| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2001-Sep-05 17:02:57 |
| Detected languages |
English - United States
|
| Comments | |
| CompanyName | |
| FileDescription | |
| InternalName | stub32 |
| OriginalFilename | stub32i.exe |
| FileVersion | 3.3.8 |
| LegalCopyright | 2008 Google |
| ProductName | Maestro |
| ProductVersion | 3.3.8 |
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ Microsoft Visual C++ v6.0 Microsoft Visual C++ v5.0/v6.0 (MFC) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for Qemu presence:
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. |
Resource 118 is possibly compressed or encrypted.
Resource 4 is possibly compressed or encrypted. |
| Suspicious | The file contains overlay data. |
8816835 bytes of data starting at offset 0x44000.
The overlay data has an entropy of 7.99981 and is possibly compressed or encrypted. Overlay data amounts for 96.9377% of the executable. |
| Malicious | The program tries to mislead users about its origins. | The PE pretends to be from Google but is not signed! |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2001-Sep-05 17:02:57 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x12000 |
| SizeOfInitializedData | 0x34000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00008947 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x13000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x47000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x8b98de |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| KERNEL32.dll |
GetProcAddress
FormatMessageA DeleteFileA MulDiv IsDBCSLeadByte GetExitCodeProcess CreateProcessA GetTempFileNameA GetSystemDefaultLCID WaitForSingleObject CompareStringA Sleep SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime FreeLibrary RemoveDirectoryA FindNextFileA WritePrivateProfileSectionA GetStartupInfoA WriteFile ReadFile SetFileAttributesA LocalFree LocalAlloc LockResource LoadResource FindResourceA SizeofResource GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc MultiByteToWideChar lstrcmpiA GetDiskFreeSpaceA HeapAlloc GetProcessHeap HeapFree GetModuleFileNameA ExitProcess CreateFileA CreateFileMappingA MapViewOfFile UnmapViewOfFile lstrcpynA SetFilePointer GetFileSize FindFirstFileA CreateDirectoryA GetLastError GetPrivateProfileStringA FindClose GetFileAttributesA lstrcatA lstrlenA GetWindowsDirectoryA lstrcpyA GetSystemDirectoryA GetTempPathA GetPrivateProfileSectionA LoadLibraryA MoveFileExA WritePrivateProfileStringA GetShortPathNameA FlushFileBuffers CloseHandle IsBadCodePtr IsBadReadPtr SetStdHandle LCMapStringW LCMapStringA SetUnhandledExceptionFilter GetStdHandle SetHandleCount GetFileType GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter FreeEnvironmentStringsW TerminateProcess GetStringTypeW GetCurrentProcess GetOEMCP GetACP GetStringTypeA IsBadWritePtr HeapReAlloc GetCPInfo VirtualFree HeapCreate VirtualAlloc GetVersion GetCommandLineA HeapDestroy RtlUnwind |
|---|---|
| USER32.dll |
GetParent
GetDlgItem SetFocus SendDlgItemMessageA EnableWindow CheckRadioButton GetWindowLongA LoadStringA LoadImageA MessageBoxA CharNextA IsDlgButtonChecked GetDlgItemTextA CheckDlgButton SetDlgItemTextA ReleaseDC GetDC GetWindow PostMessageA SetWindowTextA wsprintfA GetDesktopWindow GetWindowTextA DestroyWindow CreateDialogParamA FillRect GetSysColor GetSysColorBrush EndPaint BeginPaint DrawTextA MoveWindow GetClientRect ScreenToClient GetNextDlgTabItem SetParent MapDialogRect IsWindow GetWindowRect CreateDialogIndirectParamA ShowWindow InvalidateRect IsWindowEnabled SetWindowPos UpdateWindow IsDialogMessageA SetWindowLongA GetActiveWindow SetActiveWindow LoadIconA PeekMessageA SendMessageA DispatchMessageA TranslateMessage |
| GDI32.dll |
CreateFontIndirectA
RealizePalette SelectPalette CreatePalette GetObjectA GetStockObject CreateDIBitmap GetTextExtentPointA SelectObject EnumFontFamiliesExA DeleteDC BitBlt TextOutA SetBkMode SetBkColor CreateCompatibleDC CreateSolidBrush SetTextColor DeleteObject GetDeviceCaps |
| ADVAPI32.dll |
RegCloseKey
RegQueryValueExA RegOpenKeyExA |
| SHELL32.dll |
ShellExecuteA
SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc |
| LZ32.dll |
LZOpenFileA
LZCopy LZClose |
| COMCTL32.dll |
#17
|
| PackageForTheWeb Error |
| This self extracting executable file appears to have been corrupted and cannot be executed. You should obtain a new copy of this file to insure that it will execute correctly. |
| Unable to open the self-extracting executable file. The file is locked or in use by another process. The installation will terminate. |
| PackageForTheWeb |
| Unable to access the source file! |
| Unable to create the cabinet file! |
| Unable to access the specified path. |
| Unable to create the specified output folder. Bad path name. |
| Unable to start the decompression process! |
| The EXE file has been corrupted. Unable to continue. |
| Unable to execute the specified command line! |
| This program is used internally by PackageFromTheWeb. It should not be executed directly. |
| Bad or missing header information! |
| Unable to initialize the extension DLL. |
| Error Executing the Specified Program |
| Unpacking %s... |
| The specified drive does not exist |
| No error |
| Missing cabinet file! |
| Input file is not a cabinet. |
| Bad cabinet version. |
| Corrupt cabinet file! |
| Memory allocation failure! |
| Invalid file compression type! |
| CRC failure. |
| System error during decompression |
| Incorrect cabinet file selected |
| The package decompression has been cancelled. |
| Unable to create the specified output folder! |
| Unable to compute required disk space |
| There is not enough space on drive %s to extract this package. |
| MB |
| KB |
| bytes |
| There is not enough space on drive %s to extract this package |
| version |
| Please free up %.2f %s and click Retry |
| 12,MS Shell Dlg |
| &Finish |
| 8,MS Shell Dlg |
| 8,MS Shell Dlg |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 4.0.100.1190 |
| ProductVersion | 4.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| Comments | |
| CompanyName | |
| FileDescription | |
| InternalName | stub32 |
| OriginalFilename | stub32i.exe |
| FileVersion (#2) | 3.3.8 |
| LegalCopyright | 2008 Google |
| ProductName | Maestro |
| ProductVersion (#2) | 3.3.8 |
| Resource LangID | English - United States |
|---|
| XOR Key | 0xd7f777f0 |
|---|---|
| Unmarked objects | 0 |
| Unmarked objects (#2) | 21 |
| C++ objects (VS98 build 8168) | 8 |
| 14 (7299) | 18 |
| C objects (VS98 build 8168) | 73 |
| 19 (9049) | 15 |
| Total imports | 185 |
| C++ objects (VC++ 6.0 SP5 imp/exp build 8447) | 10 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
No comments yet.