78200a20e58b68aeb0fbdd2eccb5a8eeeceb03e42ac53859ed166866c23f5c79
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1992-Jun-19 22:22:17 |
| Detected languages |
Russian - Russia
Ukrainian - Ukraine |
Plugin Output
| Suspicious | PEiD Signature: | UPX -> www.upx.sourceforge.net |
| Suspicious | The PE is possibly packed. |
Unusual section name found:
Section is both writable and executable. Section .rdata is both writable and executable. The PE only has 8 import(s). |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE header may have been manually modified. |
Resource LOGO is possibly compressed or encrypted.
Resource 4092 is possibly compressed or encrypted. Resource 4094 is possibly compressed or encrypted. Resource 4095 is possibly compressed or encrypted. Resource 4096 is possibly compressed or encrypted. Resource PACKAGEINFO is possibly compressed or encrypted. The resource timestamps differ from the PE header:
|
| Malicious | VirusTotal score: 40/64 (Scanned on 2026-09-16 04:41:27) |
ALYac:
Application.Generic.4000864
APEX: Malicious AhnLab-V3: Unwanted/Win32.Keygen.R4441 Antiy-AVL: HackTool/Win32.KeyGen Arcabit: Application.Generic.D3D0C60 BitDefender: Application.Generic.4000864 Bkav: W32.Common.EA6E6A10 CAT-QuickHeal: Trojan.Keygen CTX: exe.hacktool.keygen ClamAV: Win.Trojan.Tufik-18 CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe Cynet: Malicious (score: 100) DeepInstinct: MALICIOUS ESET-NOD32: Win32/Keygen.AO potentially unsafe application Elastic: malicious (high confidence) Emsisoft: Application.Generic.4000864 (B) Fortinet: Riskware/Adobesuite GData: Application.Generic.4000864 Gridinsoft: Malware.Win32.Gen.bot!se62747 Ikarus: Trojan.Crypt Lionic: Worm.Win32.Viking.lz9q Malwarebytes: Keygen.CrackTool.RiskWare.DDS McAfeeD: ti!78200A20E58B MicroWorld-eScan: Application.Generic.4000864 Microsoft: HackTool:Win32/Keygen!pz Paloalto: generic.ml SUPERAntiSpyware: Hack.Tool/Gen-Keygen Sangfor: Hacktool.Win32.Keygen.mt SentinelOne: Static AI - Malicious PE Sophos: Keygen (PUA) TACHYON: Backdoor/W32.MoSucker.59904 TrellixENS: Crack-Adobesuite VIPRE: Application.Generic.4000864 Varist: W32/Risk.MMCP-8298 ViRobot: Creative.Keygen.59904 VirIT: Backdoor.Win32.Generic.PVV Webroot: W32.Malware.gen Xcitium: Application.Win32.Hacktool.Keygen@133zf Yandex: Trojan.GenAsa!sfYSO2vrum0 |
Hashes
| MD5 | b824c5d7bea0d803440c19744c6543ef 🔍 |
|---|---|
| SHA1 | 30bb5342e08b1718d2ddb93b85f9335e3c590b06 🔍 |
| SHA256 | 78200a20e58b68aeb0fbdd2eccb5a8eeeceb03e42ac53859ed166866c23f5c79 🔍 |
| SHA3 | 024b782a18f2ba3c0b2f13467c41b7d1b7d708d3a7aeaf16a3f7b25fed821683 🔍 |
| SSDeep | 1536:X8GYgpVXkc3/RQJpxWOfOMD42mmT1jMeDT:XvX7WJpxWOfOMDb3iev 🔍 |
| Imports Hash | 042f854aa40eb5213ffd940a2e18951a 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0xe000 |
| SizeOfInitializedData | 0x1000 |
| SizeOfUninitializedData | 0x16000 |
| AddressOfEntryPoint | 0x00024E10 (Section: .rdata) |
| BaseOfCode | 0x17000 |
| BaseOfData | 0x25000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x26000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
Section_1
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0x16000 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
.rdata
| MD5 | 9c7714107750541de87d66e6e7b3f356 🔍 |
|---|---|
| SHA1 | 113ed08549c6fcfc46a2f362f9459a3230dcad0a 🔍 |
| SHA256 | 46db14857a2843942be4a823a3af7f9832b57ae36f766de7d832912674e3f6f8 🔍 |
| SHA3 | 015b347b5e7a3da666b2d40e0bb908388523c244b9b2dc675ad38d7118e15eac 🔍 |
| VirtualSize | 0xe000 |
| VirtualAddress | 0x17000 |
| SizeOfRawData | 0xe000 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 7.93148 |
.rsrc
| MD5 | 1ab7d13a3ae69e0f2ea41c3f75108bf4 🔍 |
|---|---|
| SHA1 | 72311be2e395e64f407505deef42d4266dde6ba0 🔍 |
| SHA256 | 3aa394e9d9cfc8de91718a4549867fa37863be589d5d7ed184b95e00484b11e1 🔍 |
| SHA3 | 5d5bb6199be2adc743cd5c81f4336824823d509fddb820f33d78ebefa739081f 🔍 |
| VirtualSize | 0x1000 |
| VirtualAddress | 0x25000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0xe200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 3.61532 |
Imports
| KERNEL32.DLL |
LoadLibraryA
GetProcAddress ExitProcess |
|---|---|
| advapi32.dll |
RegCloseKey
|
| gdi32.dll |
SetROP2
|
| msvcrt.dll |
memset
|
| oleaut32.dll |
SysFreeString
|
| user32.dll |
GetDC
|
Delayed Imports
LOGO
| Type |
RT_BITMAP
|
|---|---|
| Language | Ukrainian - Ukraine |
| Codepage | UNKNOWN |
| Size | 0x4500 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 7.91396 |
| MD5 | 3fdfa2b30b862789c93c37deb4b4e362 🔍 |
| SHA1 | 36c709ef2fb6ac8370dbf363cb21ff0acfe081c2 🔍 |
| SHA256 | 7f6bfd47ce0b0281fe80eb1163e773e8be130463e72ec067f983a5bc1fc693d1 🔍 |
| SHA3 | 22f5ec4add7d6985ff20a22270ada82625280e31e869a54dac827e9b9a9bb4d2 🔍 |
1
| Type |
RT_ICON
|
|---|---|
| Language | Russian - Russia |
| Codepage | UNKNOWN |
| Size | 0x2e8 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 3.27894 |
| MD5 | d2008b797eb3a19866a16c92e2415415 🔍 |
| SHA1 | 2ef6097eec07660880e8454ffe2ef0f94fbf1ac2 🔍 |
| SHA256 | e56bef4e591d04b66e02421667fcdf21e80043e87eb8a6109be7e9c89c9d50f3 🔍 |
| SHA3 | dc9861ad1aeedc809d6daef92a012424c3654a0fe0b9579bae8ee6a53dc1924e 🔍 |
4091
| Type |
RT_STRING
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x34 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 5.37823 |
| MD5 | f940a1dba9c723b680b4730657ca9d60 🔍 |
| SHA1 | 6bce62b7c60d998a8ff63efaffb61f00b7e67d92 🔍 |
| SHA256 | 60a0ce21295d104209c7f7137c7563d06c42f202877445365f85ebe4be407d42 🔍 |
| SHA3 | 00589c81e65e25f9995b1e91df3cec798c30efed83bf43eb6ae6b1ab00bbf305 🔍 |
4092
| Type |
RT_STRING
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0xec |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 7.05666 |
| MD5 | bae0f4ca0d44e3828f58586e6c2ccd36 🔍 |
| SHA1 | 932745e2c97eb096622949b3941b179455198009 🔍 |
| SHA256 | e21d90ca1822ff4cb068482e1755dcc0a17508f35ace1cd90ef454340efa24b5 🔍 |
| SHA3 | 6d298fcea99cb5c187ea5c9a968400ebd0babc90838d0c7a1dbc7df5ecd096ed 🔍 |
4093
| Type |
RT_STRING
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0xd0 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 6.95859 |
| MD5 | 7560a06afe6eb21fdd3b97cbbeb58e0b 🔍 |
| SHA1 | fc41b93eb7789bc634f7695d959d4ba2d56c9cd9 🔍 |
| SHA256 | c4ed08e184a43a633d1bfd512730893b5235078a0ac3a309e5ddfc48e6b01b98 🔍 |
| SHA3 | dbf70ba7ddd56633b84deb96fb26b845fccd39397b2ddcfc76f021f47f4f6e7c 🔍 |
4094
| Type |
RT_STRING
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2ac |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 7.57912 |
| MD5 | 3e5f90cfcc164829eb010d9b548ea4a4 🔍 |
| SHA1 | 2110882b8e108110640c5dabcd7316a970dd6897 🔍 |
| SHA256 | 8bd738d9890ab31a999f07b03f3d8acb0b90377c38b9e1af4e90dab83e0bc168 🔍 |
| SHA3 | 5476abc85561daee50b9b22874c0f39347f2be889d965a61c0107ce8ec80ab6c 🔍 |
4095
| Type |
RT_STRING
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x358 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 7.65501 |
| MD5 | 1286907b4ce58fbb9350216a36624b87 🔍 |
| SHA1 | ae0480d15c6b76e1e185869448a63952d80048e7 🔍 |
| SHA256 | 6085100944133d76d43303e4f931a00934743933b9df0184df1991bd0400e0ba 🔍 |
| SHA3 | a121e3720687455b7b7d974c633bcdea40ed6f798ea2f47e75c9fd54d903d98e 🔍 |
4096
| Type |
RT_STRING
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x2b4 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 7.64658 |
| MD5 | dc1de80732416f66ca486c5d0fdf317f 🔍 |
| SHA1 | 3f65e61321f4c20c5e5e82f8535e3d89ce6b4490 🔍 |
| SHA256 | 510b0465c2227ac2bfa9256aec39968ccf77382caf6d6c2658d81569d1c89279 🔍 |
| SHA3 | c4fe5a24c97d23d0dd3e3c96317a0f754c5b42056a2828e95c16cc82c1c78fbc 🔍 |
DVCLAL
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x10 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 3.75 |
| MD5 | 13a89726fdcf4077062a2c54018113c3 🔍 |
| SHA1 | 769d8e90ca340cb312b70995b4d7925920f7df53 🔍 |
| SHA256 | 50350256a5c0ab0ed8700f23f5993ab5b8d3579c10932fb5439ed5be0576b445 🔍 |
| SHA3 | d003a59bb54146185868e821a598ea3c87febd2b68fc46e0c49ec057b0adccf9 🔍 |
PACKAGEINFO
| Type |
RT_RCDATA
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0xf8 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 7.03676 |
| MD5 | ed33ba846e4cccd4f1dbb767a1034726 🔍 |
| SHA1 | ebbb1156a3e65df5332619ca24b1288cb6f554a3 🔍 |
| SHA256 | a9203287324d013f9521b31cc4b4e6d21f3409d1b06b1d69479feeeaf4f83c80 🔍 |
| SHA3 | 82bafc9ad6eb2f8595382cc5d148f351aeab58cb298fb47f08a18d07838cb98c 🔍 |
MAINICON
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | Russian - Russia |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 2005-May-04 01:43:40 |
| Entropy | 2.16096 |
| Detected Filetype | Icon file |
| MD5 | 42cf62b780813706e75fb9f2b2e8c258 🔍 |
| SHA1 | a022d5c1cfdd8aace0089f3e72f2eedd41bda464 🔍 |
| SHA256 | a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf 🔍 |
| SHA3 | 0aafc8e3d8b6bde595537da4ffe0efc5fe53f01dafe336a2a5828b6a71283d3c 🔍 |
Version Info
TLS Callbacks
Load Configuration
RICH Header
Errors
[!] Error: Could not reach the TLS callback table.
[*] Warning: Section has a size of 0!
[!] Error: Bitmap LOGO is malformed!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
[*] Warning: Couldn't convert a string from a RT_STRING resource to UTF-8!
Leave a comment
No comments yet.