Manalyzer :: 652481c95e3db9e52eb6bdd62c981d377037b9850a1cb3f3714d128922802380

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2005-Oct-24 01:16:38
Debug artifacts	f:\mw\Speed\Pc\Install\safemode_inst\safemode_inst\Release\safemode_inst.pdb

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 7.0` `Microsoft Visual C++ 7.1` `Microsoft Visual C++ 6.0 - 8.0` `Microsoft Visual C++ v7.0` `Microsoft Visual C++ v7.1 EXE`
Suspicious	The PE contains functions most legitimate programs don't use.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc`
Suspicious	VirusTotal score: 1/70 (Scanned on 2026-07-30 19:24:31)	`Jiangmin: Trojan/Generic.qvvv`

Hashes

MD5	`ab2e0ac3a31f92980354423fb6ee588b`
SHA1	`280243efa85e72af0cf6e2d91ac8d94fcb038642`
SHA256	`652481c95e3db9e52eb6bdd62c981d377037b9850a1cb3f3714d128922802380`
SHA3	`2aeb3615c15883880419ae455eb775132805c45aaf2fea648ffa526c04befe74`
SSDeep	`384:0lYmDHZyls0/AArROxky2ZchCcvyyRrwrsYpYBRMbr+mZutMZHd8S/UvbEGGylj:05I/As1yMQVwrpYAOCZ99MvbzNjPj1l`
Imports Hash	`5f6b222674cf165a23760662adc9c695`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xe0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2005-Oct-24 01:16:38
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`7.0`
SizeOfCode	`0x6000`
SizeOfInitializedData	`0x4000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00001706 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x7000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0xb000`
SizeOfHeaders	`0x1000`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`943767919ff88cf946c8cd0c86d2eb3e`
SHA1	`ea633ea3757a166cd765b1b921f72f2b1d0bc619`
SHA256	`4fe2f8efd41fd67460f9182b7734f6c280caebaf69e814bfd9eb17151d21553b`
SHA3	`9a4ad50bef8ab7ef4792317a2b6ddfcc01a86fa7ce081de7a8e7cefc577580b8`
VirtualSize	`0x54e8`
VirtualAddress	`0x1000`
SizeOfRawData	`0x6000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.1632`

.rdata

MD5	`50c0d84acea32369f2c9bd41b23c4d7d`
SHA1	`ffee9fb592c536ecbe3aff703c0e180a8c2b96de`
SHA256	`4952495d7feb72a0135b93d4f388eebce039aa472b1e697aa354cf1b73d8574a`
SHA3	`9a04b1ed8b5d11daee1ffacb47ae22a3d0e8b7bb06bdde5a82b1c51805be2a85`
VirtualSize	`0x1528`
VirtualAddress	`0x7000`
SizeOfRawData	`0x2000`
PointerToRawData	`0x7000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.64155`

.data

MD5	`410cdcb36b803298e343166ec35c712b`
SHA1	`fb7b711fcb23a8bc164613f0b3fb81b70ac479a1`
SHA256	`64761876d3f25db022e7086441196d48bfe4268fc455de8ef633ceac930ecd83`
SHA3	`d996fdf2094c979b1af08fa1b6fb22dc814a117d3691c136ac6fbc9f28580007`
VirtualSize	`0x1c64`
VirtualAddress	`0x9000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x9000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`1.0017`

Imports

KERNEL32.dll	`MultiByteToWideChar` `LocalFree` `FormatMessageA` `VirtualProtect` `GetLocaleInfoA` `GetStringTypeW` `GetStringTypeA` `ExitProcess` `GetModuleHandleA` `GetCommandLineA` `GetVersionExA` `QueryPerformanceCounter` `GetTickCount` `GetCurrentThreadId` `GetCurrentProcessId` `GetSystemTimeAsFileTime` `GetModuleFileNameA` `SetHandleCount` `GetStdHandle` `GetFileType` `GetStartupInfoA` `HeapAlloc` `GetProcAddress` `TerminateProcess` `GetCurrentProcess` `WriteFile` `UnhandledExceptionFilter` `FreeEnvironmentStringsA` `GetEnvironmentStrings` `FreeEnvironmentStringsW` `WideCharToMultiByte` `GetLastError` `GetEnvironmentStringsW` `HeapDestroy` `HeapCreate` `VirtualFree` `HeapFree` `LoadLibraryA` `RtlUnwind` `InterlockedExchange` `VirtualQuery` `VirtualAlloc` `HeapReAlloc` `FlushFileBuffers` `GetACP` `GetOEMCP` `GetCPInfo` `SetFilePointer` `CloseHandle` `HeapSize` `SetStdHandle` `LCMapStringA` `LCMapStringW` `GetSystemInfo`
ole32.dll	`CoUninitialize` `CoCreateInstance` `CoInitialize`

Delayed Imports

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2005-Oct-24 01:16:38
Version	`0.0`
SizeofData	`101`
AddressOfRawData	`0x7f78`
PointerToRawData	`0x7f78`
Referenced File	f:\mw\Speed\Pc\Install\safemode_inst\safemode_inst\Release\safemode_inst.pdb

TLS Callbacks

Load Configuration

Size	`0x48`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x409044`
SEHandlerTable	`0x407fe0`
SEHandlerCount	`2`

RICH Header

XOR Key	`0x965c87ad`
Unmarked objects	`0`
C objects (VS2003 (.NET) build 3077)	`57`
ASM objects (VS2003 (.NET) build 3077)	`12`
C objects (2179)	`1`
C objects (9178)	`1`
Imports (2179)	`5`
Total imports	`58`
C++ objects (VS2003 (.NET) build 3077)	`4`
Linker (VS2003 (.NET) build 3077)	`1`

Errors

Leave a comment

No comments yet.