| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2010-Jul-24 03:36:51 |
| Detected languages |
Chinese - PRC
Chinese - Taiwan English - United States |
| Comments | Java Executive Created by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com) |
| CompanyName | RegExLab's Friends Group(Created by J2E 1.8 Trial, RegExLab.com) |
| FileDescription | Java Executive by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com) |
| FileVersion | 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com) |
| InternalName | J2E(Created by J2E 1.8 Trial, RegExLab.com) |
| LegalCopyright | Copyright (c) 2007 - 2010(Created by J2E 1.8 Trial, RegExLab.com) |
| LegalTrademarks | RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com) |
| OriginalFilename | J2E.exe(Created by J2E 1.8 Trial, RegExLab.com) |
| ProductName | Java Executive by Jar2Exe(Created by J2E 1.8 Trial, RegExLab.com) |
| ProductVersion | 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com) |
| PrivateBuild | (Created by J2E 1.8 Trial, RegExLab.com) |
| SpecialBuild | (Created by J2E 1.8 Trial, RegExLab.com) |
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ Microsoft Visual C++ v6.0 Microsoft Visual C++ v5.0/v6.0 (MFC) |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA256 |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource 128 is possibly compressed or encrypted. |
| Suspicious | The file contains overlay data. |
2535 bytes of data starting at offset 0x45000.
The overlay data has an entropy of 7.61298 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 7/64 (Scanned on 2024-12-30 10:00:39) |
APEX:
Malicious
Bkav: W32.AIDetectMalware Gridinsoft: Ransom.Win32.Wacatac.oa!s1 Jiangmin: Worm/AutoRun.aalp MaxSecure: Trojan.Malware.300983.susgen Trapmine: malicious.moderate.ml.score Zillya: Adware.BrowseFox.Win32.289567 |
| MD5 | 66a0e20af1e8394964b3ce754a9fd1d1 🔍 |
|---|---|
| SHA1 | 082204e72b33d763a80054fbba0cfaaefc5eb98a 🔍 |
| SHA256 | e72bb17a030c9196005c02a558c3490c7f0f64b2a2b15c158b6cadba55ffcb0e 🔍 |
| SHA3 | 9e8471cc5f3dd9a98fa72e5a4df2efcc5fdfac1d07eec58b647a0a30e528d2aa 🔍 |
| SSDeep | 6144:syEfg7f04wN2Z4BdrTw+WG2LjTI/SSD8qj0PYDbyjWTBfxEa4q6N9b:FEXsZ8w+WH8lD8vWTtqhN9b 🔍 |
| Imports Hash | fffb14ac9a5ac33f78eb8306450967f3 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2010-Jul-24 03:36:51 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x29000 |
| SizeOfInitializedData | 0x1b000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000DAEA (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x2a000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x47000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | 4b73ea77169b087c5cd1e5a357585e1d 🔍 |
|---|---|
| SHA1 | 0a555732c3949366701f7af3d71e39ebb321502f 🔍 |
| SHA256 | 8bb381b67a174abe2a80c5abce762486b63ba7b3fc501d8512366c3614d12867 🔍 |
| SHA3 | 84a464e8497b209913ca735aadc3222361e1b199611672274697812ba268e093 🔍 |
| VirtualSize | 0x28ff2 |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0x29000 |
| PointerToRawData | 0x1000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.71318 |
| MD5 | 7247d0db96411981ea9490456ed68c33 🔍 |
|---|---|
| SHA1 | c741b6c533f5a3e25c995ce1d5bd9b3b2a663bd5 🔍 |
| SHA256 | 051d17bca91fe81cc6878118a721e3aff8ca8db09d5f1ead9315d69d112629bf 🔍 |
| SHA3 | 6de407f08a0a96e9e0d30057bc09fe9315660ff029ce912e72f24a9b014fe542 🔍 |
| VirtualSize | 0x7190 |
| VirtualAddress | 0x2a000 |
| SizeOfRawData | 0x8000 |
| PointerToRawData | 0x2a000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 5.65074 |
| MD5 | 6f56b7e0af2a9caf7d14129e511e39de 🔍 |
|---|---|
| SHA1 | 80632aea750f21db16b71af8103323a96b75b53f 🔍 |
| SHA256 | 28050308acc5b10727f6952240af56f32fd8d7dca2fee0ef9b7f02106f7c7344 🔍 |
| SHA3 | c9c38d5a9fb2d100418061b166779a0482894d8406ad3cd531f63238e9cf12b9 🔍 |
| VirtualSize | 0x5900 |
| VirtualAddress | 0x32000 |
| SizeOfRawData | 0x4000 |
| PointerToRawData | 0x32000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 2.34785 |
| MD5 | 988f385c58520be3d813d4e6756a3535 🔍 |
|---|---|
| SHA1 | cce174e7539d44ef1ee322d0009218478b5ebdb3 🔍 |
| SHA256 | 96c65ce3e41532c266b33badfe2694dbd945977d4e8b0024d814e780bb3c7a67 🔍 |
| SHA3 | 201bcfa8b288ec49a0387860d2fa322eec144486b9cfcecc50552feb589a1cbd 🔍 |
| VirtualSize | 0xe7dc |
| VirtualAddress | 0x38000 |
| SizeOfRawData | 0xf000 |
| PointerToRawData | 0x36000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.65949 |
| KERNEL32.dll |
FreeLibrary
GetProcAddress LoadLibraryA SetErrorMode GetFullPathNameA SetCurrentDirectoryA CloseHandle ReadFile GetFileSize CreateFileA GetModuleFileNameA GetCurrentDirectoryA UnmapViewOfFile MapViewOfFile CreateFileMappingA SetThreadPriority GetCurrentThread SetEvent Sleep WaitForSingleObject CreateEventA InterlockedExchange InterlockedDecrement InterlockedIncrement GetCommandLineA GetVersion ExitProcess HeapFree RtlUnwind HeapReAlloc HeapAlloc RaiseException GetLastError FindFirstFileA FindNextFileA FindClose FileTimeToSystemTime FileTimeToLocalFileTime ResumeThread CreateThread TlsSetValue TlsGetValue ExitThread LCMapStringA LCMapStringW GetCPInfo CompareStringA CompareStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetCurrentThreadId TlsAlloc SetLastError GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree WriteFile HeapSize VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter SetFilePointer FlushFileBuffers GetStringTypeA GetStringTypeW GetTimeZoneInformation GetACP GetOEMCP IsBadReadPtr IsBadCodePtr SetEnvironmentVariableA SetStdHandle SetEndOfFile SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime GetLocalTime GetSystemTime MoveFileA DeleteFileA SetVolumeLabelA GetDriveTypeA GetFileAttributesA SetFileAttributesA GetDiskFreeSpaceA MultiByteToWideChar EnterCriticalSection GetModuleHandleA FindResourceA SizeofResource LoadResource LockResource LeaveCriticalSection DeleteCriticalSection GetEnvironmentStringsW InitializeCriticalSection SetEnvironmentVariableW |
|---|---|
| USER32.dll |
KillTimer
SetTimer GetClassInfoA LoadCursorA RegisterClassA GetSystemMetrics CreateWindowExA ShowWindow UpdateWindow GetClientRect BeginPaint EndPaint PostQuitMessage PostMessageA DefWindowProcA GetMessageA TranslateMessage DispatchMessageA LoadBitmapA MessageBoxA |
| GDI32.dll |
DeleteObject
SelectObject CreateCompatibleDC DeleteDC BitBlt GetObjectA |
| ADVAPI32.dll |
RegQueryValueExA
RegCloseKey RegOpenKeyExA |
| Ordinal | 1 |
|---|---|
| Address | 0x1a90 |
| Ordinal | 2 |
|---|---|
| Address | 0x1080 |
| Ordinal | 3 |
|---|---|
| Address | 0x1880 |
| Ordinal | 4 |
|---|---|
| Address | 0x1d70 |
| Ordinal | 5 |
|---|---|
| Address | 0xd840 |
| Ordinal | 6 |
|---|---|
| Address | 0xd860 |
| Ordinal | 7 |
|---|---|
| Address | 0xd7f0 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0xea8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.05936 |
| MD5 | 1d038f55de4d9b4c0f29316e96d71a0b 🔍 |
| SHA1 | 4a643cd832845e7ce81ddad237d0bb4158e53b31 🔍 |
| SHA256 | cde27416f65d7f95f0608244f034c0514998a1f81b0966f3e4d79ae4061371fb 🔍 |
| SHA3 | 683bbfbbd348f7550c716fbd8ef5b879a629a3ee91149b6d79362de41dbc8215 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x8a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.2547 |
| MD5 | 7242d3020aded4e9328cd7e26c12adb2 🔍 |
| SHA1 | 15b5ba0a6a9ee3e433f2d4d48686bf2bb2457a2f 🔍 |
| SHA256 | 39e959f256c26a2de99fb3f565120edc91201728922c2828ecd460dd6ea5c18d 🔍 |
| SHA3 | 24650e06a72fd8da39b070b4c22c7857eef6e6ecfe7110129b5b60b9747f392b 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x6c8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.73295 |
| MD5 | e3554c76818f34081aa7350e6602a47f 🔍 |
| SHA1 | 91676dfccf6adf14ed489f6aeefc9b6d5005b61a 🔍 |
| SHA256 | 67656964f3a3731f8671d57724e538316af7040fa7ce4824bc0555fb47a7acaf 🔍 |
| SHA3 | db9bfaa0a9f627b1af0eb766b13cf57907d8904e73c8ab370cc31f1f8e4b9793 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x568 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.69747 |
| MD5 | baecd4acce8fdf20a18259e8edbad4d8 🔍 |
| SHA1 | 5544bae9b1a4e23f265be9d24bf8b561eca8c80e 🔍 |
| SHA256 | 66283069f836bd8740c0dbff343590cb7b67b74f221d92cefc2366f885b47acf 🔍 |
| SHA3 | a4b67c2a242c37768491588fa7e1d0e61f7200d59042813afc5a1dcd641ebb74 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | Chinese - Taiwan |
| Codepage | Latin 1 / Western European |
| Size | 0x144 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.44305 |
| MD5 | 615361d318f26d9f4cc8bb296e6f956c 🔍 |
| SHA1 | 8646c8557312bc01ea055b95dfb7e917ccb4c8eb 🔍 |
| SHA256 | 665f025f0ea264c044efba4048bab85a63d7aafd0f5747a348e7a42e424f62a0 🔍 |
| SHA3 | c5b0b5964bdd2d328966501e384b4d010806b5c3b3dc80c85fbf787ab76da0b5 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x34c |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.2066 |
| MD5 | 32fa271a674ca22151964e08af6fbfe1 🔍 |
| SHA1 | 182d8814161bc6d32b70ba51e37d090b068697d6 🔍 |
| SHA256 | 6f50a79543e778d7ab79c8ba248ed8fcee8b7716f9ae388b15d601cd40eb5081 🔍 |
| SHA3 | 9b030aa7be29d2f3066b820ffe750671b5cdc43ba628c4c95bfbc0d263203274 🔍 |
| Type |
RT_STRING
|
|---|---|
| Language | Chinese - PRC |
| Codepage | Latin 1 / Western European |
| Size | 0x146 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.41995 |
| MD5 | f771084e3986b6ada8bec4ea3dfa0343 🔍 |
| SHA1 | dc353fd836280fae9349a468065c88587939242d 🔍 |
| SHA256 | d51bf0ef89660a1fd520f56333c84c0f579a0adaec02e19a0e0ccdffae99ad25 🔍 |
| SHA3 | c7458f084be32ad540c4b9996c51fcc34617179671058d293f056f231bcbe31d 🔍 |
| Type |
RT_RCDATA
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0xb418 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.99563 |
| MD5 | 834069dd2cad1d36621064526809ab2c 🔍 |
| SHA1 | c9c2b400b1e4c9663c345fff3389097f5639009e 🔍 |
| SHA256 | a2dbd438b0b46557d488cc45658006f8b2613597685947b9bb9063a60445a13f 🔍 |
| SHA3 | 9064b0ec6417485552104371b4bc353abfe3f21f62518c4413a91faba0b2be3d 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x3e |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.74259 |
| Detected Filetype | Icon file |
| MD5 | 1ef04dcda310f168317c2d113e4a610c 🔍 |
| SHA1 | 0e995398b74ad692cf9d3bc3267fdb01ffbcb3c3 🔍 |
| SHA256 | 02aec4257b2859e36a2b08073d1529b614f408829f19c78b16c9fec109b488c0 🔍 |
| SHA3 | 029d46d3ff512f36ca50a5cb40dace763cf27630d3536d19d63a7a8511ae165a 🔍 |
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | Latin 1 / Western European |
| Size | 0x7f4 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.50698 |
| MD5 | 350f4d7de1ec0763fd9d632ed18516cd 🔍 |
| SHA1 | 04371508687b804d2b5f7531972ec05d4ff7904c 🔍 |
| SHA256 | 3b6796c943e9a6298e8cdfe8fbd0b34aab4cabf88fbebc7c2d798b26a06ce886 🔍 |
| SHA3 | 7910bad7c69f5ff4102d2fce01fe0c2331e9bfe290f6bb7f11de95438712f9d9 🔍 |
| Java 運行環境未找到。 |
| Java 運行環境無效。 |
| Java 虛擬機初始化失敗。 |
| Java 虛擬機創建失敗。 |
| 未能獲取 Java 虛擬機版本。 |
| Java 虛擬機版本 %d.%d 太低,需要 %d.%d 或更高版本。 |
| 主啟動類未找到。 |
| 主啟動類無效,缺少 main 方法。 |
| 可執行檔生成之後不允許被修改。 |
| 錯誤 |
| Java Runtime Environment not found. |
| Java Runtime Environment not valid. |
| Java Virtual Machine initialize failed. |
| Java Virtual Machine starts failed. |
| Can not get the virtual machine version. |
| Java virtual machine version %d.%d is too low, require %d.%d or higher. |
| The main startup class could not be found. |
| The main startup class is not valid, main method missing. |
| The exe can not be modified after it generated. |
| Error |
| Java 运行环境未找到。 |
| Java 运行环境无效。 |
| Java 虚拟机初始化失败。 |
| Java 虚拟机创建失败。 |
| 未能获取 Java 虚拟机版本。 |
| Java 虚拟机版本 %d.%d 太低,需要 %d.%d 或更高版本。 |
| 主启动类未找到。 |
| 主启动类无效,缺少 main 方法。 |
| 可执行文件生成之后不允许被修改。 |
| 错误 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.8.4.444 |
| ProductVersion | 1.8.4.444 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_UNKNOWN
|
| Language | UNKNOWN |
| Comments | Java Executive Created by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com) |
| CompanyName | RegExLab's Friends Group(Created by J2E 1.8 Trial, RegExLab.com) |
| FileDescription | Java Executive by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com) |
| FileVersion (#2) | 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com) |
| InternalName | J2E(Created by J2E 1.8 Trial, RegExLab.com) |
| LegalCopyright | Copyright (c) 2007 - 2010(Created by J2E 1.8 Trial, RegExLab.com) |
| LegalTrademarks | RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com) |
| OriginalFilename | J2E.exe(Created by J2E 1.8 Trial, RegExLab.com) |
| ProductName | Java Executive by Jar2Exe(Created by J2E 1.8 Trial, RegExLab.com) |
| ProductVersion (#2) | 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com) |
| PrivateBuild | (Created by J2E 1.8 Trial, RegExLab.com) |
| SpecialBuild | (Created by J2E 1.8 Trial, RegExLab.com) |
| Resource LangID | English - United States |
|---|
| XOR Key | 0x8c1c9d81 |
|---|---|
| Unmarked objects | 0 |
| 19 (8034) | 9 |
| Total imports | 151 |
| 12 (7291) | 4 |
| 14 (7299) | 27 |
| C++ objects (8047) | 12 |
| C objects (8047) | 6 |
| C objects (VS98 SP6 build 8804) | 167 |
| C++ objects (VS98 SP6 build 8804) | 40 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 1 |
No comments yet.