4236f12d6110312ad44d7f7db0b61cbbc20dd9b9d3483e5abf76f02741886c9e

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1992-Jun-19 22:22:17
Detected languages German - Austria

Plugin Output

Suspicious The PE is possibly packed. Section CODE is both writable and executable.
Section .rsrc is both writable and executable.
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2004-Sep-05 20:44:46
Malicious VirusTotal score: 6/46 (Scanned on 2026-08-06 03:50:14) APEX: Malicious
Bkav: W32.Malware.2E25C488
Cynet: Malicious (score: 100)
Kingsoft: malware.kb.a.1000
SentinelOne: Static AI - Suspicious PE
Trapmine: malicious.moderate.ml.score

Hashes

MD5 56b82affab3ec365bb9334807ffeca5c 🔍
SHA1 15ff732bd8d72adc28ef9aa9fe122b2ba84dbd9b 🔍
SHA256 4236f12d6110312ad44d7f7db0b61cbbc20dd9b9d3483e5abf76f02741886c9e 🔍
SHA3 c1a3537940f5e82494f7d18c30524320a804210e30a124990621ad3cda4afd8f 🔍
SSDeep 3072:4dj6LlTD+khCAg/boixmg7BwCINmnyG/JlOG9h:4dj6pTDnil91wZmnvJlOG9 🔍
Imports Hash 109a674a0c09b2fafd70ca573e3ea3eb 🔍

DOS Header

e_magic MZ
e_cblp 0x50
e_cp 0x2
e_crlc 0
e_cparhdr 0x4
e_minalloc 0xf
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0x1a
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 2
TimeDateStamp 1992-Jun-19 22:22:17
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0x36c00
SizeOfInitializedData 0xf200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001000 (Section: CODE)
BaseOfCode 0x1000
BaseOfData 0x38000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 1.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x50000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x4000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

CODE

MD5 c810b6ad3b7221c01c40ee10bcd50e9d 🔍
SHA1 678014f332bada77a3598a14e4c1806527d6a941 🔍
SHA256 be5a225885530ad0d2e141b9a338e6b010b01db682d4228ee99997cec7cd666b 🔍
SHA3 4c943c5659d24ca6e367c9f45f6e542f87eb512670dc5f2838cf742adb6a25bc 🔍
VirtualSize 0x4d000
VirtualAddress 0x1000
SizeOfRawData 0x1b400
PointerToRawData 0x400
PointerToRelocations 0x32434550
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99842

.rsrc

MD5 0e9ab4baa92e3e5f73f8d90fef347c1a 🔍
SHA1 f25affd11d4125362db27e45ae6149f10c801a95 🔍
SHA256 0f11656e6c6a4cd00a675cff8e67f44228060fae3f9b51f3a34c472813f0944c 🔍
SHA3 9e6748d7d25d3850b6cad55450ad9f3c9e5ec6e5c0df724278e68a8058dab403 🔍
VirtualSize 0x2000
VirtualAddress 0x4e000
SizeOfRawData 0x1400
PointerToRawData 0x1b800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.42178

Imports

kernel32.dll LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32.dll LoadStringA
oleaut32.dll VariantChangeTypeEx
gdi32.dll StretchBlt
shell32.dll SHGetPathFromIDListA
ole32.dll CoTaskMemFree
comctl32.dll ImageList_GetIconSize

Delayed Imports

1

Type RT_ICON
Language German - Austria
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 2004-Sep-05 20:44:46
Entropy 2.33217
MD5 eeac59750a6b1c740713b10792e1facb 🔍
SHA1 f83b187bd216704f29393c915607cf153c0f6f66 🔍
SHA256 bff29f0526df65a069d2615dc7e485a153afffc8b2cb1b87c21eb49b0fa2757d 🔍
SHA3 f7145c8cec75c0504533df989b53a1e146e5e6fb3e6be52fe1c5a2bb2610be61 🔍

PACKAGEINFO

Type RT_RCDATA
Language UNKNOWN
Codepage UNKNOWN
Size 0x150
TimeDateStamp 2004-Sep-05 20:44:46
Entropy 0
MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍

MAINICON

Type RT_GROUP_ICON
Language German - Austria
Codepage UNKNOWN
Size 0x14
TimeDateStamp 2004-Sep-05 20:44:46
Entropy 2.16096
Detected Filetype Icon file
MD5 42cf62b780813706e75fb9f2b2e8c258 🔍
SHA1 a022d5c1cfdd8aace0089f3e72f2eedd41bda464 🔍
SHA256 a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf 🔍
SHA3 0aafc8e3d8b6bde595537da4ffe0efc5fe53f01dafe336a2a5828b6a71283d3c 🔍

Version Info

TLS Callbacks

StartAddressOfRawData 0x44f284
EndAddressOfRawData 0x44f28c
AddressOfIndex 0x44f26c
AddressOfCallbacks 0x44f270
SizeOfZeroFill 0
Characteristics IMAGE_SCN_TYPE_REG
Callbacks (EMPTY)

Load Configuration

RICH Header

Errors

[!] Error: Resource PACKAGEINFO is bigger than the PE. Not trying to load it in memory. [!] Error: Resource PACKAGEINFO is bigger than the PE. Not trying to load it in memory. [!] Error: Resource PACKAGEINFO is bigger than the PE. Not trying to load it in memory. [!] Error: Resource PACKAGEINFO is bigger than the PE. Not trying to load it in memory. [!] Error: Resource PACKAGEINFO is bigger than the PE. Not trying to load it in memory. [*] Warning: Resource PACKAGEINFO is empty! [!] Error: Resource PACKAGEINFO is bigger than the PE. Not trying to load it in memory. [!] Error: Resource PACKAGEINFO is bigger than the PE. Not trying to load it in memory.
Leave a comment

No comments yet.