f21eaaeb870f250877e3a6dc498c5c3046cb414 🔍
SHA3 03ddd58bddd9af320b79e443521aae041b4098e328b842349f29c2bda6bdb122 🔍
VirtualSize 0x20378
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x8000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.11058

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x2d000
VirtualAddress 0x2b000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 8f9df24f429ba45159c5421dc756b17b 🔍
SHA1 b0de1c6bdde3b2508e20835ec1dc338e751d4c20 🔍
SHA256 d2e124e48b4dfbb56c225e27ffd461da1ce3efbc183a275859b5a830bc10e9df 🔍
SHA3 9753e775faacb3b7d9d1bf52104f9143d3c50b666d9f55937d814c867af847bf 🔍
VirtualSize 0x2d680
VirtualAddress 0x58000
SizeOfRawData 0x2d800
PointerToRawData 0x8600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.24043

Imports

ADVAPI32.dll RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
SHELL32.dll SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32.dll OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
COMCTL32.dll #17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
USER32.dll GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
GDI32.dll SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
KERNEL32.dll GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x13fb5
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99251
Detected Filetype PNG graphic file
MD5 8a6e3266d63e6aa4a6c10d112a649952 🔍
SHA1 b2f35a87a6054d2e03420992faaeab885588f3cb 🔍
SHA256 d27737e2b6defdafcccc7b6bed9723d0f21287a9005275058161366966bf9da8 🔍
SHA3 5d6cc69afffb0574fb967e9cecdc962786798d7c4d518624809cf2baaa94c544 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.01624
MD5 3e4da27eab3446f9ef8796040c3144ac 🔍
SHA1 87b3f8d1ad7f6f6dae3d0a438539472d68a64b32 🔍
SHA256 df6ff113bd2ec0ada8ecd7ff08a16669851f9afdef9421eadab108497d18f277 🔍
SHA3 91baa7ae0edab80efc9806115163f5e839e796a44e57729555510b401f0eee18 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.03378
MD5 b7eeb6fb28bf2ae64d2dd5500d123a9b 🔍
SHA1 b0a72f13cd04cc0d93d64a3129a853c6016f1bea 🔍
SHA256 d37b4f9fbddbb09a7f340f13d9328483022f9f6a46a9a620e112d0c7c034fc0b 🔍
SHA3 66522833481295bb50f76c913a00959634324c65efde9fbfb94f4ca00a29a896 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.00002
MD5 4a17728605b6506e89cc4ae77feb9955 🔍
SHA1 4add11e0852a9b25c01070ef7838b54b1ef96285 🔍
SHA256 b53dce5dcbd93ef980fe9f8655884c5d5f3f5ec3fe60cceec65a3de732980ae9 🔍
SHA3 27d79bf8b3adb8c984f85c10726b19e07172163fd92da17111eed6d868c48f2a 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.96568
MD5 5808a8615681ff63f2de4b3a2d5ec97b 🔍
SHA1 f9091053998d22e56d5bbc4714df24b23e12d399 🔍
SHA256 92c64b79d51f9430edccfd5cbf5662e7fdfc22a35eb4a110d7782c8ed2df3440 🔍
SHA3 4db095a5ebd28b3f0d4207a35163035f17afdbd71a423c13a61308dfdc7b40d1 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.70887
MD5 cd7d890891f0b30f5a08c7f5f9bfd555 🔍
SHA1 8248c5d301e77ad8b99514cf978a123ab40d7aa0 🔍
SHA256 70e56844197a1a55103f8ffe695b7ac05c57c60a80bd4da88ed60fcd062bd6d7 🔍
SHA3 ed9f3109ae199a800ef4504fc9051ebcc8aaa7da96c111564288db3cd1208459 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0
MD5 982079681d7ad12766abc44f06946f3e 🔍
SHA1 50f73ed0787bf5911bb907e487efbc84a9714e48 🔍
SHA256 250f52cb2d6f1966a29f6ac771fa1cd185b8f8531396c8a4026c0fe635617e0c 🔍
SHA3 b8805d45012d79cfa8bb45e23c9b4a4421cd91538d569e58437efa0f545cf4d4 🔍

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x120
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.56193
MD5 db6dd0434da4d7cac564518725167e09 🔍
SHA1 a65a1367d7cd96450f089a8f8108239bbcea9f5b 🔍
SHA256 c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016 🔍
SHA3 4e3be5455c51e1cb04836e318cb69ecdffd2deadd0f338d4bc985d8f5ca653ff 🔍

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73893
MD5 386770584473e271f23dced36427f4ff 🔍
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19 🔍
SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014 🔍
SHA3 db13e5969376b27e8443eebff685230e2b74685aeb2fba73973f06e5cddc8662 🔍

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xf8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.91148
MD5 fa83652660409e90e0db9731ad2adb17 🔍
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc 🔍
SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 🔍
SHA3 5b3e1cb25be7a2dbae4f08f0d4794ed23dbd6ea37a3f9702be12dba588f42a7b 🔍

107

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xa0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52183
MD5 6ffba239dcfcab2080195f23947b70aa 🔍
SHA1 bcda1ca8ee9bb9878bde83aa06c670bb5a4d5843 🔍
SHA256 a7e5ea849cb343e9b58de221aeb25c9dd4a3748070bfba879a30c4265fc39023 🔍
SHA3 a75544b4c3fcbcb32fe4e02d1a631e045b2e58516aa1065bb96cce681aea7030 🔍

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.92767
MD5 1db3e4c32b9560257ddf3506fef9dd3f 🔍
SHA1 6666e0c8336456cfacec71d84415c6516e9e2673 🔍
SHA256 587a03198c39f990e77691056bb5705e21374281862ce06de94c68172f50f763 🔍
SHA3 30ca0affc3f1d2ef8b37f2103db7581caaf88548823fb3ae1d308fae9738dab4 🔍

103 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.5621
Detected Filetype Icon file
MD5 b1c0d044556aee4d6759245f89fddd38 🔍
SHA1 53bbec00f5436d0b2f8f094a3d3cf2710ad2d8ec 🔍
SHA256 b82a49115d3ef2ac44694708c6feff0832a4201f8b839ae6f06d7fe08c1e0f93 🔍
SHA3 3ccd32d49108601263d7819d94e7dd4c98dcfc2e185f5ee520ed75b92f6bb76e 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1e0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.18447
MD5 42028d073c94e43405c93bc3061ba6d0 🔍
SHA1 831c0eba8778955a072adb3b916ddd8c276a5d17 🔍
SHA256 abffe4be474c5ce25665dd2c215bb3afb2ab5debfbc923823608236eb3118dd5 🔍
SHA3 cebd1a30164452cf13ddb394c90f790a51e7a2d9df09433a7e338de1dad9ce61 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x548
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28651
MD5 74bd1c9761bde4540e0ce44a22adc8d9 🔍
SHA1 3887d7d5641fa941e4a7045496a6b67d45ddda7b 🔍
SHA256 5fe6e1123b916d49e917b7b90ba08196b2eaf5919b6b54ca2287a47070a49d63 🔍
SHA3 04345f5c159bd835d0f660688bc78b3cdd1695e1dc6555b44cc684a29af0dc20 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 2.1.0.0
ProductVersion 2.1.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription Baso Network
FileVersion (#2) 2.1.0
LegalCopyright
ProductName Baso Network
ProductVersion (#2) 2.1.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd26650e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 165
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0!
Leave a comment

No comments yet.