Manalyze report for 77bd1c21da18b99fc55be247f27106d2642a343950dca99ed786350bd313161c

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2025-May-14 16:13:39
Detected languages	English - United States
CompanyName	MEDCO
ProductName	tas
FileVersion	`1.00`
ProductVersion	`1.00`
InternalName	tas404
OriginalFilename	tas404.exe

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual Basic v5.0/v6.0` `Microsoft Visual Basic v5.0 - v6.0`
Suspicious	PEiD Signature:	`HQR data file`
Info	Interesting strings found in the binary:	Contains domain names: http://medcotas.com http://medcotas.net http://test.medcotas.co.uk http://test.medcotas.co.uk/index.php?option http://www.medcotas.com http://www.medcotas.com/barood/BanyanKeysSerialNumbers.xml http://www.medcotas.com/barood/Barood64bits.xml http://www.medcotas.com/barood/BaroodUSBSerialNumbers.xml http://www.medcotas.com/barood/IndexOfTAS.xml http://www.medcotas.com/tas/tas_latest/ http://www.medcotas.com/updates.ini http://www.medcotas.net http://www.medcotas.net/RegistrationPage.aspx? http://www.medcotas.net/arabi/serialcodeactivation.aspx? http://www.medcotas.net/arabi/serialcodeactivationdelete.aspx? medcotas.co.uk medcotas.com medcotas.net test.medcotas.co.uk www.medcotas.com www.medcotas.net
Safe	VirusTotal score: 0/72 (Scanned on 2026-01-31 15:59:24)	`All the AVs think this file is safe.`

Hashes

MD5	`2587e08685425dca186381db95d08d70` 🔍
SHA1	`22e9fc785ab3085e21d3c6e5894b8b63fe7f2a77` 🔍
SHA256	`77bd1c21da18b99fc55be247f27106d2642a343950dca99ed786350bd313161c` 🔍
SHA3	`591c849a5bb81499985061d6ce15fc22f2a83d98c3b96c338aa5f56141ff1d4c` 🔍
SSDeep	`393216:Hi895kUnsSiOKajLTBhmIZbRGBDpc6OIcVNXG8NuUUE6OxxKSlMx+XW4dCUDFcc:CeiOKajLTBhmIZbRGBDpc6OIcVNXG8N` 🔍
Imports Hash	`5d2ed8dff085d8a0431be88966fa3329` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xc0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2025-May-14 16:13:39
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0xe57000`
SizeOfInitializedData	`0x3b000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0001A960 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0xe58000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`4.0`
ImageVersion	`1.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0xe93000`
SizeOfHeaders	`0x1000`
Checksum	`0xe672a8`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`9d1db62ddfbcd9f61323684a39925a97 🔍`
SHA1	`4113a0b27e5ba4c711d27b0856d998f9e2d0bf9c 🔍`
SHA256	`fa32e0d43be29cc47dbd06840cfe63c7b7450e067af6ac0b73cfe9e56a4911db 🔍`
SHA3	`ebc43113c315550b21bfff1d09899d874c17640d5289e208c8c088ebc9303a76 🔍`
VirtualSize	`0xe56aa4`
VirtualAddress	`0x1000`
SizeOfRawData	`0xe57000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.11063`

.data

MD5	`620f0b67a91f7f74151bc5be745b7110 🔍`
SHA1	`1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 🔍`
SHA256	`ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7 🔍`
SHA3	`a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563 🔍`
VirtualSize	`0x39c3c`
VirtualAddress	`0xe58000`
SizeOfRawData	`0x1000`
PointerToRawData	`0xe58000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`17b7ca580381e135d5909dc9558a2f8a 🔍`
SHA1	`6e1dab60b8bd739c46ab4a81632ad2fdc4da310e 🔍`
SHA256	`012b70ec698e301475f90b116197bafa828ac3aa1dd96ba00f9f331b2c3fe265 🔍`
SHA3	`353423bae2e033b4650cf9e9fd7f7688bd700d0e670c483bd4967b32da52249b 🔍`
VirtualSize	`0xba8`
VirtualAddress	`0xe92000`
SizeOfRawData	`0x1000`
PointerToRawData	`0xe59000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.69553`

Imports

MSVBVM60.DLL	`#582` `__vbaVarSub` `__vbaVarTstGt` `__vbaStrI2` `#690` `#583` `__vbaR8ForNextCheck` `#691` `#584` `_CIcos` `_adj_fptan` `__vbaStrI4` `#585` `__vbaVarMove` `__vbaRedimPreserveVar` `#586` `__vbaVarVargNofree` `__vbaAryMove` `__vbaFreeVar` `#587` `__vbaLineInputStr` `__vbaLenBstr` `__vbaStrVarMove` `__vbaLateIdCall` `#589` `__vbaEnd` `__vbaFreeVarList` `_adj_fdiv_m64` `__vbaFpCDblR8` `__vbaVarIndexStore` `__vbaLineInputVar` `__vbaFreeObjList` `__vbaR8Sgn` `#516` `__vbaStrErrVarCopy` `#517` `_adj_fprem1` `__vbaRecAnsiToUni` `#518` `#626` `__vbaCopyBytes` `__vbaResume` `__vbaForEachCollAd` `__vbaStrCat` `__vbaVarCmpNe` `#553` `__vbaLsetFixstr` `#660` `__vbaSetSystemError` `__vbaStrDate` `__vbaRecDestruct` `#662` `__vbaHresultCheckObj` `__vbaLenVar` `#558` `__vbaVargVarCopy` `_adj_fdiv_m32` `__vbaAryVar` `__vbaVarTstLe` `__vbaAryDestruct` `__vbaVarCmpGe` `#591` `__vbaVarIndexLoadRefLock` `__vbaLateMemSt` `#592` `__vbaStrBool` `__vbaBoolStr` `#593` `__vbaForEachCollObj` `__vbaVarPow` `__vbaExitProc` `__vbaVarForInit` `#300` `#594` `#301` `__vbaObjSet` `#595` `__vbaOnError` `#302` `#596` `_adj_fdiv_m16i` `#303` `#597` `__vbaObjSetAddref` `_adj_fdivr_m16i` `__vbaVarIndexLoad` `#598` `#305` `#599` `__vbaFpR4` `#306` `__vbaStrFixstr` `#520` `__vbaBoolVar` `#307` `#308` `#309` `__vbaRefVarAry` `__vbaVarTstLt` `__vbaFpR8` `__vbaBoolVarNull` `_CIsin` `#631` `__vbaErase` `__vbaVarZero` `__vbaNextEachCollObj` `#632` `__vbaVarCmpGt` `__vbaVargVarMove` `__vbaChkstk` `#526` `__vbaCyVar` `__vbaFileClose` `EVENT_SINK_AddRef` `#527` `#528` `__vbaGenerateBoundsError` `__vbaVarAbs` `__vbaGet3` `__vbaExitEachColl` `#529` `__vbaStrCmp` `#637` `__vbaPutOwner3` `__vbaAryConstruct2` `__vbaVarTstEq` `#560` `__vbaObjVar` `__vbaPrintObj` `__vbaI2I4` `#561` `DllFunctionCall` `__vbaVarLateMemSt` `__vbaVarOr` `__vbaFpUI1` `__vbaCastObjVar` `__vbaLbound` `__vbaRedimPreserve` `_adj_fpatan` `__vbaR4Var` `__vbaR4Cy` `__vbaLateIdCallLd` `__vbaStrR8` `__vbaRedim` `__vbaUI1ErrVar` `__vbaRecUniToAnsi` `EVENT_SINK_Release` `__vbaNew` `#600` `#601` `__vbaUI1I2` `_CIsqrt` `__vbaRedimVar` `__vbaObjIs` `__vbaLateIdCallSt` `__vbaVarAnd` `#311` `EVENT_SINK_QueryInterface` `__vbaStrUI1` `__vbaUI1I4` `__vbaVarMul` `__vbaExceptHandler` `#711` `#313` `__vbaStrToUnicode` `#605` `#712` `__vbaInputFile` `__vbaPrintFile` `#606` `__vbaDateStr` `_adj_fprem` `_adj_fdivr_m64` `__vbaLateIdStAd` `#607` `__vbaR8ErrVar` `__vbaI2Str` `__vbaVarDiv` `#608` `#530` `__vbaVargVarRef` `#716` `#531` `__vbaVarCmpLe` `__vbaFPException` `#717` `#532` `__vbaInStrVar` `__vbaUbound` `__vbaStrVarVal` `#534` `__vbaVarCat` `#535` `__vbaCheckType` `__vbaDateVar` `#536` `__vbaI2Var` `#644` `#537` `#538` `#645` `_CIlog` `__vbaErrorOverflow` `#647` `__vbaFileOpen` `__vbaVarLateMemCallLdRf` `__vbaVar2Vec` `#648` `__vbaInStr` `__vbaR8Str` `__vbaNew2` `#571` `__vbaVarInt` `_adj_fdiv_m32i` `#572` `_adj_fdivr_m32i` `#573` `__vbaVarSetObj` `__vbaStrCopy` `#681` `__vbaI4Str` `__vbaLateMemNamedCall` `__vbaVarNot` `__vbaVarCmpLt` `__vbaFreeStrList` `#576` `_adj_fdivr_m32` `#577` `__vbaPowerR8` `__vbaR8Var` `_adj_fdiv_r` `#578` `#685` `#100` `__vbaVarTstNe` `__vbaVarSetVar` `__vbaI4Var` `__vbaVarLateMemStAd` `#689` `__vbaVarCmpEq` `#610` `__vbaLateMemCall` `__vbaVarAdd` `__vbaAryLock` `__vbaStrComp` `__vbaStrToAnsi` `__vbaFreeVarg` `__vbaVarDup` `__vbaVerifyVarObj` `__vbaR4Sgn` `__vbaFpI2` `#614` `__vbaVarMod` `__vbaUnkVar` `__vbaVarLateMemCallLd` `__vbaFpI4` `#616` `__vbaVarTstGe` `__vbaVarCopy` `__vbaRecDestructAnsi` `__vbaLateMemCallLd` `__vbaVarSetObjAddref` `#617` `__vbaR8IntI2` `_CIatan` `__vbaAryCopy` `#540` `__vbaI2ErrVar` `#618` `__vbaStrMove` `__vbaCastObj` `__vbaR8IntI4` `__vbaStrVarCopy` `#619` `#542` `__vbaVarNeg` `#543` `#650` `_allmul` `#544` `#651` `__vbaLateIdSt` `__vbaLateMemCallSt` `#545` `#652` `_CItan` `__vbaNextEachCollAd` `#546` `__vbaUI1Var` `#547` `__vbaFPInt` `__vbaAryUnlock` `__vbaFpCSngR8` `__vbaVarForNext` `_CIexp` `#656` `__vbaI4ErrVar` `__vbaFreeObj` `__vbaRecAssign` `__vbaFreeStr` `#581`

Delayed Imports

30001

Type	`RT_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x8a8`
TimeDateStamp	2025-May-14 16:13:39
Entropy	`4.9586`
MD5	`e2eab157511c9f2f1b70a12637a4e32b 🔍`
SHA1	`4eb3c0310654ea05cf8a985e77ca25871cc533fc 🔍`
SHA256	`b29b41c07c9b2ec75671c5faabe84df4ca27f514f02a094e8f687854d8a6a90d 🔍`
SHA3	`ef09137eeb5f9c08300d114cd90be8ed480e0f0eeac440ec26744b05d3261467 🔍`

1

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	Unicode (UTF 16LE)
Size	`0x14`
TimeDateStamp	2025-May-14 16:13:39
Entropy	`2.22322`
Detected Filetype	Icon file
MD5	`4610e703b0622b2c9fec4ec01e9c9ecc 🔍`
SHA1	`1a395734ea2dbcb38430aadb6bf899d5c5e0b93a 🔍`
SHA256	`4b5b6cd2cee245f4389b889f8441491157870ddf1a9ec09c3fde3fca1657b220 🔍`
SHA3	`c545f87715aabfd3ba01bcac62b42f3758394fbfbd3f3d564fc7aaa285ed5ff1 🔍`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	Unicode (UTF 16LE)
Size	`0x1fc`
TimeDateStamp	2025-May-14 16:13:39
Entropy	`3.12735`
MD5	`7d7a50de00fa46309fe820deda6748c0 🔍`
SHA1	`9caec3979855b17f57fe2247b8797c2cfd73d2cd 🔍`
SHA256	`f75b81158ceac43455d3f5ed8aca16a02ffb0e95d269cade1412bf3aa266e770 🔍`
SHA3	`3022d7ca8a0906ece72ccb78de15c7b4affbbf94daa16ef2a8e4085b08c64adf 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	MEDCO
ProductName	tas
FileVersion (#2)	1.00
ProductVersion (#2)	1.00
InternalName	tas404
OriginalFilename	tas404.exe

Resource LangID	English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xc887f499`
Unmarked objects	`0`
14 (7299)	`1`
9 (8041)	`190`
13 (8140)	`1`

Errors

Leave a comment

No comments yet.