| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2015-Nov-18 09:15:19 |
| Detected languages |
Chinese - PRC
Process Default Language |
| Debug artifacts |
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
|
| Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to SHA1
Uses constants related to SHA256 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The file contains overlay data. |
1583180 bytes of data starting at offset 0x42800.
The file contains a WinRAR compressed archive file after the PE data. Overlay data amounts for 85.3207% of the executable. |
| Malicious | VirusTotal score: 4/69 (Scanned on 2026-07-15 16:00:39) |
APEX:
Malicious
CrowdStrike: win/malicious_confidence_60% (D) Cylance: Unsafe Cynet: Malicious (score: 100) |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xe0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2015-Nov-18 09:15:19 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 9.0 |
| SizeOfCode | 0x28c00 |
| SizeOfInitializedData | 0x19800 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001DA8B (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2a000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x65000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| COMCTL32.dll |
InitCommonControlsEx
|
|---|---|
| SHLWAPI.dll |
SHAutoComplete
|
| KERNEL32.dll |
FindClose
FindNextFileW FindFirstFileW GetVersionExW GetCurrentDirectoryW FoldStringW GetFullPathNameW GetModuleFileNameW FindResourceW GetModuleHandleW FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcessId GetLocaleInfoW GetNumberFormatW SetEnvironmentVariableW ExpandEnvironmentStringsW WaitForSingleObject GetDateFormatW GetTimeFormatW FileTimeToSystemTime FileTimeToLocalFileTime GetExitCodeProcess GetTempPathW MoveFileExW UnmapViewOfFile Sleep MapViewOfFile GetCommandLineW CreateFileMappingW GetTickCount GetLocalTime OpenFileMappingW SetThreadExecutionState InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread GetProcessAffinityMask CreateEventW CreateSemaphoreW ReleaseSemaphore ResetEvent SetEvent SetThreadPriority SystemTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime LocalFileTimeToFileTime WideCharToMultiByte MultiByteToWideChar CompareStringW SetFileTime SetFileAttributesW GlobalAlloc SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LoadLibraryA GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleHandleA LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetModuleFileNameA ExitProcess HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess VirtualAlloc VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetCommandLineA RaiseException GetSystemTimeAsFileTime GetFileAttributesW ReadFile GetFileType FlushFileBuffers SetEndOfFile SetFilePointer WriteFile GetStdHandle GetLongPathNameW GetShortPathNameW GetCPInfo MoveFileW CreateFileW CreateDirectoryW DeviceIoControl RemoveDirectoryW DeleteFileW CreateHardLinkW GetCurrentProcess CloseHandle SetLastError GetLastError CreateFileA IsDBCSLeadByte HeapAlloc HeapReAlloc HeapFree RtlUnwind |
| USER32.dll |
GetDlgItem
SetWindowLongW EnableWindow ShowWindow GetDC ReleaseDC FindWindowExW GetParent MapWindowPoints CreateWindowExW UpdateWindow LoadCursorW RegisterClassExW DefWindowProcW DestroyWindow CopyRect IsWindow CharUpperW OemToCharBuffA LoadIconW IsDialogMessageW PostMessageW GetSysColor SetForegroundWindow MessageBoxW WaitForInputIdle IsWindowVisible DialogBoxParamW DestroyIcon SetFocus GetClassNameW SendDlgItemMessageW EndDialog GetDlgItemTextW SetDlgItemTextW wvsprintfW SendMessageW PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadStringW GetWindowRect GetClientRect SetWindowPos GetWindowTextW SetWindowTextW GetSystemMetrics GetWindow GetWindowLongW LoadBitmapW |
| GDI32.dll |
GetDeviceCaps
CreateCompatibleDC CreateCompatibleBitmap SelectObject StretchBlt DeleteDC GetObjectW DeleteObject CreateDIBSection |
| COMDLG32.dll |
GetSaveFileNameW
CommDlgExtendedError GetOpenFileNameW |
| ADVAPI32.dll |
RegOpenKeyExW
RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges |
| SHELL32.dll |
SHFileOperationW
SHGetFileInfoW ShellExecuteExW SHChangeNotify SHBrowseForFolderW SHGetMalloc SHGetPathFromIDListW SHGetFolderLocation |
| ole32.dll |
CLSIDFromString
CoCreateInstance OleInitialize OleUninitialize CreateStreamOnHGlobal |
| 选择目标文件夹 |
| 正在解压 %s |
| 正在跳过 %s |
| 不可预料的压缩文件末端 |
| 文件“%s”头被破坏 |
| 找到损坏的头 |
| 主压缩文件头已损坏 |
| 压缩文件注释头损坏 |
| 压缩文件注释已损坏 |
| 没有足够的内存 |
| 未知方式于 %s |
| 无法打开 %s |
| 无法创建 %s |
| 无法创建文件夹 %s |
| 加密的文件 %s 里发生校验和错误。损坏的文件或错误的密码。 |
| %s 校验和错误 |
| %s 中压缩的数据校验和错误 |
| 在文件 %s 中写入错误。磁盘可能已满 |
| 在文件 %s 中读取错误 |
| 文件关闭错误 |
| 缺少必须的分卷 |
| 这个压缩文件格式未知或者数据已经被损坏 |
| 正在从 %s 中提取 |
| 下一压缩卷 |
| 压缩文件头损坏 |
| 关闭 |
| 错误 |
| 执行指定操作时发生错误 |
| 查看信息窗口获取更多细节信息 |
| 字节 |
| 修改于 |
| 文件夹无法访问 |
| 某些文件无法被创建。 |
| 请关闭所有正在运行的应用程序,重新启动 Windows 并再次运行此安装程序 |
| 某些安装文件被破坏。 |
| 请下载一个最新版本或重试安装程序 |
| 所有文件 |
| <style>body{font-family:"Arial,宋体";font-size:12;}</style><ul><li>单击 <b>安装</b> 按钮开始解压。</li><br><br> |
| <ul><li>按下 <b>解压</b> 按钮开始解压。</li><br><br> |
| <li>使用 <b>浏览</b> 按钮从目录树中选择目标文件夹。它也可以手动输入。 |
| </li> |
| <br><br> |
| <li>如果指定的目标文件夹不存在,在文件解压前它将被自动创建。 |
| 已在提取之前自动创建。</li></ul> |
| 压缩文件已损坏 |
| 正解压文件到 %s 文件夹 |
| 正解压文件到临时文件夹 |
| 解压 |
| 解压进度 |
| 路径和文件名总长度必须不能超过 %d 个字符 |
| 在 %s 里未知的加密模式 |
| 指定的密码不正确。 |
| 无法复制 %s 到 %s。 |
| 无法创建符号链接 %s |
| 无法创建硬链接 %s |
| 你可能需要以管理员权限运行此自解压压缩文件 |
| 暂停 |
| 继续 |
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2015-Nov-18 09:15:19 |
| Version | 0.0 |
| SizeofData | 81 |
| AddressOfRawData | 0x2cd28 |
| PointerToRawData | 0x2bd28 |
| Referenced File | d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb |
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x430298 |
| SEHandlerTable | 0x42ceb0 |
| SEHandlerCount | 36 |
| XOR Key | 0x4e51b9bd |
|---|---|
| Unmarked objects | 0 |
| ASM objects (VS2008 SP1 build 30729) | 27 |
| C objects (VS2008 SP1 build 30729) | 144 |
| Imports (VS2008 SP1 build 30729) | 19 |
| Total imports | 243 |
| C++ objects (VS2008 SP1 build 30729) | 103 |
| Exports (VS2008 SP1 build 30729) | 1 |
| Linker (VS2008 SP1 build 30729) | 1 |
| Resource objects (VS2008 SP1 build 30729) | 1 |
No comments yet.