bd7630b6ad94f8ed2024e5e98a24b6fedbb5f2b8a058b70c8ffeefe98a7dcca2

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2021-Sep-25 21:57:46
Detected languages English - United States
FileDescription Microsoft Defender Configurator
LegalCopyright Copyright * Andrzej Pluta (@Andy Ful)
ProductName ConfigureDefender

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • http://nsis.sf.net
  • http://nsis.sf.net/NSIS_Error
  • nsis.sf.net
Suspicious The PE is an NSIS installer Unusual section name found: .ndata
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
 Can access the registry:
  • RegCreateKeyExW
  • RegEnumKeyW
  • RegQueryValueExW
  • RegSetValueExW
  • RegCloseKey
  • RegDeleteValueW
  • RegDeleteKeyW
  • RegOpenKeyExW
  • RegEnumValueW
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • CreateFileW
  • GetTempPathW
 Functions related to the privilege level:
  • AdjustTokenPrivileges
  • OpenProcessToken
 Changes object ACLs:
  • SetFileSecurityW
 Can shut the system down or lock the screen:
  • ExitWindowsEx
Info The PE is digitally signed. Signer: Open Source Developer
Issuer: Certum Code Signing 2021 CA
Safe VirusTotal score: 0/69 (Scanned on 2026-07-29 21:02:56) All the AVs think this file is safe.

Hashes

MD5 93ed561c7535cd3dfa495d3201bf64e4
SHA1 63cf61756387c46d018d32887b5ebb8364890d9c
SHA256 bd7630b6ad94f8ed2024e5e98a24b6fedbb5f2b8a058b70c8ffeefe98a7dcca2
SHA3 d5acdce7d59a634de3ae426e253a576f1ac93592bd9c826ee8dc18ce203c0187
SSDeep 49152:YTkeg6AYuqEU5vGUjO5HR96kTAiIqaC5j8s:YTkegfYPEUNn+R9+i9aCx5
Imports Hash 56a78d55f3f7af51443e58e0ce2fb5f6

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2021-Sep-25 21:57:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x6a00
SizeOfInitializedData 0x2da00
SizeOfUninitializedData 0x800
AddressOfEntryPoint 0x0000352D (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x8000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 6.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xa3000
SizeOfHeaders 0x400
Checksum 0x261961
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ce9df19df15aa7bfbc0a8d0af0b841d0
SHA1 6cba022a30ad3c84a5343e05a15e49562c18aba0
SHA256 c902047f3976f37a722b89e3e2401d690d77b3e70ebaf7a32e9ac5ce6ff34a5e
SHA3 a80cef7bf78b6d8cf31176f4f7b837d46a7ec1b2d2dd9ab44d791ec0b29f199c
VirtualSize 0x6897
VirtualAddress 0x1000
SizeOfRawData 0x6a00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.4584

.rdata

MD5 a118375c929d970903c1204233b7583d
SHA1 73c2bec231377068f99d5c55ff5c975960280e6c
SHA256 322668435dbcf8d7246f9f554db08e811dd251f45ad883764e7af6b723e51e0a
SHA3 712081c7df3abf95c9a3dacb7e21700d783b1ca8d1105fe9df0f6df834b73c24
VirtualSize 0x14a6
VirtualAddress 0x8000
SizeOfRawData 0x1600
PointerToRawData 0x6e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.02411

.data

MD5 82a10c59a8679bb952fc8316070b8a6c
SHA1 7e347dcff055b97091b833896e1097b7ed374fdd
SHA256 05429ca22a1221b4c12a26881799b71b769633a366bccd17b0114acd29ac162f
SHA3 e2e59928a622a7543320d477ef40fed9784205f20846697c8936055ee1f94925
VirtualSize 0x2b018
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x8400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.15458

.ndata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x11000
VirtualAddress 0x36000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc

MD5 d1822b3876398f4a8297c8dcbe09af1d
SHA1 fa6e810d50d4d55ad230af1ebea9ec081dc0fb96
SHA256 a056fe67b57fb092d827c9a0b7935afa4974fa486f321a19eb9f5c82b540159b
SHA3 136756c942f7a687719541d263fe0f2effbfe48bdd70d4cb877295bccee5195b
VirtualSize 0x5b020
VirtualAddress 0x47000
SizeOfRawData 0x5b200
PointerToRawData 0x8a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.27443

Imports

ADVAPI32.dll RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
SHELL32.dll SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32.dll OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
COMCTL32.dll #17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
USER32.dll GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
GDI32.dll SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
KERNEL32.dll GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.11811
MD5 64e3aba3d3082ce2c1d03f64bb538e9a
SHA1 52a18028b260fce447a15cd4f10328234ac01aca
SHA256 8f003be0e2283ef10af111dd50e8a41f48f9789ad8c261d7137f791de7802563
SHA3 68c0cb3efb0ef4fe4041638df31bbb07330cce39d0d825b75a08fa2c806c3e68

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.22916
MD5 e64b111c286e76772bf1307d5f567dd5
SHA1 b3d339dd8121efc01dd9895782258298a961146b
SHA256 d9f2e394b24367383eb6c0a166dfea799616cbfcd2add7ebfcddd32690608032
SHA3 40b44d48a999cc8e9b66a24ede8d0d0b65b6c850f705e30141229140f6926f75

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.41272
MD5 a594e4e8be4a4dfa2774e58a456a63b2
SHA1 63ba9dc17c2421bb1ba9c40654a28c203341845c
SHA256 a13d36bcf86786e472ad513ce02cf5a0c2284f6193ee7b2b6b807e6563fecd46
SHA3 d7c062798cacd964a4818aa7a7fc28b558811317b0c95bf76cc0d5921ad75e6d

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.09815
MD5 df242bcef229921a47a6dedb48eab31d
SHA1 7507172e8adf6be14ce0f834868b56e2e1e08d0f
SHA256 aa9d723361a75a7d3685ccc16237fde30d3b0c21862a96008e3ee5b8e8c21892
SHA3 db1dfcb58a6478ec10f05c8d45b1d43737905b90d97776d9cfe20294390d56fb

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.7351
MD5 fdc541fddb99b9171e26f5fb66bddac6
SHA1 e54ab8c2710fc07415ee22674577f43519445437
SHA256 b5f409e078fc1aebf572853c56329fc1fa2d0d8d08f21fb1a5bd7394727b465d
SHA3 a0445a532e88635617fa5a681269d58e7bc490ac603b6160fa946db3bf37d2f9

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.17387
MD5 7188c3876c2ed22cceed1e40205cc2d3
SHA1 3696ad0c5e08d3262c3e53105a102c30eec66561
SHA256 3bbea646cec0fac136e9e620fc0109c1c8adadbc87475428d29bbdb80a9b6868
SHA3 933b5f0abf8ad6e0d526389ac9bb3985d0ef48b2ff0dfe2f4d6aacf03942ca7b

105

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x100
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.66174
MD5 3409f314895161597f3c395cc5f65525
SHA1 1a99d016d65e567f24449d9362afb6ac44006d0b
SHA256 fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96
SHA3 b3b19241cc6454389e45833e50b742ae1927a5f161017350a99f2cbc66914f26

106

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x11c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.88094
MD5 2d12c45dc2c029044aaff357141cb900
SHA1 083db861ab3c7db23c6257878296e73a89a74b8b
SHA256 69897c784f1491eb3024b0d52c2897196a2e245974497fda1915db5fefcf8729
SHA3 349b5d605c9c3efe5e0c4e2faa12dd21022fc5f9b053f2cbf4e2a6b8bc656442

111

Type RT_DIALOG
Language English - United States
Codepage UNKNOWN
Size 0x60
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.48825
MD5 6be4e1387d369cf86e68eacbdd0e81dd
SHA1 351970fe2681b9b35b5d59ad052011ed96a96e17
SHA256 85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0
SHA3 45e552e173141e06d113209b6cc915042ad0b4d5531464b8dbe5637029f489cb

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.55883
Detected Filetype Icon file
MD5 6e76f5733300ec94763a4aee57790e58
SHA1 9ac9578b624211bb2fba24c80de01daf54396ded
SHA256 dc21c7239c9f57d9fc0897bebce7a9a274e226e8bc5a94da9898bf88cb6a09c5
SHA3 d98cfbde9581bc0ce04864f75f9f19bf4a2ea4c7706e30adb0c067541ad853e3

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x1f8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25924
MD5 21c260ec5f3b8897c1e3046730577875
SHA1 5112f2cda4c02eec6234f00283ff903afc38a277
SHA256 a772de604fd2e1901859290294c2d6d252b4e91d2ccbab3ddd9ba1ba137a34a1
SHA3 5acf1c964b0836f855ffa8c08502d467269243f678d2f96ac3f6a4d555709aaa

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x349
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.28747
MD5 39a5f7e944b19d4a6d666e5b22cb9189
SHA1 02ba880d90d9591390530245c9f79a8ff3e79aed
SHA256 64853bb3de406ea1dd1ca7b2acdf1e5f011236e25cf8271042b952be01e8f040
SHA3 d58d7ac1878dc0236f33fd60d22d0336f96582f4c1e4569f8d5bdadb4dc2e30c

Version Info

Signature 0xfeef04bd
StructVersion 0
FileVersion 4.1.0.0
ProductVersion 4.1.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
FileDescription Microsoft Defender Configurator
LegalCopyright Copyright * Andrzej Pluta (@Andy Ful)
ProductName ConfigureDefender
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd26650e9
Unmarked objects 0
C objects (VS2003 (.NET) build 4035) 2
Total imports 165
Imports (VS2003 (.NET) build 4035) 15
48 (9044) 10
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

[*] Warning: Section .ndata has a size of 0! [*] Warning: [plugin_authenticode] Hashing algorithm 2.16.840.1.101.3.4.2.2 is not supported.
Leave a comment

No comments yet.