99882585c0a5180fd3ccf1f4a086763520088c21d890a43e6391b256fd6c27f6

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2001-Aug-13 17:13:38
Detected languages English - United States
CompanyName
FileDescription NetVideo
FileVersion 5.0.0.1
LegalCopyright

Plugin Output

Info Matching compiler(s): Wise Installer Stub
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
 Possibly launches other programs:
  • WinExec
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Suspicious The file contains overlay data. 3172994 bytes of data starting at offset 0x3a00.
The overlay data has an entropy of 7.99992 and is possibly compressed or encrypted.
Overlay data amounts for 99.5342% of the executable.
Safe VirusTotal score: 0/72 (Scanned on 2025-11-14 05:53:08) All the AVs think this file is safe.

Hashes

MD5 e6914b7f078be093eb736a8a894ce2cf 🔍
SHA1 407db5c8aacd8a1d4eb07e966035e8fb50b7ed52 🔍
SHA256 99882585c0a5180fd3ccf1f4a086763520088c21d890a43e6391b256fd6c27f6 🔍
SHA3 8273ab194df3fde9e7e5da8abaac8aca0438d1183da19e8fac37244043f72dc8 🔍
SSDeep 49152:uNS36GKv5zwfLnCwR+zQFPBtTc+2mBgAMuuf9pxjxFoHo7fXThdoYx/Pt0b:RKDpw7EQFPbWmBR5uFyo4Yx/PWb 🔍
Imports Hash e41c25ab7824b3df73334188c40518ae 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2001-Aug-13 17:13:38
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x2200
SizeOfInitializedData 0x1600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000021AF (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x4000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 4.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x7000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c71643c087e2557d0b1d36c694eccccf 🔍
SHA1 222a4e420f735d39fa927c1cc80d2888ca66c444 🔍
SHA256 1886225d074d690fa8e6c126a730498227aded0b9c14720d770a48672c679c22 🔍
SHA3 6c5f23adcdbb201b5d243d66787c92cacab4bbe52b799f0e4d8ad88bdf56fefc 🔍
VirtualSize 0x2126
VirtualAddress 0x1000
SizeOfRawData 0x2200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.19442

.rdata

MD5 c8cfb67d59a05aefa27a9fecd141f5ef 🔍
SHA1 ddfe8297e281504291c742d08e76f7b68d5ab52a 🔍
SHA256 8a77822a2450990615dfeeed221a5b77fdfacc8e4842914e18a1ef76d73f98c8 🔍
SHA3 79619b34f295daef31a503f21d104d6ca209a825aaae7a73cea4b39b48522a06 🔍
VirtualSize 0x779
VirtualAddress 0x4000
SizeOfRawData 0x800
PointerToRawData 0x2600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.78172

.data

MD5 c7c41671d08e5cd17ae9b12731e3de24 🔍
SHA1 bd8c43a36af27914353b6e51e8130c409daae8a4 🔍
SHA256 57f7880eb4f50e205307fa294ac3591198853c900a2b7d658576dfbdf40d15f1 🔍
SHA3 6d1fa47f604dacef41fe36d4102072bee4a43cefdc632fd38e303f558017a1bb 🔍
VirtualSize 0x478
VirtualAddress 0x5000
SizeOfRawData 0x400
PointerToRawData 0x2e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.95766

.rsrc

MD5 98ea9be826b7d7fae068d1f5a5a48fec 🔍
SHA1 5dc76437a81d66424100c74d7dbbc5171d11e090 🔍
SHA256 28e850d784bd4ef7b4e650b83f56720d6737102af0e25772e0226d531585489f 🔍
SHA3 ff71befd87f273037f78da227bdd0920fe6f5ba0500f28cb042a8e78c60f87eb 🔍
VirtualSize 0x640
VirtualAddress 0x6000
SizeOfRawData 0x800
PointerToRawData 0x3200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.78191

Imports

KERNEL32.dll lstrcpyA
GetCommandLineA
SetErrorMode
lstrlenA
MulDiv
GetTempFileNameA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
FormatMessageA
lstrcatA
GetLastError
_lwrite
_llseek
GlobalUnlock
_lopen
GlobalAlloc
GlobalFree
_lclose
_lcreat
LoadLibraryA
GetProcAddress
FreeLibrary
OpenFile
GetVersionExA
GetCurrentProcess
WinExec
ExitProcess
_lread
LocalFree
GetTempPathA
GlobalLock
USER32.dll GetDC
BeginPaint
EndPaint
InvalidateRect
PostQuitMessage
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
DrawTextA
ReleaseDC
ShowWindow
SetWindowPos
UpdateWindow
SetTimer
LoadIconA
wsprintfA
MessageBoxA
ExitWindowsEx
RegisterClassA
LoadCursorA
GDI32.dll DeleteObject
GetStockObject
GetDeviceCaps
PatBlt
CreateSolidBrush
TextOutA
SetTextColor
SetBkMode
SelectObject
StretchDIBits
CreateFontA
RealizePalette
SelectPalette
CreatePalette
ADVAPI32.dll OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

Delayed Imports

_MainWndProc@16

Ordinal 1
Address 0x2a80

_StubFileWrite@12

Ordinal 2
Address 0x3082

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.37233
MD5 02c8776534fcb3d5551e42c6c360e1ff 🔍
SHA1 3aedcdef245d870ec7746ed9ac2c34329ca43c09 🔍
SHA256 fa38c19f3e9ff3140b9a653ac955d2677b857080342bd200120b7447ba662287 🔍
SHA3 d60e5cce521ed9bb1aebed83faec570969b3792233375e7742ed09a9643af68a 🔍

108

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.16096
Detected Filetype Icon file
MD5 42cf62b780813706e75fb9f2b2e8c258 🔍
SHA1 a022d5c1cfdd8aace0089f3e72f2eedd41bda464 🔍
SHA256 a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf 🔍
SHA3 0aafc8e3d8b6bde595537da4ffe0efc5fe53f01dafe336a2a5828b6a71283d3c 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x24c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.67928
MD5 bf3a81dc0aa49e686b4571d2920fb6b6 🔍
SHA1 0292717c66934f014708046caeae7427e7b303d8 🔍
SHA256 f2fa618b070eb6cb92ecc05c736fe7b35a2434d7924d9dba0a12b9e27f65d620 🔍
SHA3 65a8f5b8839c88ef5029941d51cfe7c38a34ef5b22b7217540de9ec7795332be 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 5.0.0.1
ProductVersion 5.0.0.1
FileFlags (EMPTY)
FileOs VOS_DOS
VOS_DOS_WINDOWS16
VOS_DOS_WINDOWS32
VOS_OS232
VOS_OS232_PM32
VOS_WINCE
VOS__PM32
VOS__WINDOWS16
FileType VFT_APP
Language English - United States
CompanyName
FileDescription NetVideo
FileVersion (#2) 5.0.0.1
LegalCopyright
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xaf0ad129
Unmarked objects 0
Unmarked objects (#2) 1
Total imports 70
19 (8034) 9
C objects (8799) 2
Resource objects (VS98 SP6 cvtres build 1736) 1
Linker (VC++ 6.0 SP5 imp/exp build 8447) 1

Errors

Leave a comment

No comments yet.