55780472c174a56bc424816b9ba59d6a2cb40157f38b4c9ab3c42de73701f9bb

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2001-Aug-10 19:20:12
Detected languages English - United States
CompanyName Microsoft Corporation
FileDescription Age of Empires II Expansion
FileVersion 00.07.26.0809
InternalName AGE2_X1
LegalCopyright Copyright © Microsoft Corp. 2001
OriginalFilename AGE2_X1.EXE
ProductName Age of Empires II Expansion
ProductVersion 2.1

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Microsoft Visual C++ v5.0/v6.0 (MFC)
Suspicious PEiD Signature: SafeDisc v4
SafeDisc 4
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE is possibly packed. Unusual section name found: THIS_COD
Unusual section name found: THIS_DAT
Unusual section name found: Inf32Dat
Unusual section name found: .patch
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • FindWindowA
Code injection capabilities (PowerLoader):
  • FindWindowA
  • GetWindowLongA
Can access the registry:
  • RegCreateKeyExA
  • RegSetValueExA
  • RegCloseKey
  • RegQueryValueExA
Possibly launches other programs:
  • WinExec
Can create temporary files:
  • GetTempPathA
  • CreateFileA
Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • GetAsyncKeyState
Enumerates local disk drives:
  • GetDriveTypeA
  • GetVolumeInformationA
Can take screenshots:
  • FindWindowA
  • GetDC
Reads the contents of the clipboard:
  • GetClipboardData
Suspicious The file contains overlay data. 4096 bytes of data starting at offset 0x2d4000.
Safe VirusTotal score: 0/70 (Scanned on 2026-06-11 18:42:16) All the AVs think this file is safe.

Hashes

MD5 fe3ac4feabf17a91134959b12866b7f6 🔍
SHA1 9aed66cbea1bf79dd4f9bdbc6889df4416e35e13 🔍
SHA256 55780472c174a56bc424816b9ba59d6a2cb40157f38b4c9ab3c42de73701f9bb 🔍
SHA3 1103d9fdbc65bff4b8aedf0d4e42fe4e98d381ceb5b78b5418c486deb8f0d4da 🔍
SSDeep 24576:sxgw/L8MixaHyb20FfG/bWl+mHoRdPNKLEQ8uH3P1BBpCpCD2rIRbBBplN2HHku:BiryjCil+dPNKt82MhrIb2nXD8pKbC 🔍
Imports Hash 123bac45e54331dfbdfcac9f7bac931f 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 9
TimeDateStamp 2001-Aug-10 19:20:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x274000
SizeOfInitializedData 0x5f000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00217522 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x235000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x3e6000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7927d54ad8c95b6c63c9eb8cc09a740d 🔍
SHA1 f1aac7a34ba1b62f232692e6d1d366391c318f88 🔍
SHA256 35ab82344d4820eea3bc26b3353228527146df05331e0e15ff49d6d5e0d01da5 🔍
SHA3 e8b5124c0a235c65dce02980fe7e1d71cf0b3017d83ea24f0fa0c400a56085e5 🔍
VirtualSize 0x227199
VirtualAddress 0x1000
SizeOfRawData 0x228000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.50982

THIS_COD

MD5 714283871818816d523fd026fbe742ac 🔍
SHA1 6fbdda326a3c60b73f6f3f9c7e15057fdbbb888a 🔍
SHA256 f7854bd880b01ec8fd9e7c4e9c46676890d0444aa39fd3ef27feeeed8bf26e85 🔍
SHA3 3b435746aaa29f07c8ab3410ec29be9e5d892ed2a3f027602b4d0972b011ca56 🔍
VirtualSize 0xb979
VirtualAddress 0x229000
SizeOfRawData 0xc000
PointerToRawData 0x229000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.9738

.rdata

MD5 b2d4ffd475120649adcf2dffc918a73d 🔍
SHA1 f03b625f0784cc11bd20e9dce0776720156550b5 🔍
SHA256 56a00e1c58084c13454bc379c2ff8c05df9309ebab7627b90a1eb3dcbab5cf5e 🔍
SHA3 83356ee8b52bbd3a9a607f69f2bc9cc77cf278e9c76db8cc1651a72a636c5edb 🔍
VirtualSize 0x35475
VirtualAddress 0x235000
SizeOfRawData 0x36000
PointerToRawData 0x235000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.43859

.data

MD5 778cc5028f34f5e2ccc931fddb1ebe9e 🔍
SHA1 5415266168e9b47f74697dd0e5c381a491fab513 🔍
SHA256 44e22d61e53fc96c600e7c02647cce839e89799391570377cd1bfbebc810e24c 🔍
SHA3 1c0e7fbeb06e22fb858bc5e951d0850212bc833c7a7e981c76db03dafecba715 🔍
VirtualSize 0x129168
VirtualAddress 0x26b000
SizeOfRawData 0x18000
PointerToRawData 0x26b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.19341

THIS_DAT

MD5 14dd83956e35597faff86a9d61f9f330 🔍
SHA1 8cf8ff0e73cf621b50994b0545a9415e3386fddc 🔍
SHA256 3610ac921029d7d18dae10765bec785be189ea3afa45679db32b21a581a06fe9 🔍
SHA3 e43b130da83d16e9e59d9a536bea54d87bb9e7eb519324f208ee02c76718a1dd 🔍
VirtualSize 0xbc
VirtualAddress 0x395000
SizeOfRawData 0x1000
PointerToRawData 0x283000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.00984534

Inf32Dat

MD5 ed35ed1c5d548c0a06e2591ccad6c4f8 🔍
SHA1 223b630dda0f3f0b36d8605c084ce457c0ab40a0 🔍
SHA256 93370bcfccf6329d058ec56871752f396196a667218ba2aeaadd1d49084f0c5b 🔍
SHA3 15eae1e2ee2019d84890b124a21ed398b55060922f856d585a38a9c79c2242ac 🔍
VirtualSize 0xad90
VirtualAddress 0x396000
SizeOfRawData 0xb000
PointerToRawData 0x284000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0011254

.rsrc

MD5 f2aeaaf485c01f692522b943c2bda060 🔍
SHA1 63cd518ca9ac428df6cbf69772774a265099a975 🔍
SHA256 ea7ae3a78171c7591a6a7348decbef91665131c81843de0f70af0821052ff234 🔍
SHA3 0279619212db8ff32fec8df00674b8b18cfeb7feb9ab0e41cc919cba0558baee 🔍
VirtualSize 0x3818
VirtualAddress 0x3a1000
SizeOfRawData 0x4000
PointerToRawData 0x28f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71181

.pdata

MD5 df77fb38a4a0c85db3a30b60bfa80971 🔍
SHA1 cf41152975aef859b5de1203a4330485e62ac83d 🔍
SHA256 f1f38d00b7523f5d1e2ced89722d1652e11a19e6ad1f8014876da1e533658def 🔍
SHA3 2e7184f11d5723d281cf7e7f9f1853f7ad6fa692306ee195a6eff31be3abcb6a 🔍
VirtualSize 0x1000
VirtualAddress 0x3a5000
SizeOfRawData 0x1000
PointerToRawData 0x293000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.176498

.patch

MD5 d4348474ebff128b2914a1052d9ae075 🔍
SHA1 9ed7687cc53576fd0e2dbb450adc3fc110b6639b 🔍
SHA256 68a8a01e86997cbcae1672e1e756a481c55f56c40d51c780d5c5ab57395e69fd 🔍
SHA3 fdcfc66acd44e09abb349e58f8e554a8974fc2687b649917fa168b65336284ba 🔍
VirtualSize 0x40000
VirtualAddress 0x3a6000
SizeOfRawData 0x40000
PointerToRawData 0x294000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 3.13398

Imports

VERSION.dll GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
MSVFW32.dll ICInfo
MCIWndCreateA
WINMM.dll mixerGetControlDetailsA
timeGetTime
mixerSetControlDetails
mixerGetLineControlsA
timeEndPeriod
mciGetErrorStringA
mixerClose
timeBeginPeriod
mixerOpen
mciSendCommandA
mixerGetNumDevs
mixerGetLineInfoA
KERNEL32.dll GetProcAddress
GetVersionExA
SetEndOfFile
MapViewOfFile
GetDiskFreeSpaceA
CreateFileMappingA
UnmapViewOfFile
GetTempFileNameA
VirtualFree
ReleaseSemaphore
SetThreadPriority
SetPriorityClass
GetPriorityClass
GetThreadPriority
WaitForSingleObject
CreateSemaphoreA
GetCurrentProcess
GetCurrentThread
IsDBCSLeadByte
GlobalUnlock
GlobalLock
GlobalMemoryStatus
FreeLibrary
GetTempPathA
GetFileAttributesA
CreateDirectoryA
SetLastError
GetFileSize
SetFilePointer
DeleteFileA
GetACP
FindResourceA
GlobalHandle
_lclose
_hread
GlobalReAlloc
OpenFile
_lread
_llseek
FindNextFileA
GetCurrentDirectoryA
MulDiv
ReleaseMutex
CreateMutexA
UnhandledExceptionFilter
FreeEnvironmentStringsA
WriteFile
FindFirstFileA
FindClose
GlobalAlloc
ReadFile
GlobalFree
CompareStringA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringW
WinExec
OutputDebugStringA
GetModuleFileNameA
GetDriveTypeA
GetSystemTime
CreateFileA
CloseHandle
GetTimeFormatA
GetVolumeInformationA
GetDateFormatA
LoadLibraryA
IsBadWritePtr
VirtualAlloc
HeapReAlloc
SetHandleCount
TerminateProcess
WideCharToMultiByte
GetCPInfo
GetStdHandle
SetStdHandle
GetModuleHandleA
GetOEMCP
HeapCreate
MultiByteToWideChar
LCMapStringA
LCMapStringW
RaiseException
HeapSize
GetStringTypeA
GetStringTypeW
LockResource
LoadResource
GetLastError
GetLocalTime
GetTimeZoneInformation
FileTimeToLocalFileTime
FileTimeToSystemTime
RtlUnwind
HeapFree
HeapAlloc
GetFileType
SetEnvironmentVariableA
SetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
USER32.dll PostQuitMessage
GetCapture
TranslateMessage
SystemParametersInfoA
GetWindowThreadProcessId
GetSysColor
SetSysColors
DrawTextExA
FillRect
UpdateWindow
GetSystemMetrics
KillTimer
GetFocus
SetTimer
SetWindowTextA
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
MessageBeep
FindWindowA
GetCaretBlinkTime
SetRect
DrawTextA
GetKeyNameTextA
MapVirtualKeyA
GetParent
DefWindowProcA
ReleaseDC
ShowWindow
SetFocus
LoadCursorA
CallWindowProcA
SendMessageA
GetWindowLongA
SetWindowLongA
GetClientRect
MoveWindow
InvalidateRect
SetCursor
SetClassLongA
MessageBoxA
CreateWindowExA
CharUpperA
DestroyWindow
IsWindow
SetCursorPos
GetKeyState
ClientToScreen
ScreenToClient
GetKeyboardState
GetForegroundWindow
GetWindowRect
GetCursorPos
PostMessageA
GetUpdateRect
SetForegroundWindow
GetLastActivePopup
BringWindowToTop
LoadIconA
RegisterClassA
GetMessageA
GetActiveWindow
ClipCursor
GetAsyncKeyState
SetWindowPos
LoadStringA
ReleaseCapture
SetCapture
ValidateRect
PeekMessageA
DispatchMessageA
wsprintfA
GetDC
IsIconic
GetWindowTextA
GDI32.dll DeleteObject
GetStockObject
GetDeviceCaps
TextOutA
SetTextColor
SetBkMode
SelectObject
GetNearestPaletteIndex
CreateRectRgn
SetTextAlign
LineTo
SelectClipRgn
GetPaletteEntries
SetBkColor
MoveToEx
GetTextMetricsA
SetPaletteEntries
GetTextExtentPoint32A
CreateICA
RealizePalette
DeleteDC
CreatePalette
SelectPalette
ResizePalette
GetSystemPaletteEntries
CreatePen
GetObjectA
CreateFontIndirectA
DPLAYX.dll #1
#4
#2
DSOUND.dll #1
DDRAW.dll DirectDrawCreate
IMM32.dll ImmReleaseContext
ImmGetDefaultIMEWnd
ImmSetOpenStatus
ImmNotifyIME
ImmGetContext
ImmGetOpenStatus
ImmAssociateContext
ADVAPI32.dll RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
ole32.dll CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize
WSOCK32.dll gethostname
WSAStartup
gethostbyname
WSACleanup

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.01118
MD5 fd9d70d6db0e32712d8d492f65c45d56 🔍
SHA1 f940a13016f34bdab49d2c2e08fafe43206e1991 🔍
SHA256 7937f42189dcbd825f7f22b6ab8c82eb9569d71238c12f3f5113b67b57a86819 🔍
SHA3 3b78a937877bb1ecf60f1c27034161147126f7ba015f9ee0a8b0b51e5914eea6 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37803
MD5 3380cf42c720c274d07c999d239d0e06 🔍
SHA1 249156b4bcd4155feedb2e4a063f6c9e57edecbb 🔍
SHA256 62cf7f1b96aa9c7f0080d8006bfc68aade315dd5305a787561b75999cf98955b 🔍
SHA3 3a83274d826a21713c64b773fb67008eeb72fde8a428771083a454ef57ff6bf5 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.65883
MD5 c96a2221238919bbb2116ad312ec25f9 🔍
SHA1 5426673c76eb664dd0132669df1a94d776e050da 🔍
SHA256 9a32fe676a6b2f0ece348b4497e8c5244ae5d5e8da2ca6f13229aaaeed6867d6 🔍
SHA3 71cf0f5c6f09a3ac92e7763e0bf623dacfbba7d63b96bdbfe8dde4d156e1410a 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.77095
MD5 7f7cae24b249e356b2871c0f97c08cca 🔍
SHA1 259676771443585cd5deab7e6c832a984546e20b 🔍
SHA256 68818403f434f0aa5a0ee1982f20f2ae5bbc9124289785fcf5ff20099966baa9 🔍
SHA3 a28998984ba45768e1b1d429c8f7c290b777751541e597445b1db198873099d8 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.69513
MD5 75b64449370f8fea3644d4295de5de2f 🔍
SHA1 39e9d50680fc54ed12a0ff7e26f318832d51d914 🔍
SHA256 9f9853f68558c0e47303a39a834fbf34193f520597ea53d4fa5dd12fcca7b753 🔍
SHA3 eec82c606baf6e3a4b05319cf3e6f14224063a8afebd5a5afbae32eab8064bbc 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1628
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.20703
MD5 a52968f48b5afa6d35405a465320c1f7 🔍
SHA1 0dd5f081790378b94e94844778ce3dd9d36d9219 🔍
SHA256 f2eb55b02a3a175c857e08405f055055dd372e20f4fb9506c1cfcf2bd1cf598c 🔍
SHA3 3c55722e47e418ec595507612a0d09510967914e4df15ab5a7894b2abe4c66e4 🔍

APPICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8973
Detected Filetype Icon file
MD5 6a060fdc177aa059e18207a2d38e18be 🔍
SHA1 cab9f0f1fee4a98f9038b8b2eab4fc27bfde95a4 🔍
SHA256 5deb499ba496389cfdb3c1d0f1a79c54170126e35aa7b24de44a83b781be9c9b 🔍
SHA3 8568663ab9b3ebeb31c15508c10260916ad4f61fca029daefca3363da55aeb14 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x320
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.47232
MD5 ce5b674470c35869cb4838c8b71eb786 🔍
SHA1 3c3762c824e95cb6b652349572b2bf97fd77ec6b 🔍
SHA256 483b68dbb5bec17cd0c3e67b8a51e45911042c1fdfd48dadae1743e48c9dcb70 🔍
SHA3 b62474acb0073cec82a77f6a21ec5f8118a6e81dd2e228ddaede7f1d4b16035f 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.7.26.809
ProductVersion 2.1.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Microsoft Corporation
FileDescription Age of Empires II Expansion
FileVersion (#2) 00.07.26.0809
InternalName AGE2_X1
LegalCopyright Copyright © Microsoft Corp. 2001
OriginalFilename AGE2_X1.EXE
ProductName Age of Empires II Expansion
ProductVersion (#2) 2.1
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xfa7e0a70
Unmarked objects 0
12 (7291) 11
14 (7299) 33
C objects (VS98 build 8168) 153
C++ objects (VS98 build 8168) 16
Total imports 275
19 (8034) 32
C objects (VC++ 6.0 SP5 imp/exp build 8447) 2
C++ objects (VC++ 6.0 SP5 imp/exp build 8447) 304
Unmarked objects (#2) 20
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

Leave a comment

No comments yet.