| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2004-Aug-21 07:51:15 |
| Suspicious | PEiD Signature: | FreeBASIC 0.16b |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Manipulates other processes:
|
| Suspicious | VirusTotal score: 2/72 (Scanned on 2025-10-01 01:40:14) |
Kingsoft:
Win32.Troj.Undef.a
VirIT: Trojan.Win32.Generic.APQA |
| MD5 | df1817e2622d1aeca01e31b22533ba84 🔍 |
|---|---|
| SHA1 | 43e761e6427225c082876620e3a1660d503ad623 🔍 |
| SHA256 | d25c0429e4b0259d736c0b0aa877abcc7460143815f0f5a707ac24a1866b8fdc 🔍 |
| SHA3 | d6b9cc91693dbec1e6f6eac1831bbae6799da7c02c9fc6abd0d8ec59f1a489e8 🔍 |
| SSDeep | 192:8b2FNC3hbOdr2jILbXVolyk0nQMO4UZ6GKXvoY:8bC9GulolwRHUZ6GKXwY 🔍 |
| Imports Hash | 6f3fc667205b06c5788abd93c75dbc56 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2004-Aug-21 07:51:15 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x1200 |
| SizeOfInitializedData | 0x1a00 |
| SizeOfUninitializedData | 0x200 |
| AddressOfEntryPoint | 0x00001230 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x3000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 1.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x6000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x9d1f |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| SizeofStackReserve | 0x200000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 80d01b9415c2586a69662c3fd7b3942d 🔍 |
|---|---|
| SHA1 | afd5fc5bdef978e666f8c8ddf2eb3d2f7bf1c441 🔍 |
| SHA256 | 5e28086635c8eabe3f4e0d69740dbac0a90397902e296a2d12545ee86c8de4b3 🔍 |
| SHA3 | 61b7337bda1d4bf46d5f84210045245cbdf87a958edba5f8744e5adcf46cd478 🔍 |
| VirtualSize | 0x1044 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x1200 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.36299 |
| MD5 | 0f11f37c44302c7476e23969df9fcf86 🔍 |
|---|---|
| SHA1 | f262e644105270ad1c23f4929caffbc51c6e780d 🔍 |
| SHA256 | dff58b096f05598750953069858009171be486baac46ee22ff05543a15116710 🔍 |
| SHA3 | 97e14451dd6c3c7d97c369e30cfe023f9a3b661e2fecb6bc6619b0085964af83 🔍 |
| VirtualSize | 0x40 |
| VirtualAddress | 0x3000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x1600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0.232313 |
| MD5 | d41d8cd98f00b204e9800998ecf8427e 🔍 |
|---|---|
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍 |
| SHA3 | a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍 |
| VirtualSize | 0xb0 |
| VirtualAddress | 0x4000 |
| SizeOfRawData | 0 |
| PointerToRawData | 0 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| MD5 | fecf2e800f85a7ae8bd22132fe8e51cf 🔍 |
|---|---|
| SHA1 | 0e8fc1777fd85484ce3c57d086185f986bbba1fc 🔍 |
| SHA256 | e9d8121a59048defad9d4edf54d43db34bc3221b2d1a7534b99a5b23c4baa424 🔍 |
| SHA3 | 6d896800f159cedea1407be776192d4f10cd77500533a74640264c9b3fc809b2 🔍 |
| VirtualSize | 0x404 |
| VirtualAddress | 0x5000 |
| SizeOfRawData | 0x600 |
| PointerToRawData | 0x1800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 3.14044 |
| KERNEL32.dll |
AddAtomA
CloseHandle CreateDirectoryA ExitProcess FindAtomA GetAtomNameA GetCurrentDirectoryA GetLastError OpenProcess ReadProcessMemory SetUnhandledExceptionFilter |
|---|---|
| msvcrt.dll |
_strdup
|
| msvcrt.dll (#2) |
_strdup
|
No comments yet.