Manalyze report for 8a0c6871ec6e09e4193f537884111006a947d7b3e9260110907777d0c4dd68d3

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2007-Oct-07 09:49:24
Detected languages	English - Australia English - United States
FileDescription	TimerResolution
FileVersion	`1, 2, 0, 1`
InternalName	TimerResolution
LegalCopyright	Copyright (C) 2007
OriginalFilename	TimerResolution.exe
ProductName	TimerResolution Application
ProductVersion	`1, 2, 0, 1`

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++` `Microsoft Visual C++ v6.0` `Microsoft Visual C++ v5.0/v6.0 (MFC)`
Info	Interesting strings found in the binary:	`Contains domain names: http://users.tpg.com.au http://users.tpg.com.au/lucash/ http://www.lucashale.com http://www.lucashale.com/timerresolution/ lucashale.com tpg.com.au users.tpg.com.au www.lucashale.com`
Suspicious	The PE is packed or was manually edited.	`The number of imports reported in the RICH header is inconsistent.`
Suspicious	The PE contains functions most legitimate programs don't use.	`Possibly launches other programs: ShellExecuteA` `Uses Windows's Native API: NtSetTimerResolution NtQueryTimerResolution`
Suspicious	VirusTotal score: 2/71 (Scanned on 2026-11-02 15:46:53)	`DrWeb: Trojan.DownLoader46.23980` `Zillya: Trojan.Kryptik.Win64.68739`

Hashes

MD5	`2c9017dbc6c38d2567d550177d64a81d` 🔍
SHA1	`f77de1de8e39c17c299c25696cc7965bfe07028f` 🔍
SHA256	`8a0c6871ec6e09e4193f537884111006a947d7b3e9260110907777d0c4dd68d3` 🔍
SHA3	`5b468d5e6f481b74771496c9daad843339285ebbbb49e6e106a7f03aad84e96a` 🔍
SSDeep	`192:h0ZL+FnJA4o2TCFFlsDof85qan7hsDofi1oynazAetV0qMI18rii13:h0enJA4/2fkJn618zAo0qM68rv13` 🔍
Imports Hash	`72717c83cf7b5d060d520d8545909ee1` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`4`
TimeDateStamp	2007-Oct-07 09:49:24
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0x2000`
SizeOfInitializedData	`0x5000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000021E4 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x3000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x1000`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`2f9759853d9c4b322d091b4d2dec5b16 🔍`
SHA1	`30ca186a4c2728c59f0a6d9f7c91f08a5aaecf1c 🔍`
SHA256	`679455cdcaa8a39348d213df588915602f82efa35c1c62a84f7276dfbb978ad6 🔍`
SHA3	`2b73d6ef4922b5584cb9b1ce939e051fe14229b8c3c93681aa2503a1aa866862 🔍`
VirtualSize	`0x1610`
VirtualAddress	`0x1000`
SizeOfRawData	`0x2000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.52837`

.rdata

MD5	`46985dccffb4a41e3021a3fa76ad1358 🔍`
SHA1	`27af6d9786ca2cd5cc65eeea26c412fbc22a3391 🔍`
SHA256	`d6229b768468c8be79174b8f4b9e152402862598d027d89533678e5be9e18898 🔍`
SHA3	`867b2be8c2c9446951208f033e03d9966729112269ac5f127209b270b11c152e 🔍`
VirtualSize	`0x10d0`
VirtualAddress	`0x3000`
SizeOfRawData	`0x2000`
PointerToRawData	`0x3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.97447`

.data

MD5	`cb8401b42fdd1fe3254d0f47a45a2a8e 🔍`
SHA1	`9e142de5c22a43baa7d94d2d090f2dea559a0c48 🔍`
SHA256	`544304bc9e35339abfff9f517bebe0109982736987a518a13c6ea07763d7967c 🔍`
SHA3	`521a920f0d3046929bbe827b8bf3da005cd31f5a84e2dbd2489f63dd1d367f64 🔍`
VirtualSize	`0x14c`
VirtualAddress	`0x5000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x5000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.136119`

.rsrc

MD5	`b4f0b60a6d5a2cc71d5f13bac06c171d 🔍`
SHA1	`b27ac6c893de8ada57e56018e8b2d553f292195e 🔍`
SHA256	`c9e1c8c952df3248362d894c1a44b2154353756d1038132275f791f5d2642926 🔍`
SHA3	`82c358d261285cbc52d19efa86c31bb86dd29b6e179e9a7e18619644ff306b2d 🔍`
VirtualSize	`0x1180`
VirtualAddress	`0x6000`
SizeOfRawData	`0x2000`
PointerToRawData	`0x6000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.41631`

Imports

MFC42.DLL	`#5163` `#6374` `#4353` `#5290` `#3798` `#4837` `#4441` `#2648` `#2055` `#6376` `#3749` `#5065` `#1727` `#5261` `#2446` `#2124` `#2982` `#3147` `#3259` `#4465` `#3136` `#3262` `#2985` `#3081` `#2976` `#3830` `#3831` `#3825` `#3079` `#4080` `#4627` `#4424` `#3721` `#800` `#795` `#858` `#860` `#540` `#567` `#825` `#3626` `#3663` `#2414` `#4275` `#2379` `#755` `#6172` `#5875` `#5789` `#470` `#6453` `#3874` `#4284` `#1641` `#2385` `#2864` `#613` `#289` `#4673` `#4274` `#6375` `#4486` `#2554` `#2512` `#5731` `#3922` `#1089` `#5199` `#2396` `#3346` `#5300` `#5302` `#2725` `#4079` `#4698` `#5307` `#5289` `#5714` `#4622` `#3738` `#561` `#815` `#641` `#2514` `#2621` `#1134` `#5265` `#4376` `#4853` `#4998` `#4710` `#6052` `#1775` `#5280` `#4425` `#3597` `#537` `#324` `#2302` `#4234` `#1146` `#1168` `#2367` `#2370` `#4160` `#2863` `#2818` `#6334` `#5241` `#4407` `#1776` `#4078` `#6055` `#3619` `#3402` `#2860` `#5277` `#1576`
MSVCRT.dll	`__setusermatherr` `_adjust_fdiv` `__p__commode` `__p__fmode` `__set_app_type` `_except_handler3` `_controlfp` `__getmainargs` `_acmdln` `exit` `_setmbcp` `__CxxFrameHandler` `_ftol` `__dllonexit` `_onexit` `_exit` `_XcptFilter` `_initterm`
KERNEL32.dll	`GetModuleHandleA` `GetStartupInfoA`
USER32.dll	`GetSystemMetrics` `IsIconic` `GetClientRect` `LoadIconA` `EnableWindow` `GetParent` `DrawIcon` `AppendMenuA` `SendMessageA` `SetCursor` `LoadCursorA` `GetSystemMenu`
GDI32.dll	`GetObjectA` `GetTextExtentPoint32A` `CreateFontIndirectA`
SHELL32.dll	`ShellExecuteA`
COMCTL32.dll	`_TrackMouseEvent`
ntdll.dll	`NtSetTimerResolution` `NtQueryTimerResolution`

Delayed Imports

1

Type	`RT_ICON`
Language	English - Australia
Codepage	UNKNOWN
Size	`0x2e8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.13063`
MD5	`3d9a6c6161a4bf82c31e2e0b1810550c 🔍`
SHA1	`a7fd63ea2e315c475dd5ffd5515d098a5e08fc09 🔍`
SHA256	`e612c73e2af385bc8476fa25c77755e1ddb149abde43d2594755b7427210ff61 🔍`
SHA3	`d94280e2eecd983f7da6f1082c4b1e8088390e00405614228dc19299fe03142b 🔍`

2

Type	`RT_ICON`
Language	English - Australia
Codepage	UNKNOWN
Size	`0x128`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.20573`
MD5	`f85b4cfc134e5a97f2f5280467340bb3 🔍`
SHA1	`6bfbb605d7562583b9c5b2c125657713bcc76a3b 🔍`
SHA256	`794525c643841081ce7059e8260b0d333f7c51dfcb1b71ed3cdd3ecf635eee36 🔍`
SHA3	`db520f07d04ef4a1d9d86174237466ecd5fde5c0129fe04f3f75cfbee51228d1 🔍`

100

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x19c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.46601`
MD5	`ff44aeafc53d30905899bc0bce632034 🔍`
SHA1	`b896cac793ebd127a9ab6b49d4ed2f5559836d03 🔍`
SHA256	`5603496f8b340eb72dd60fd20437c7424590865f301bd54c174f6d8dcbf8f805 🔍`
SHA3	`9f99161e4c916fa3762d4c253f235f7201670dac2538b58e20fc25aaad73cb65 🔍`

102

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0x31c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.2321`
MD5	`1f1a3af6192cba5195d97e2c80783988 🔍`
SHA1	`0c220a8b32aa45883d1843f3e5e59659f895b956 🔍`
SHA256	`f8e7b46cfbaadcf9c9266d01eb6139f130831f84f308ef271aa700a86c9477e2 🔍`
SHA3	`6a69b3dfc6b1e10718cccba83064891d3ed5a62212fb69cef876aef4680bff82 🔍`

7

Type	`RT_STRING`
Language	English - United States
Codepage	UNKNOWN
Size	`0x5c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.28933`
MD5	`f2e450a907228d9b0d065f45c1e15d8a 🔍`
SHA1	`b767db4f25e5e66edb1a4f1e7353788b193969b5 🔍`
SHA256	`4442470d328abd508edc384dce4860af9a1a19455a7c3463150756a32d5fc1ae 🔍`
SHA3	`3c6a3153d72aca22b0d8faa2acdce0b115785dae7e8ac0d63b56aaeb9ad369f1 🔍`

128

Type	`RT_GROUP_ICON`
Language	English - Australia
Codepage	UNKNOWN
Size	`0x22`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.37086`
Detected Filetype	Icon file
MD5	`d59e0d372ea5fd8c1f4de744376a6af4 🔍`
SHA1	`6883ce60e71a83424db0b41d0ab6bf61080e3de2 🔍`
SHA256	`b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b 🔍`
SHA3	`5e39df982879204dd9f129a37d1e1c2ff906e88de9ae01b4418db5e8455e7ae1 🔍`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x36c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.35212`
MD5	`5508d4b251cb6ed149359d5133f1c82a 🔍`
SHA1	`e8cd64901d761157c9b874af5fce4c2f7dd2fb91 🔍`
SHA256	`f025bfd0a81d257c2aaa4510dec65fcac8942dcb54b780ea3748e4423edb7063 🔍`
SHA3	`5c31360ccb522287c1d9b152e04ba2804fb09f42642bde59792c8a78b9237649 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	English - Australia
Codepage	UNKNOWN
Size	`0x296`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.02593`
MD5	`f699d3730fcc3f4516f7b0d7ccfe6163 🔍`
SHA1	`5ef9e72a626a2d8d4a563c08c7dd0b117dbdfe05 🔍`
SHA256	`2f6e50bfa1d65f1093cd2d12036f51834d0076b0a24be940cbd24f3b2669c9fc 🔍`
SHA3	`45fa2684d8019a9405f2bfeb6a65308cdb4285c1b41ab3d0f6fefdd74b7fa735 🔍`

String Table contents

&About Set Timer Resolution...

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.2.0.1
ProductVersion	1.2.0.1
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
FileDescription	TimerResolution
FileVersion (#2)	1, 2, 0, 1
InternalName	TimerResolution
LegalCopyright	Copyright (C) 2007
OriginalFilename	TimerResolution.exe
ProductName	TimerResolution Application
ProductVersion (#2)	1, 2, 0, 1

Resource LangID	English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xf093bf29`
Unmarked objects	`0`
Imports (9210)	`2`
Unmarked objects (#2)	`3`
19 (8034)	`8`
14 (7299)	`1`
C objects (8047)	`11`
Linker (8047)	`2`
C++ objects (8569)	`3`
Linker (8569)	`3`
Total imports	`156`
49 (9044)	`4`
Resource objects (VS98 SP6 cvtres build 1736)	`1`

Errors

Leave a comment

No comments yet.