41302c9c60499b64465d985098f33525dffb1908f1b807456183f8a602ce013f

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2016-Jul-11 10:18:50
Detected languages English - United States
Japanese - Japan
Comments http://www.ponsoftware.com/
CompanyName pon software
FileDescription Win32 cab Self-Extractor
FileVersion 1.51
InternalName deccab
LegalCopyright Copyright(c) 2001-2016 by pon software
OriginalFilename deccab.exe
ProductName decode cab
ProductVersion 1.52

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Microsoft Visual C++
Microsoft Visual C++ v6.0
Microsoft Visual C++ v5.0/v6.0 (MFC)
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • rundll32.exe
 May have dropper capabilities:
  • %temp%
 Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • http://www.ponsoftware.com
  • http://www.ponsoftware.com/
  • nsoftware.com
  • ponsoftware.com
  • www.ponsoftware.com
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessA
 Can create temporary files:
  • GetTempPathA
  • CreateFileA
Info The PE is digitally signed. Signer: pon software
Issuer: thawte SHA256 Code Signing CA
Safe VirusTotal score: 0/71 (Scanned on 2026-11-03 19:44:32) All the AVs think this file is safe.

Hashes

MD5 c05011e7b800b0a645efaf3478a87bd6 🔍
SHA1 ffee58b7d8830286c9332b58f5a29221a090929a 🔍
SHA256 41302c9c60499b64465d985098f33525dffb1908f1b807456183f8a602ce013f 🔍
SHA3 bf5e7422d21b2d1c2037a433b8a2b548fd1fa5d5c16c038c584acdddaa3856a8 🔍
SSDeep 3072:vHIQB6Osk7sd4ADk6lN5W54alct3kPn6Hum+:vHIQBPskYd4iuut0f4uv 🔍
Imports Hash cafe4a1aa3dcfca7a63665012d29e6bf 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2016-Jul-11 10:18:50
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0xa000
SizeOfInitializedData 0x8000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00003CBA (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xb000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x13000
SizeOfHeaders 0x1000
Checksum 0x24647
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4789e8a47a5eab2446336154c0ab4a11 🔍
SHA1 1fb905e3f6c160310227a5a69b1c5e46922c7dcf 🔍
SHA256 b348155e54a857c5124b0c3b0ab94cc25579b31320a3b2380427f55202160c8b 🔍
SHA3 5cdc1fbbca23f13672d3425f23cd476c64214d6c8cdbbeabb024f5389ea43ec0 🔍
VirtualSize 0x98cd
VirtualAddress 0x1000
SizeOfRawData 0xa000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.31395

.rdata

MD5 ccb44bb6d9665686637d81701c66606e 🔍
SHA1 b2f4869eba0ba8be12f29cad9f3f7580cd738dac 🔍
SHA256 e61b45d43fd22d590812f897a45428e84f4639207cb0a4fe504105c426ac00e1 🔍
SHA3 3d858b5cf7ee94f9f9be4406b84456257b314111c9c8a51f5a157d34494681b8 🔍
VirtualSize 0xf0a
VirtualAddress 0xb000
SizeOfRawData 0x1000
PointerToRawData 0xb000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.93021

.data

MD5 96ebf5959cbbc76f200deb4fb350a559 🔍
SHA1 b20f702f854847c3112fc312bab11502a73076f5 🔍
SHA256 882939dc5e20b34b12f19231df68b2dba252984072441d9b4e9e80d946ec178f 🔍
SHA3 9397d29ccbd0eeb12f27451f1a1c59e86695f8c1917752b0056a715e83d04fab 🔍
VirtualSize 0x3d98
VirtualAddress 0xc000
SizeOfRawData 0x1000
PointerToRawData 0xc000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.76419

.rsrc

MD5 1cb38a29c961c21ddbad0a7b40db7cc8 🔍
SHA1 ab03baa865d141feddeea3bc10ffdd6c664d0ade 🔍
SHA256 81d1cbdf506ab810c369478e9bc5f28ab873597cf54d5a8bf82e6dd115a6e2e4 🔍
SHA3 87309253f222963633e465cca87a3c9b3ed536099c1ccba65ba8f89d9247d050 🔍
VirtualSize 0x2c40
VirtualAddress 0x10000
SizeOfRawData 0x3000
PointerToRawData 0xd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.49362

Imports

MSVCRT.dll _controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strncpy
atoi
wcschr
wcscat
wcscpy
_strdup
strchr
strtok
sprintf
_stricmp
_tell
_write
strstr
_strnicmp
memset
_open
_filelength
malloc
_lseek
_read
free
_close
strrchr
wcsrchr
wcsstr
wcscspn
wcslen
_beginthreadex
KERNEL32.dll DeleteFileA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
GetTempPathA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CreateDirectoryA
WideCharToMultiByte
MultiByteToWideChar
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalHandle
GlobalUnlock
GlobalFree
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
OutputDebugStringA
IsDBCSLeadByte
CreateFileA
GetFileTime
GetFileSize
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetWindowsDirectoryA
SearchPathA
lstrcmpiA
GetShortPathNameA
CreateProcessA
Sleep
GetExitCodeProcess
GetModuleHandleA
GetProcAddress
GetCurrentProcess
lstrcpyA
GetModuleFileNameA
lstrlenA
lstrcatA
FindClose
FindNextFileA
RemoveDirectoryA
lstrcmpA
FindFirstFileA
SetFileAttributesA
CloseHandle
GetExitCodeThread
WaitForSingleObject
GetFileAttributesA

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.60197
MD5 81eedc9a29690afd3c8e61c3c0f10fa2 🔍
SHA1 8a6db23591ce99b18ebf00ea28dac70096fb5914 🔍
SHA256 e10d8b414b0ce9797bf7f8c2ce166d733fdfe53fc5cb2ec500a0e4802c15c617 🔍
SHA3 aa5c9331975765dd1130d3c9f8dd4899d88d70793726c2af9a01d8d88da82e13 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.41101
MD5 68dec127ad1e2852d55c01ee5d2ae1a2 🔍
SHA1 8fb808cda702982d5bb661780c4abdf39f39d130 🔍
SHA256 2630f566987c79ae41cb645207efeafd0ee5f9b6458a6701c568628448ba8c3a 🔍
SHA3 82927d8ac85f485313655090feeb1dd3ab71e7edf3750e75dc81267b399d0287 🔍

103

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0xb8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.17189
MD5 6bb067bede80499c6e2a6e85d66f09c5 🔍
SHA1 d53919375b0aa7670471407ee47d1577050cb97e 🔍
SHA256 caa5f468b6ac74b2d8c1ff8037062515bb78a13bf590de6985cc69b37c8c33e9 🔍
SHA3 27ec90e8996869a8772de3dab48c36074d4f4837f392311fbe21edfcd5019a77 🔍

103 (#2)

Type RT_DIALOG
Language Japanese - Japan
Codepage UNKNOWN
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.60674
MD5 6a335cc7f27dc4063a60e97741515da6 🔍
SHA1 6d0531ed114da7a8a22ab6cf51d4af56462d0098 🔍
SHA256 831765f696d8adf1da06a4c4d4ef5eaa7e6b4b15cd430dfb8b04612bb6428c10 🔍
SHA3 970a24649dd97095da091444c891dbffc1e624ed550e2a2fb167772d13746ce6 🔍

202

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x202
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.45675
MD5 dc4d29ecd45746fff09c95c433774668 🔍
SHA1 d5dbf5dc0878d92ae1b39479c125c1ddc45fbab0 🔍
SHA256 0b11bcb595e53860ea13379ce49ed520ab2d5e63b1977e26611af8786d211bcc 🔍
SHA3 b1dcb14bff8e4b485993efc0a1660834d47de98d65c36479b2d38b1d1095f5e6 🔍

202 (#2)

Type RT_DIALOG
Language Japanese - Japan
Codepage UNKNOWN
Size 0x144
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.26063
MD5 0209c615c1c4596165c6a1349fb97e73 🔍
SHA1 c3e7834b43c33f3dbe0b9b6cc0a1b536f391b30f 🔍
SHA256 fc68a50b7513b436dda6217854192834d519b089966de56b8df47b1532284430 🔍
SHA3 5117884101095e3092aa7c77ca914d5a81c475b674ce3d8597fa5fe8fb28c6b5 🔍

2007

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x278
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.42708
MD5 0a56df073c06c8b899fe81456e7c9474 🔍
SHA1 b10ecbd47c5ed0dc73a78a034d927a2c2cbc54bb 🔍
SHA256 8795f196a569e026b2cbaa0e3f6bbfeb502ec3c5d9669efdca79692d0668e927 🔍
SHA3 60cb6ba906c5ca95e5874f1e6230fab8633d6e9a2e69f57076af4a815b705548 🔍

2007 (#2)

Type RT_DIALOG
Language Japanese - Japan
Codepage UNKNOWN
Size 0x258
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.16711
MD5 dc58cea790383bda39193e9584082ba8 🔍
SHA1 6cbf0e3b2d01f9ec31b46e1925c44c69956853d5 🔍
SHA256 0d7144b84c7985f58cb74906780a54716c255228410a08ff787496b946311540 🔍
SHA3 be6285df3b5f22db8c501c7e912289bbdfad333b2c9b925324eaa4c45b497fd5 🔍

2008

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x11a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.29446
MD5 7f770bb3571038dfb391097da4071b46 🔍
SHA1 68b38c7e331d1a710d13d62c6c6d13d515ee0afe 🔍
SHA256 c43f8a7212dcabdd953d0ddeb36649793cab427ae983a3dbe950c85445f7051f 🔍
SHA3 b908a3533cf6cb23e79106ad9380ddabc1d395abbdc48994e87ca36dbfabb225 🔍

2008 (#2)

Type RT_DIALOG
Language Japanese - Japan
Codepage UNKNOWN
Size 0xe6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.74004
MD5 4a55e26b597dfb899fa48a146572c290 🔍
SHA1 be9d5e4e92e8c84a4792cb14dfb428f3a7885519 🔍
SHA256 6a60fbf338ac47482604575e8117cf150417d0e9ed1834aea8285dee98b18cbe 🔍
SHA3 afaaec308f0430b0c43c621d0411f1e89a98a3af03e4b878824d5402e5107be9 🔍

1 (#2)

Type RT_STRING
Language English - United States
Codepage UNKNOWN
Size 0x354
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.40135
MD5 13162f5799aab23a9d53ead2cae26a68 🔍
SHA1 aa6e8cb1f40b0a8e1a84905e4bbce1cdb28fe88d 🔍
SHA256 90d3e5ca1dedfe231ff8fd9009934f1a0439715f04166b46e18dacaca9675e1e 🔍
SHA3 2fb78c6cc548069de9358951893e3943c0b28997b354c87b064964cc01b4ef0c 🔍

1 (#3)

Type RT_STRING
Language Japanese - Japan
Codepage UNKNOWN
Size 0x28c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.05139
MD5 e95e3474c7b5215304e72e8cab3d9366 🔍
SHA1 b772b7b8c50c6d5d5f8823c637a3a985b9ad3d48 🔍
SHA256 c50267ba3aa9d8785fb5e0959bc37446b8cf082143d7aba0f535c47d723ef109 🔍
SHA3 5cb60d72cc7bcc43355004ed3f7f72d8cced6b51ca50b4af27b1c4a49d4c31fe 🔍

200

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.81924
Detected Filetype Icon file
MD5 cbee427fa121aba9b9b265ff05de5383 🔍
SHA1 24fcae33001c8e0f5ec795c6edf076a69d59589f 🔍
SHA256 494e4fd717fa1ee0c5c7bb3b4e28fdab4b7f6e95b4f9865f5ab86f03f62ae62c 🔍
SHA3 a3fa35d56632275ba55716a4964f02031270f61f06a903fc460ac2dd6bebde85 🔍

205

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.22322
Detected Filetype Icon file
MD5 e113b50b534c1cf282bd8b50aa427dfe 🔍
SHA1 65f4cefce100e60fb5f37ee84f6c6079d8925964 🔍
SHA256 70c44df2204ba02cef387313aed59a095724ba4b8e0213b68e41418b1236e140 🔍
SHA3 889cd611ad8ce301ece0cff36f29c125c2350dba0106a153bf46ba8007f345cf 🔍

1 (#4)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x600
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71915
MD5 410425c7f7538c599e355acc17bf7473 🔍
SHA1 fb30f901384600834e4a281ce554494e10f295f3 🔍
SHA256 ec0cd674471b20d42f9d314423e646c371df44b8fe38509b26f7433d0dc18093 🔍
SHA3 17b43b20f99fb719c3431332cc0c212dceeae55f5598144575682051ac3e2a11 🔍

1 (#5)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x5ca
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37257
MD5 26fb05e12ba7d4b5aa09cef99c46868a 🔍
SHA1 b3594800cc18c8157dbd39f9966e52ef5710f149 🔍
SHA256 d9b9dcbdd9e598d58aedb0d7d5cd24875af354ae864704e7b96d62eb63cafd40 🔍
SHA3 fd396c4f15501334c11499eafcfefe03629e764667519424fb1d68c78bcf339a 🔍

String Table contents

Cannot create a file.
Cannot open arhive.
not supported archive format.
The Folder '%s' does not exist.
Do you want to create it?
Cannot create a folder.
%s
invalid filename.(skipped)
Cannot create a folder.
This archive forbids writing.
CRC check error!
%%s Bytes
Modified: %02d, %02d, %04d, %02d:%02d:%02d
Invalid path!
Please select a folder to store the extracted files.
This auto-sfx-module cannot be run in Win32.
展開先にファイルを作成できません。
書庫を開けません。
対応していない書庫形式です。
'%s'
展開先フォルダは存在しません。
フォルダを作成しますか？
フォルダを作成できません。
%s
不正なファイル名の展開をスキップします。
展開先フォルダを作成できません。
CRC チェックエラー
'%s'
はファイルが改竄されたか、ファイルが破損しています。
配布ファイルの場合にはファイルの入手元から再入手してください。
%%s バイト
%04d年%02d月%02d日 ??曜日、%02d:%02d:%02d
格納パス情報がおかしいです。
解凍先のフォルダを指定してください。
このセットアップモジュールは Windows 64ビット用です。

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.51.0.0
ProductVersion 1.52.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments http://www.ponsoftware.com/
CompanyName pon software
FileDescription Win32 cab Self-Extractor
FileVersion (#2) 1.51
InternalName deccab
LegalCopyright Copyright(c) 2001-2016 by pon software
OriginalFilename deccab.exe
ProductName decode cab
ProductVersion (#2) 1.52
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xdb88075b
Unmarked objects 0
C++ objects (VS98 build 8168) 3
Unmarked objects (#2) 25
19 (8034) 2
C objects (8047) 11
14 (7299) 2
Linker (8047) 3
Total imports 135
C++ objects (VS98 SP6 build 8804) 4
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Could not read the name of the DLL to be delay-loaded!
Leave a comment

No comments yet.