b2094923e9f520e72548211eac43fee3459772f6508dc6df7cb865603bb9317b
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2016-Feb-19 17:37:39 |
| Detected languages |
German - Germany
|
| ProductName | Installexetermevaluator |
| FileVersion | 1.00 |
| ProductVersion | 1.00 |
| InternalName | Install |
| OriginalFilename | Install.exe |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual Basic 5.0
Microsoft Visual Basic v5.0/v6.0 Microsoft Visual Basic v5.0 - v6.0 |
| Malicious | VirusTotal score: 4/70 (Scanned on 2023-10-08 23:29:25) |
APEX:
Malicious
Bkav: W32.AIDetectMalware MaxSecure: Trojan.Malware.300983.susgen Trapmine: malicious.moderate.ml.score |
Hashes
| MD5 | a4d800eade724fea72198fe720bc0f77 🔍 |
|---|---|
| SHA1 | 609daabb261e77620fb7022c0e5bddc79b3986d6 🔍 |
| SHA256 | b2094923e9f520e72548211eac43fee3459772f6508dc6df7cb865603bb9317b 🔍 |
| SHA3 | 8ffeb7aefc7c0371a7df69b9f5d157944eefe9b0914f30def480f42f6fa6485b 🔍 |
| SSDeep | 48:6tuijUxQNGhMJhJ6xitsbPPcH81/l+23ipgToVRGpjNhpLhOkCqONFLDPhxhRPX:cuV63uPUH81F3SC6Gp5v4k1rqYE32 🔍 |
| Imports Hash | 2b3c007ab8b7dfd76cb3aa897f07ac43 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xc0 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2016-Feb-19 17:37:39 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x1000 |
| SizeOfInitializedData | 0x2000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001190 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 1.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x4000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x90b8 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 258a7b7ad16d51c83ad25c1692f430bf 🔍 |
|---|---|
| SHA1 | a4d8229c8ef0405ee32166140d65041c29632b70 🔍 |
| SHA256 | 5606f5dd125b5119f97c15f439fdfeda55cb4b0bfeb96bb57a298e47ab529f62 🔍 |
| SHA3 | 49487a8d39d13b6cf7c83bd421df51eab2514b9c497c8ad3aaa546dda28ee630 🔍 |
| VirtualSize | 0xe98 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x1000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 4.42455 |
.data
| MD5 | 620f0b67a91f7f74151bc5be745b7110 🔍 |
|---|---|
| SHA1 | 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 🔍 |
| SHA256 | ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7 🔍 |
| SHA3 | a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563 🔍 |
| VirtualSize | 0xa40 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x2000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
.rsrc
| MD5 | 98586242ca789a29e8655375b523c1b6 🔍 |
|---|---|
| SHA1 | b97fadaef50c5739091081bb5798c4c918b46dd7 🔍 |
| SHA256 | ca938948b354563352d14e535ff926199f0bf66544aa277c973ec8378f726e6d 🔍 |
| SHA3 | 6f25f0130e04b206e03a07e9c1eb5698c2440dfbe71b495f45a03a987049515b 🔍 |
| VirtualSize | 0x8b8 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x1000 |
| PointerToRawData | 0x3000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 1.86326 |
Imports
| MSVBVM60.DLL |
_CIcos
_adj_fptan __vbaVarMove __vbaFreeVar __vbaFreeVarList _adj_fdiv_m64 _adj_fprem1 _adj_fdiv_m32 _adj_fdiv_m16i _adj_fdivr_m16i _CIsin __vbaChkstk EVENT_SINK_AddRef _adj_fpatan EVENT_SINK_Release #600 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler _adj_fprem _adj_fdivr_m64 #530 __vbaFPException __vbaStrVarVal __vbaVarCat _CIlog #647 _adj_fdiv_m32i _adj_fdivr_m32i _adj_fdivr_m32 _adj_fdiv_r #100 _CIatan _allmul _CItan _CIexp __vbaFreeStr |
|---|
Delayed Imports
30001
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x130 |
| TimeDateStamp | 2016-Feb-19 17:37:39 |
| Entropy | 2.57965 |
| MD5 | a20d09bee9b4207ad5a3b67a78c1dce3 🔍 |
| SHA1 | ca85fbf532389887f3837bbadd1c579040b99c8b 🔍 |
| SHA256 | 2d3915cdc82e909357d44c4de1b8890bd753605c28df11b10299e3fd09d930b9 🔍 |
| SHA3 | e3b2b0325b24bb74af126af0863b39a6e63c08820f69cf0ae582a31bfc1052db 🔍 |
30002
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x2e8 |
| TimeDateStamp | 2016-Feb-19 17:37:39 |
| Entropy | 1.76987 |
| MD5 | 24799ca590d42134e7103b06d46fd960 🔍 |
| SHA1 | 4af9a0fe3b7371abc50a18e851f3122fce9a2ffa 🔍 |
| SHA256 | a32e750bc1b0315530097434a7e1d324b843e1f5ffd95238b49d3a8aa8e6fe09 🔍 |
| SHA3 | 9a17698629ef5e7a1c567a9669be74aa2c9d8356ecfba40c48811e4dcf5ea875 🔍 |
30003
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x128 |
| TimeDateStamp | 2016-Feb-19 17:37:39 |
| Entropy | 2.07177 |
| MD5 | e6c5053ba1c848d7e16701a2d08fb8c6 🔍 |
| SHA1 | f253482c0fa25197130f6475f2ded060527843bf 🔍 |
| SHA256 | 46dc088910439dad6a0d69da5e64227d04a640845fd1c31e90a7d4340c539fe0 🔍 |
| SHA3 | 1e6c369197dd1a466ea87357db49ec559ecf82c0c3fa13af1a383445945861e6 🔍 |
1
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x30 |
| TimeDateStamp | 2016-Feb-19 17:37:39 |
| Entropy | 2.97836 |
| Detected Filetype | Icon file |
| MD5 | 835a20def9b2661b64b8ac06b4901f36 🔍 |
| SHA1 | 70732dac88537f00c89d105f986ef843d3aca818 🔍 |
| SHA256 | cbdcb84268fcf2a25b844c1dca787de835c0376e82c1a2e62814a3c940a26cfb 🔍 |
| SHA3 | 9a2de99425a7e2086c65d82719bf44696cfe58b8077ce214e814ceeeb78ba1f4 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | German - Germany |
| Codepage | Unicode (UTF 16LE) |
| Size | 0x1f8 |
| TimeDateStamp | 2016-Feb-19 17:37:39 |
| Entropy | 3.08819 |
| MD5 | b2cc3c6eaf57b122814ba0c5e2bc0d68 🔍 |
| SHA1 | f105f5fdaa890aac3e4c5053a754af711c07a8ea 🔍 |
| SHA256 | 76d5823b60cb96613f40692256f0af6ff1dc16c5b32366324803b8d12a67d697 🔍 |
| SHA3 | ae16951eca4a05712590d816da8dd21cc518ea07a34567af718563af64b44923 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | German - Germany |
| ProductName | Installexetermevaluator |
| FileVersion (#2) | 1.00 |
| ProductVersion (#2) | 1.00 |
| InternalName | Install |
| OriginalFilename | Install.exe |
| Resource LangID | German - Germany |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x88aa2a9d |
|---|---|
| Unmarked objects | 0 |
| 14 (7299) | 1 |
| 9 (8041) | 2 |
| 13 (8169) | 1 |
Errors
Leave a comment
No comments yet.