Manalyze report for dd83471b6002d58f8684f9c7c2548e22a57849d97665b0f39b27b141342aed53

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2012-Sep-24 02:47:40
Detected languages	English - United States
Debug artifacts	AcrobatInfo.pdb
CompanyName	Adobe Systems Incorporated
FileDescription	Adobe Acrobat
FileVersion	`11.0.0.379`
LegalCopyright	Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All rights reserved.
ProductName	Adobe Acrobat
ProductVersion	`11.0.0.379`
OriginalFilename	AcrobatInfo.exe

Plugin Output

Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryW` `Can access the registry: RegQueryValueExA RegCloseKey RegOpenKeyExA`
Info	The PE is digitally signed.	`Signer: Adobe Systems` `Issuer: VeriSign Class 3 Code Signing 2010 CA`
Safe	VirusTotal score: 0/71 (Scanned on 2026-09-24 08:04:39)	`All the AVs think this file is safe.`

Hashes

MD5	`4d5b4e80d948f559697cd7c0be566e54` 🔍
SHA1	`bedd774f0a297762c6ae0d4f49503957004c8528` 🔍
SHA256	`dd83471b6002d58f8684f9c7c2548e22a57849d97665b0f39b27b141342aed53` 🔍
SHA3	`250b6730cb41b6e28b9e04f9aac955c5ec1101f65599ff7a7e1e90f319938275` 🔍
SSDeep	`384:eGSMJ26+MHh2csggHMVtxoK8dOW3mirILc9W5E/eMUR:/SMJt+MHh78WtxoK8uIILnNR` 🔍
Imports Hash	`403f7818ea58345ded632cf7b4721f30` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xf0`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`5`
TimeDateStamp	2012-Sep-24 02:47:40
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`10.0`
SizeOfCode	`0x1200`
SizeOfInitializedData	`0x1e00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00001B8F (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x3000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`5.1`
ImageVersion	`0.0`
SubsystemVersion	`5.1`
Win32VersionValue	`0`
SizeOfImage	`0x7000`
SizeOfHeaders	`0x400`
Checksum	`0x1198c`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`5e777d5ae808f15bb8e4e6f77d70c867 🔍`
SHA1	`018d47521e975f629b4f11aa7d09735c46c4ac4e 🔍`
SHA256	`d46095e4d0a43bbe1e44852e02f9cf2ffd8249cd2da3d84ee4b31f1a641b30b1 🔍`
SHA3	`05cd4b81e2af522f0187cead05d4d70073011324abf91c8776647b1ad9733e67 🔍`
VirtualSize	`0x1058`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.79382`

.rdata

MD5	`dfcab4c527d450514dab160ef23674bb 🔍`
SHA1	`8521247a23278086e48e619030f4a28ae8eac8b7 🔍`
SHA256	`62507f33c9c8d7832bd24cd4fcbf0f8901ed2f17b041d0519f90556355a234da 🔍`
SHA3	`0ea5ce1d24634bdaaa180846e54ad787981480699442300496442c91a0748d1e 🔍`
VirtualSize	`0xa1a`
VirtualAddress	`0x3000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x1600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.50782`

.data

MD5	`3395948ff99a4414eb23a9da06b24dac 🔍`
SHA1	`9e8449e0bf9728fb3a2ffbbc383f4ace6620148f 🔍`
SHA256	`a7db9c3028c163323560e716d226515a589b68c8b12a89d53e8874841cef439d 🔍`
SHA3	`2a9537f7bd217d894c2c5cab8c55a936d78d22d77a7b7c0e7fd02b376b7b7bad 🔍`
VirtualSize	`0x3bc`
VirtualAddress	`0x4000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.393689`

.rsrc

MD5	`d7d002eb2170e65ab35786ed0ef6ab72 🔍`
SHA1	`4cdbe382381aa46b87a4052d8574ed9a261329bf 🔍`
SHA256	`c3c8a85a21f205164a5cc57565c5fd1a81291d7189e65c8263b6f4c48606c749 🔍`
SHA3	`96fdfef1a01d523e2f0307cab8b51549d06d8cd47529cb0a4cf0f332a21fc46e 🔍`
VirtualSize	`0xa38`
VirtualAddress	`0x5000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x2400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.1613`

.reloc

MD5	`65c1fbb918c12d5d6f1a037376457ae9 🔍`
SHA1	`05738764e1387e23ce4d9bcc328d81064eac3da1 🔍`
SHA256	`d54de676bbb1441651e32beea94cd0f6b0f9574d253a265db7d237a7d3d723ae 🔍`
SHA3	`adfd643e9ae00e887c938ac7eb791f011e468ea39464161dea504d5014d7c7ac 🔍`
VirtualSize	`0x2d0`
VirtualAddress	`0x6000`
SizeOfRawData	`0x400`
PointerToRawData	`0x3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`4.3292`

Imports

KERNEL32.dll	`HeapSetInformation` `GetCurrentProcess` `GetProcAddress` `GetModuleHandleW` `GetModuleHandleA` `GetFileAttributesW` `GetVersionExW` `LoadLibraryW` `GetLastError` `SetLastError` `OutputDebugStringA` `SetUnhandledExceptionFilter` `GetProcessHeap` `FreeLibrary` `GetVersion` `GetModuleFileNameW` `GetCurrentProcessId` `GetCurrentThreadId` `GetTickCount` `QueryPerformanceCounter` `DecodePointer` `IsDebuggerPresent` `UnhandledExceptionFilter` `TerminateProcess` `EncodePointer` `GetStartupInfoW` `InterlockedCompareExchange` `Sleep` `GetSystemTimeAsFileTime` `InterlockedExchange`
ADVAPI32.dll	`RegQueryValueExA` `RegCloseKey` `RegOpenKeyExA`
MSVCR100.dll	`exit` `_wcmdln` `_initterm` `_initterm_e` `_configthreadlocale` `__setusermatherr` `_commode` `_fmode` `__set_app_type` `_crt_debugger_hook` `?terminate@@YAXXZ` `_unlock` `__dllonexit` `_lock` `_onexit` `_invoke_watson` `_controlfp_s` `_XcptFilter` `_cexit` `__wgetmainargs` `_amsg_exit` `_except_handler4_common` `wcsstr` `memset` `_get_heap_handle` `malloc` `wcsrchr` `wcsncpy_s` `free` `wcsncat_s` `_exit`

Delayed Imports

API_ADOBE_PUBLIC_KEY

Type	`RT_RCDATA`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x5e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.84055`
MD5	`1cc0aabe89ab70e5bda666bfd232c80f 🔍`
SHA1	`45f20f523d0b3e792ff39f5bd5f58c5dde735025 🔍`
SHA256	`0c9e3cfe505fe3d243aa39f9582914f8094b02331718bb47367ee8de2d6f00b5 🔍`
SHA3	`62242443b938921664b292427bad06638c27fca0521fa861aaa4c5afd4ede878 🔍`

T405_ADOBE_PUBLIC_KEY

Type	`RT_RCDATA`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x5e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.92981`
MD5	`03caabc8b39f673b724d95f4880058ad 🔍`
SHA1	`c384515de3e978d4f5414bdd3cebe786843379b4 🔍`
SHA256	`789ee8f24d7b3990571de12ae327f0e8dcc15fcf18d89a43dc7d9bfbf12380f7 🔍`
SHA3	`736c3e74d9aba77b8f240b94c14b97e89b0239799670ceac34119d5c449f652c 🔍`

1

Type	`RT_VERSION`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x45a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.42875`
MD5	`3f9420716b9c9077a23aa157665b3bf9 🔍`
SHA1	`03580c0075b116d07674349895a652994715fdc5 🔍`
SHA256	`647250bba54fe92a9c011fde78437648bb1003e96835ebd3e8727f1a1518dc5a 🔍`
SHA3	`28343fcc375e6503a99c82518a88699a6185d7c928002d48c7d340a12fcf37c4 🔍`

1 (#2)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x3ac`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.17861`
MD5	`318cfaea8f5be6e3d9436f6b045a6954 🔍`
SHA1	`8b84f6a82093f83a3fa677d91cc61f4fe287be0b 🔍`
SHA256	`04b37f4dbfc681436cc2906c997d6ad1bacd8a4d9accdadc03038b5c213b3590 🔍`
SHA3	`6fdf7f5a0a4aaff8bf7d9bdb70f5ae82861a997ac14bae91cc424548f1bd9b10 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	11.0.0.379
ProductVersion	11.0.0.379
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS` `VOS_DOS_WINDOWS16` `VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_OS232` `VOS_OS232_PM32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	Adobe Systems Incorporated
FileDescription	Adobe Acrobat
FileVersion (#2)	11.0.0.379
LegalCopyright	Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All rights reserved.
ProductName	Adobe Acrobat
ProductVersion (#2)	11.0.0.379
OriginalFilename	AcrobatInfo.exe

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2012-Sep-24 02:47:40
Version	`0.0`
SizeofData	`40`
AddressOfRawData	`0x3388`
PointerToRawData	`0x1988`
Referenced File	AcrobatInfo.pdb

TLS Callbacks

Load Configuration

Size	`0x48`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x404004`
SEHandlerTable	`0x4033b0`
SEHandlerCount	`1`

RICH Header

XOR Key	`0x95ae6989`
Unmarked objects	`0`
Imports (VS2010 SP1 build 40219)	`2`
ASM objects (VS2010 SP1 build 40219)	`2`
C objects (VS2010 SP1 build 40219)	`19`
Imports (VS2008 SP1 build 30729)	`5`
Total imports	`64`
C++ objects (VS2010 SP1 build 40219)	`4`
Resource objects (VS2010 SP1 build 40219)	`1`
Linker (VS2010 SP1 build 40219)	`1`

Errors

Leave a comment

No comments yet.