3e8b2861492f1a5296f05dcaabc0b24d0c122de79792b021c14042a1e2ae318e

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2012-Jun-14 16:16:10
Detected languages English - United States
Comments Created with Setup Factory
FileDescription Setup Application
FileVersion 9.1.0.0
InternalName suf_launch
LegalCopyright Setup Engine Copyright © 2004-2012 Indigo Rose Corporation
LegalTrademarks Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFilename suf_launch.exe
ProductName Setup Factory Runtime
ProductVersion 9.1.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious PEiD Signature: UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h)
UPX -> www.upx.sourceforge.net
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
Suspicious Strings found in the binary may indicate undesirable behavior: Contains a XORed PE executable:
  • 53 6f 6e 74 27 77 75 68 60 75 66 6a 27 64 66 69 69 68 73 27 ...
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • comodo.net
  • crl.usertrust.com
  • http://crl.usertrust.com
  • http://crl.usertrust.com/UTN-USERFirst-Object.crl04
  • http://crl.usertrust.com/UTN-USERFirst-Object.crl05
  • http://ocsp.comodoca.com0
  • http://ocsp.usertrust.com0
  • http://www.indigorose.com
  • http://www.usertrust.com1
  • https://secure.comodo.net
  • https://secure.comodo.net/CPS0B
  • indigorose.com
  • secure.comodo.net
  • usertrust.com
  • www.indigorose.com
  • www.lua.org
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
 Functions related to the privilege level:
  • OpenProcessToken
Suspicious The file contains overlay data. 2608200 bytes of data starting at offset 0x11800.
The overlay data has an entropy of 7.91467 and is possibly compressed or encrypted.
Overlay data amounts for 97.3253% of the executable.
Malicious VirusTotal score: 9/70 (Scanned on 2026-08-24 07:01:14) APEX: Malicious
Bkav: W32.Malware.A508E2A6
Cylance: Unsafe
Cynet: Malicious (score: 100)
DeepInstinct: MALICIOUS
Elastic: malicious (moderate confidence)
Google: Detected
TrendMicro-HouseCall: Trojan.Win32.Gen.TL0101FJ26YV
Varist: W32/Agent.CIX.gen!Eldorado

Hashes

MD5 3ad8a8c8f0f68be272b435c2288c397e 🔍
SHA1 e03ae85381c19b62b49c5986cbda8616ebb13e2b 🔍
SHA256 3e8b2861492f1a5296f05dcaabc0b24d0c122de79792b021c14042a1e2ae318e 🔍
SHA3 da6a0e6877250b1e2e80b133b249607c917e0162bdc8a09ae6e10438b4526557 🔍
SSDeep 49152:ON26FOnzGn6LJvqkwnpC+mWd6uIccdsGL0i3KJp3RP7AQljg0:O06FOznLo0+Dd6uxcmGL0JRJvj1 🔍
Imports Hash 1ff847646487d56f85778df99ff3728a 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2012-Jun-14 16:16:10
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 10.0
SizeOfCode 0x5800
SizeOfInitializedData 0xbc00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000029E1 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x7000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x15000
SizeOfHeaders 0x400
Checksum 0x1b89e
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c76b9ce587690b8a39ba7840b7dd540c 🔍
SHA1 114d7340e840ad290bdbf90e90e9848d2e1725c5 🔍
SHA256 a00ca9a863671b53f3827886406ca4967dad3c431d69e6486eec22e65020bef2 🔍
SHA3 9477a30e7bed966312d2065b460a0554cb8c61b0262d124ff625dac3e5450192 🔍
VirtualSize 0x5718
VirtualAddress 0x1000
SizeOfRawData 0x5800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45945

.rdata

MD5 e96aa4f970e6f6799910a72904df3100 🔍
SHA1 80c5981f622e43d6b57fcf3642184de602555aea 🔍
SHA256 7ef2a00b505d7c6eea17396996af46b069539da535a30b838e27dcd37a8b70fe 🔍
SHA3 08198caf2cff29d6ab5989f028230d3e368b51cac9efd41d4d9b5246e04bfe56 🔍
VirtualSize 0x2e82
VirtualAddress 0x7000
SizeOfRawData 0x3000
PointerToRawData 0x5c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.97533

.data

MD5 e504fdbba062ee9bbd9ac425a4f5c0f5 🔍
SHA1 43d241c5d9433f431cd187c0aff3a614130ad427 🔍
SHA256 9311d3ce61454f57fad8b8bfd0e560fa2c5c50e5adfaf08c6d84a63a4f6d71f8 🔍
SHA3 32c881ab5032b7e9c6a3e74f28dea2e2dc803bbbbaf4205898faf63e8a6567f3 🔍
VirtualSize 0x1968
VirtualAddress 0xa000
SizeOfRawData 0xc00
PointerToRawData 0x8c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.58663

.rsrc

MD5 f07da938ca4a81c16d34f6b033be873e 🔍
SHA1 be3ca429967a53ebea6f66c8ba4d146d40588aab 🔍
SHA256 5b5c0f6a5e2e00a5a3343d7f6f968057abf0584113fb1b83743a85b421e9103a 🔍
SHA3 7549cac394b6f819a433835c26cb63d40526840270ebcdc37b7fe8816fedb261 🔍
VirtualSize 0x6dcc
VirtualAddress 0xc000
SizeOfRawData 0x6e00
PointerToRawData 0x9800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.82004

.reloc

MD5 a88bdb6f651ecf67b1b3db4a2866ea4e 🔍
SHA1 13996ad6f496c64dff1dbee17649d328463ed818 🔍
SHA256 6b4158116338cec89b82463ed9b34c860278f8a421b7e3919e8b9d6be7bddcbf 🔍
SHA3 81a7f8f1eb36f73e5d80d1f5b61368fae19a7bdb733c4be6e9f8252c90e73c68 🔍
VirtualSize 0x1092
VirtualAddress 0x13000
SizeOfRawData 0x1200
PointerToRawData 0x10600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.7122

Imports

KERNEL32.dll _lclose
GetModuleFileNameA
_lread
_llseek
_lopen
_lwrite
_lcreat
CreateDirectoryA
SetCurrentDirectoryA
lstrcatA
FreeLibrary
GetProcAddress
LoadLibraryA
GetDiskFreeSpaceA
GetFileAttributesA
RemoveDirectoryA
DeleteFileA
lstrlenA
GetCurrentDirectoryA
CloseHandle
GetExitCodeProcess
GetLastError
LocalFree
GetCurrentProcess
MoveFileExA
Sleep
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
RtlUnwind
HeapSize
lstrcpyA
GetTempPathA
CompareStringA
IsValidCodePage
GetOEMCP
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
USER32.dll TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
MsgWaitForMultipleObjects
ADVAPI32.dll GetTokenInformation
OpenProcessToken
SHELL32.dll ShellExecuteExA

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37177
MD5 496b9dec82e136f2b5dd974f16e64bf0 🔍
SHA1 9018c14ef7230dd5ee908cd193927d44d086782c 🔍
SHA256 bb69db8fabd21337e457a739d0c541c759678d349e900d52f5dfa22828f326e5 🔍
SHA3 babb83439e7ae90d3eb92f8bf7c442b4661e4f69ff0ca9e57eb882305072e6ff 🔍

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.31421
MD5 ceea1f40f26b391da8977d0bc69ce333 🔍
SHA1 b0cc7faf384a4a9b55661c9dd00afff3bd478469 🔍
SHA256 1f8d3da0dd89dca26c6bb14ac7be9ed5a01bc929574ad46b87524f251e80e2be 🔍
SHA3 b2209ce5f96a2132ab957018f921de9955c4e2d755221c41dd1263f681fb7608 🔍

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.9477
MD5 286299765e413961c577250b562a9f6d 🔍
SHA1 c11066e0b36e102c15530a0a2bcf3ff59a447e38 🔍
SHA256 06fb164c24b5774aa1cc61dee3855f98998e7d8b80e7370403da6c202f054da8 🔍
SHA3 78911af57398ed019c2227579f388a129529836767481d8f3a52a82fca9ab835 🔍

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.78233
MD5 2bfdea3afd1fff1a7b0289c617cfae05 🔍
SHA1 bc3d4258adec91cf01ff8d841bec5c48dd58000f 🔍
SHA256 a8af8d3e6282e1efdd38fb2787c9ec42cfbbf9cd1d473f6845590c3e31ea3c11 🔍
SHA3 f14c0636ff106d35a48416d618b5f71220091567cea7ad6f582412d2e81f1afd 🔍

5

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.14953
MD5 d400262b6638ac150461e04641caf542 🔍
SHA1 bff6b574a2d8b8597b021e26699da166d7520104 🔍
SHA256 31e4e1eea0a0e2e6443773d356ddca1fe28d32e74727a13638c85bdbd78281a6 🔍
SHA3 b007210806cc46ddec9dbe9dcef89d122150393bfd47f2cae5e4419fdbb17ab7 🔍

6

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.83714
MD5 b5c47d2978f629cc35ab63e89cabcb2c 🔍
SHA1 2b979114d1a0832ede92cc14a62be2fe3a5572fd 🔍
SHA256 7a7ef627be60b3f8f5b2366d513efd6b341eb942f039bfcc9399d82ebd898d0d 🔍
SHA3 bb2328d1e5c94651d22cf3798eb92a76f9d12a8f9bc237339608787594276d5a 🔍

7

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x668
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.64397
MD5 6acf27cac1ed0cc79e0b5cf6bbfa35af 🔍
SHA1 ae882712f338525cbb428dbb0dc5556a858993db 🔍
SHA256 d8bbb3fb720499a58160e7956e4bd18855b384c6dbd3aa262fea0e121436c6f2 🔍
SHA3 06441aae6d59e83b9369b36d31536ea17a6ecc34b49ea1958dc0fca25ff89567 🔍

8

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.84115
MD5 5073c50c3a136934f16481bc0b3df044 🔍
SHA1 11df1eebfbd55cb5acf95991e7c0169475ef9b8a 🔍
SHA256 b65d018eb43b3c976a891e6677049eee014093e7c77774ffa1a4d08565891ecd 🔍
SHA3 89b824ae6dc6f8b6f2e1336885fc0cd021eaf37e1efa48eeafc39a70a171b764 🔍

9

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.41049
MD5 ca478133475a2622104a5405539831fe 🔍
SHA1 8f2ad79e45e19b6ad4c3dc6aa273ea53479b67fa 🔍
SHA256 9df16fabe1cfc3dc3095c7c70f5fa39be14a8ca6a4fdf4aeaa194cde7995127c 🔍
SHA3 34ec32be9c59ab7710496e0b02eb1c81b11ff5394d1a13e31ade7870126bbc7d 🔍

101

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.89097
Detected Filetype Icon file
MD5 6e71c5b6be8e29bfdcf3d856260f17b4 🔍
SHA1 d98d52ae0f3b84f09e2579e87bacdd0987e921d7 🔍
SHA256 d5f3b5a9baad2206b061f158ddba8b9feb33508f7b1c45fbdc4167b0d749e9fe 🔍
SHA3 97b048b0f05c431eaa5c59b1156fa9107d30ef7da35299cc317df636b40992ac 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x3e0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.39747
MD5 285d59f27fedb3d7530c93740723a215 🔍
SHA1 eb289187e2ca14f41befa0de63802e5c8052ce2e 🔍
SHA256 7725ed36c9a66a47e1d11e7e5e0109208759fbe953413f9ac0618c73a31919bf 🔍
SHA3 108faf189a1f341e16c31823f2e1367f388cb4fa72f18a15e081287b5e28ff7a 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x4d0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.31872
MD5 745521cd5d2fd98b824f52de4ce045d9 🔍
SHA1 8434883bae4d4de7cbdb4c294428c272d81d70dd 🔍
SHA256 d048ce091eb6bc795f3500184d2f150a289971c0052287441c2db122be9523e7 🔍
SHA3 f30858bacf241c25bf38fc185cc9b5d3f38684f963be94a6d340eee259b3f710 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 9.1.0.0
ProductVersion 9.1.0.0
FileFlags VS_FF_PRIVATEBUILD
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments Created with Setup Factory
FileDescription Setup Application
FileVersion (#2) 9.1.0.0
InternalName suf_launch
LegalCopyright Setup Engine Copyright © 2004-2012 Indigo Rose Corporation
LegalTrademarks Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFilename suf_launch.exe
ProductName Setup Factory Runtime
ProductVersion (#2) 9.1.0.0
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x40a020
SEHandlerTable 0x409470
SEHandlerCount 3

RICH Header

XOR Key 0x945cbac7
Unmarked objects 0
ASM objects (VS2010 SP1 build 40219) 14
C objects (VS2010 SP1 build 40219) 67
Imports (VS2008 SP1 build 30729) 9
Total imports 100
C++ objects (VS2010 SP1 build 40219) 25
Resource objects (VS2010 SP1 build 40219) 1
Linker (VS2010 SP1 build 40219) 1

Errors

Leave a comment

No comments yet.