6e86e2f20e22665b4c79f2335ca7b7ed28142d619c5a5d920d71f26d56a68454

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2012-Dec-30 08:49:49
Detected languages Chinese - PRC
CompanyName Beijing Zhike Online
FileDescription 稻壳阅读器
FileVersion 2.10.10
LegalCopyright Copyright 2016-2020 Beijing Zhike Online
OriginalFilename DocBox.exe
ProductName 稻壳阅读器
ProductVersion 2.10.10

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • CheckTokenMembership
 Enumerates local disk drives:
  • GetDriveTypeW
 Can take screenshots:
  • CreateCompatibleDC
  • GetDC
Suspicious The file contains overlay data. 3340870 bytes of data starting at offset 0x28800.
The overlay data has an entropy of 7.99991 and is possibly compressed or encrypted.
Overlay data amounts for 95.2695% of the executable.
Malicious VirusTotal score: 7/70 (Scanned on 2026-10-04 09:22:55) APEX: Malicious
Antiy-AVL: Trojan/Win32.Cosmu
ClamAV: Win.Virus.Pioneer-10025604-0
CrowdStrike: win/malicious_confidence_60% (D)
Cylance: Unsafe
Malwarebytes: Malware.Heuristic.2126
McAfeeD: ti!6E86E2F20E22

Hashes

MD5 fd5d25a3d5dd6f70c6f1af4dc3be8332 🔍
SHA1 bce44b8218e866b757fc5a4f498ad322bcf19b47 🔍
SHA256 6e86e2f20e22665b4c79f2335ca7b7ed28142d619c5a5d920d71f26d56a68454 🔍
SHA3 eaf53e4ac472b63d474bc64d1ba04de153b0a7424e92c0c8f584f228dc744a99 🔍
SSDeep 98304:VLGCJQUM7xMXQq1DuBlojHsluDq8DiztIgxQtOAsGM:VLskQ2Dylu1izthQtE 🔍
Imports Hash ce986e6f173ce1468aeef6f8637babcc 🔍

DOS Header

e_magic MZ
e_cblp 0x60
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x60

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2012-Dec-30 08:49:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 8.0
SizeOfCode 0x13200
SizeOfInitializedData 0x15400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001382F (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x15000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x2e000
SizeOfHeaders 0x1000
Checksum 0x364e46
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a86014994324ad6f47bddf386fd89176 🔍
SHA1 cb19091db06314b3eb60e9204fde0e2f2a34fe25 🔍
SHA256 be8647b1941418f395f6c70985bd99c4992ddc94c06ab4183b28599acd7bf5c1 🔍
SHA3 b039aa016ef598e047373ae57927ff1026585bf10784f62b2a79abb1bd1ba546 🔍
VirtualSize 0x130f0
VirtualAddress 0x1000
SizeOfRawData 0x13200
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.61441

.rdata

MD5 35777f2b015ddedada5adf2353c5807e 🔍
SHA1 aa5582c89b7be6e54bee241ece6ec7f27ef52f08 🔍
SHA256 a5b38c3f387d125f6f1172d129943d7b69bda9e83a9f1b7c8de91dec3632de2b 🔍
SHA3 4fb2d3cf5d3353205e2509d3ba0798fbb0ecf6578bf1e7d077b59991846488ef 🔍
VirtualSize 0x3560
VirtualAddress 0x15000
SizeOfRawData 0x3600
PointerToRawData 0x13400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.12875

.data

MD5 4c129856aeef51c872b4a2f6db01e9bd 🔍
SHA1 b1dabf1566d6c3a20ff92b636b0763be11564630 🔍
SHA256 082e84a7688040d79ce5935ba26f1d77bef5931ba10df00657bd939fa4c21a96 🔍
SHA3 9a9c31ad5effbdae89797baf248458f77e1bfde9ee872f2009a5b3138d909c8b 🔍
VirtualSize 0x29ec
VirtualAddress 0x19000
SizeOfRawData 0x800
PointerToRawData 0x16a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.81262

.rsrc

MD5 29ed43575856db1ec5c2ae254ccfcfc2 🔍
SHA1 6303a25228775bb07c76e1340c8439f8408dcef4 🔍
SHA256 97de1fff844d1bc6e924f5d12f3abd5f44fa412694e428325cfa77ede78fd6b9 🔍
SHA3 559946c66decc7065917b2f497c5191eed2bc2e1f33c93a50f8c176ec1ccd955 🔍
VirtualSize 0x11547
VirtualAddress 0x1c000
SizeOfRawData 0x11600
PointerToRawData 0x17200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.33759

Imports

KERNEL32.DLL SetFileTime
SetEndOfFile
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleA
LeaveCriticalSection
WaitForMultipleObjects
ReadFile
SetFilePointer
GetFileSize
FormatMessageW
lstrcpyW
LocalFree
IsBadReadPtr
GetSystemDirectoryW
GetCurrentThreadId
SuspendThread
TerminateThread
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
GetVersionExW
GetModuleFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
SetCurrentDirectoryW
GetDriveTypeW
CreateFileW
GetCommandLineW
GetStartupInfoW
CreateProcessW
CreateJobObjectW
ResumeThread
AssignProcessToJobObject
CreateIoCompletionPort
SetInformationJobObject
GetQueuedCompletionStatus
GetExitCodeProcess
CloseHandle
SetEnvironmentVariableW
GetTempPathW
GetSystemTimeAsFileTime
lstrlenW
CompareFileTime
SetThreadLocale
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
ExpandEnvironmentStringsW
WideCharToMultiByte
VirtualAlloc
GlobalMemoryStatusEx
lstrcmpW
GetEnvironmentVariableW
lstrcmpiW
lstrlenA
GetLocaleInfoW
MultiByteToWideChar
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetSystemDefaultLCID
lstrcmpiA
GlobalAlloc
GlobalFree
MulDiv
FindResourceExA
SizeofResource
LoadResource
LockResource
LoadLibraryA
ExitProcess
lstrcatW
GetDiskFreeSpaceExW
SetFileAttributesW
SetLastError
Sleep
GetExitCodeThread
WaitForSingleObject
CreateThread
GetLastError
SystemTimeToFileTime
GetLocalTime
GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
GetStartupInfoA
ADVAPI32.dll FreeSid
AllocateAndInitializeSid
CheckTokenMembership
COMCTL32.dll #17
GDI32.dll CreateCompatibleDC
CreateFontIndirectW
DeleteObject
DeleteDC
GetCurrentObject
StretchBlt
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW
MSVCRT.dll ??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
free
memcpy
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
memset
_wcsnicmp
strncmp
wcsncmp
malloc
memmove
_wtol
_purecall
ole32.dll CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
OLEAUT32.dll SysAllocString
VariantClear
OleLoadPicture
SHELL32.dll SHGetSpecialFolderPathW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteExW
USER32.dll GetMenu
SetWindowPos
GetWindowDC
ReleaseDC
CopyImage
GetKeyState
GetWindowRect
ScreenToClient
GetWindowLongW
SetTimer
GetMessageW
DispatchMessageW
KillTimer
DestroyWindow
EndDialog
SendMessageW
wsprintfW
GetClassNameA
GetWindowTextW
GetWindowTextLengthW
GetSysColor
wsprintfA
SetWindowTextW
CreateWindowExW
GetDlgItem
GetClientRect
SetWindowLongW
UnhookWindowsHookEx
SetFocus
GetSystemMetrics
SystemParametersInfoW
ShowWindow
DrawTextW
GetDC
ClientToScreen
GetWindow
DialogBoxIndirectParamW
DrawIconEx
CallWindowProcW
DefWindowProcW
CallNextHookEx
PtInRect
SetWindowsHookExW
LoadImageW
LoadIconW
MessageBeep
EnableWindow
IsWindow
EnableMenuItem
GetSystemMenu
wvsprintfW
CharUpperW
MessageBoxA
GetParent

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.00635
MD5 55fe088fd676c6360759fa2f49445b2b 🔍
SHA1 1a49d5068e3d370eab250408cbd106059bc61592 🔍
SHA256 4ab3b98765109b08ce7dd0c93734a7846982dc1eff0ae8b5034e8ebd34987859 🔍
SHA3 c1b9d02ca4b7c6efafec226f09cac659c3f20395cbc2748a06911e2fe507e2c9 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.61245
MD5 77e637c0b5fcc200493ddc13878d8629 🔍
SHA1 0ab0ee0b9f804a17124e7f79a345c9bfe9c252e3 🔍
SHA256 0c0f9a0df9a7a6fb10abef4728549a56ef2c436ba814557162fd814ba29c57cf 🔍
SHA3 49f823c9e81cccca1afabd90c94e0c3cc6b9a3ffa92ed25b4c58011ab7ba5ea4 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.14054
MD5 698c736ea81f1978c04e4f208da86813 🔍
SHA1 2e447c46958cfc2891abefc0d2cc10aa97a7e997 🔍
SHA256 c7487cd1c7685ddfd68c8a3bb6c395319b227b166fb645c3d69042131eaf210c 🔍
SHA3 c532885e459702047b3e273fb4ca928d533808e06d252fa84ea1a5141639ca42 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.6834
MD5 3a6125b3381eb65e5c1c265db7f09fc1 🔍
SHA1 00a92a76c17ed4e139453ff01b5866f1fc25df3d 🔍
SHA256 11416789cfa10dd6b18fa467381cfa390f16b5e53d8cde49064efff378d94a67 🔍
SHA3 04f7795fb1d2ad83abed2ccf30fb14b26d72ee230df8d3d85fa9a2a290a054f0 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.58104
MD5 d4c7d9f431f717b55c3fd9be9693d4a4 🔍
SHA1 f43a96ea4a3661c62b41c65fe6fb20e489b1c56d 🔍
SHA256 0067fe2a4d0e201399e6140d35b84d94663279bb3cecfd8b3042d6604750ade7 🔍
SHA3 0dffcbb26a29f4b213cf06540e0fc154fdfcbc3a1e596fc02bf8d89a87f215a0 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x40f4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.92936
Detected Filetype PNG graphic file
MD5 2ae94b2f56abe7600969cfb5be441ecc 🔍
SHA1 e2a7401783996d98c4bc582d5147c5539c545550 🔍
SHA256 5b950b7af264698f1758bf5fd212eac9df2cf56b7a91cd211493f2c1c5b74224 🔍
SHA3 4e6a9edf983f9423128a5446cc6d52ace71026ccccf11e14158bfda44e8d22de 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.638
MD5 3c498ab770b165e9ec1a7bc50e174fa3 🔍
SHA1 ee0e16142edfdb21528e404e5152fcebf98aed1e 🔍
SHA256 d64c155a0ce70211f5e28e2a3b89e514b4ef6f5dab3a05ec11c281260e3c6362 🔍
SHA3 9eb3b7d60a731eb7afe93fed84c8eee079a53caf4be4d4be657397c5db226b26 🔍

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.80585
MD5 12f9183651f2cb050f30087d6849fced 🔍
SHA1 4b29868529eb77f4a46d09a3846375966e01c829 🔍
SHA256 87af93c7a473f55aae8e5ed35ec29484de5390cac27c649c50f22661f9eac19e 🔍
SHA3 5226baa2064f2da435d15d17698045265c38eaadef8e71703ca391159d3f3309 🔍

9

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x1a68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.97501
MD5 0264849dbf61fd5182fccaae7729ef1a 🔍
SHA1 76db81d431b67bcb0898a2ffbc881b78d6d074f8 🔍
SHA256 d32b8155301357857af9a1ec6ced45d9601ff69c7aacdd68f4c90d930762f609 🔍
SHA3 365151bc9b71b7c5366ab0598522f80233a9a8c862d440b96d3ed0a077f02190 🔍

10

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.23212
MD5 c3901c82b998246c42e3020cb3bd7fef 🔍
SHA1 4aea49df26ac5a4e71881f4955d2a37d655235eb 🔍
SHA256 bf9498d33533674b12efa718edc58da378a723ecd6cb5d71d8904571128bf6fb 🔍
SHA3 17c819653f2bc638a3d372138fcf62e805465db260a15604a8ca078ac789d2f6 🔍

11

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.54288
MD5 70f1b9e0142fde2595fb0395834dd9d8 🔍
SHA1 03feccd1b7aa1ed90595a86fd2298ace44595d36 🔍
SHA256 b90bf19263d424c57b0e0674ed14fa7581fd26c8b59632672723ea46b11098d7 🔍
SHA3 0c56636c78607ff8aebe011096ef152523ee7a0267a257841fee7822f51df5d3 🔍

12

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x6b8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.67792
MD5 0c347d563f07b37f610bead85159f5fa 🔍
SHA1 3bd6c2963348430250600444ae0da5e85bb14fb1 🔍
SHA256 29aa3e8df140028d8f1ac7ba9bef728b32da564091d8777beb755ce0ece5e192 🔍
SHA3 f72f4a8f16c98604041a6325e8ea0d186f6194a910748ec4fd0ad8260a5be42f 🔍

13

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91527
MD5 a3a522e825746f1fb8dc972ad2d30f1d 🔍
SHA1 0294b3ad0fafb53149c44f91e9e4cd2eaf9b5cde 🔍
SHA256 15d27868eb9f5a64300ee687cc6ffa38cb4dadaa27654f919fae92dffacb3710 🔍
SHA3 4e1ed2e9cf9a89dae3c83f0b5564b9d9a53d0706f242e7cee8feaf3619a9023b 🔍

1 (#2)

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xbc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10199
Detected Filetype Icon file
MD5 18d575c3f28cb68abbfb6ff399b14145 🔍
SHA1 6a407c28216b0f68bda2879a554e082c1327a143 🔍
SHA256 5565415d68bee3194795116fab36135d53321c7b608f6afdff3f3061884ed5e4 🔍
SHA3 b373e63c7d4bbc1a08301fd643f117da103ee7ba3966bbbf6147610f9d122ddf 🔍

1 (#3)

Type RT_VERSION
Language Chinese - PRC
Codepage UNKNOWN
Size 0x2a4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4679
MD5 5fdeb673f644c9db69bcc076604ae208 🔍
SHA1 b96b02a16758e371ab50879a5aa3fc4206094005 🔍
SHA256 79ada4507b652da4c3ba19131d354e7cadf01c82e3fa2de6bafb8b772ca473e3 🔍
SHA3 552ad4f16c437eaa786da8f31355f3ed8962b53e5953862a0bc275888220d1b8 🔍

1 (#4)

Type RT_MANIFEST
Language Chinese - PRC
Codepage UNKNOWN
Size 0x533
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.92402
MD5 35fe862f70332c4a895b4b717c842f24 🔍
SHA1 376136aa1f51107b824e44f4a9afb6da418101c2 🔍
SHA256 6decd44feb4a7f3ef755795279c5cccd1b9fd6680bee90c2d485e62262ce4529 🔍
SHA3 89f959002dacba4917861dde2f7075d2ca1593b6969c10a36e8ce4123baf494a 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName Beijing Zhike Online
FileDescription 稻壳阅读器
FileVersion (#2) 2.10.10
LegalCopyright Copyright 2016-2020 Beijing Zhike Online
OriginalFilename DocBox.exe
ProductName 稻壳阅读器
ProductVersion (#2) 2.10.10
Resource LangID Chinese - PRC

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.