e72bb17a030c9196005c02a558c3490c7f0f64b2a2b15c158b6cadba55ffcb0e

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2010-Jul-24 03:36:51
Detected languages Chinese - PRC
Chinese - Taiwan
English - United States
Comments Java Executive Created by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com)
CompanyName RegExLab's Friends Group(Created by J2E 1.8 Trial, RegExLab.com)
FileDescription Java Executive by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com)
FileVersion 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com)
InternalName J2E(Created by J2E 1.8 Trial, RegExLab.com)
LegalCopyright Copyright (c) 2007 - 2010(Created by J2E 1.8 Trial, RegExLab.com)
LegalTrademarks RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com)
OriginalFilename J2E.exe(Created by J2E 1.8 Trial, RegExLab.com)
ProductName Java Executive by Jar2Exe(Created by J2E 1.8 Trial, RegExLab.com)
ProductVersion 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com)
PrivateBuild (Created by J2E 1.8 Trial, RegExLab.com)
SpecialBuild (Created by J2E 1.8 Trial, RegExLab.com)

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Microsoft Visual C++ v5.0/v6.0 (MFC)
Info Interesting strings found in the binary: Contains domain names:
  • RegExLab.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA256
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Can access the registry:
  • RegQueryValueExA
  • RegCloseKey
  • RegOpenKeyExA
Enumerates local disk drives:
  • GetDriveTypeA
Can take screenshots:
  • CreateCompatibleDC
  • BitBlt
Info The PE's resources present abnormal characteristics. Resource 128 is possibly compressed or encrypted.
Suspicious The file contains overlay data. 2535 bytes of data starting at offset 0x45000.
The overlay data has an entropy of 7.61298 and is possibly compressed or encrypted.
Malicious VirusTotal score: 7/64 (Scanned on 2024-12-30 10:00:39) APEX: Malicious
Bkav: W32.AIDetectMalware
Gridinsoft: Ransom.Win32.Wacatac.oa!s1
Jiangmin: Worm/AutoRun.aalp
MaxSecure: Trojan.Malware.300983.susgen
Trapmine: malicious.moderate.ml.score
Zillya: Adware.BrowseFox.Win32.289567

Hashes

MD5 66a0e20af1e8394964b3ce754a9fd1d1 🔍
SHA1 082204e72b33d763a80054fbba0cfaaefc5eb98a 🔍
SHA256 e72bb17a030c9196005c02a558c3490c7f0f64b2a2b15c158b6cadba55ffcb0e 🔍
SHA3 9e8471cc5f3dd9a98fa72e5a4df2efcc5fdfac1d07eec58b647a0a30e528d2aa 🔍
SSDeep 6144:syEfg7f04wN2Z4BdrTw+WG2LjTI/SSD8qj0PYDbyjWTBfxEa4q6N9b:FEXsZ8w+WH8lD8vWTtqhN9b 🔍
Imports Hash fffb14ac9a5ac33f78eb8306450967f3 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2010-Jul-24 03:36:51
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x29000
SizeOfInitializedData 0x1b000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000DAEA (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2a000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x47000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4b73ea77169b087c5cd1e5a357585e1d 🔍
SHA1 0a555732c3949366701f7af3d71e39ebb321502f 🔍
SHA256 8bb381b67a174abe2a80c5abce762486b63ba7b3fc501d8512366c3614d12867 🔍
SHA3 84a464e8497b209913ca735aadc3222361e1b199611672274697812ba268e093 🔍
VirtualSize 0x28ff2
VirtualAddress 0x1000
SizeOfRawData 0x29000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.71318

.rdata

MD5 7247d0db96411981ea9490456ed68c33 🔍
SHA1 c741b6c533f5a3e25c995ce1d5bd9b3b2a663bd5 🔍
SHA256 051d17bca91fe81cc6878118a721e3aff8ca8db09d5f1ead9315d69d112629bf 🔍
SHA3 6de407f08a0a96e9e0d30057bc09fe9315660ff029ce912e72f24a9b014fe542 🔍
VirtualSize 0x7190
VirtualAddress 0x2a000
SizeOfRawData 0x8000
PointerToRawData 0x2a000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.65074

.data

MD5 6f56b7e0af2a9caf7d14129e511e39de 🔍
SHA1 80632aea750f21db16b71af8103323a96b75b53f 🔍
SHA256 28050308acc5b10727f6952240af56f32fd8d7dca2fee0ef9b7f02106f7c7344 🔍
SHA3 c9c38d5a9fb2d100418061b166779a0482894d8406ad3cd531f63238e9cf12b9 🔍
VirtualSize 0x5900
VirtualAddress 0x32000
SizeOfRawData 0x4000
PointerToRawData 0x32000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.34785

.rsrc

MD5 988f385c58520be3d813d4e6756a3535 🔍
SHA1 cce174e7539d44ef1ee322d0009218478b5ebdb3 🔍
SHA256 96c65ce3e41532c266b33badfe2694dbd945977d4e8b0024d814e780bb3c7a67 🔍
SHA3 201bcfa8b288ec49a0387860d2fa322eec144486b9cfcecc50552feb589a1cbd 🔍
VirtualSize 0xe7dc
VirtualAddress 0x38000
SizeOfRawData 0xf000
PointerToRawData 0x36000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.65949

Imports

KERNEL32.dll FreeLibrary
GetProcAddress
LoadLibraryA
SetErrorMode
GetFullPathNameA
SetCurrentDirectoryA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetModuleFileNameA
GetCurrentDirectoryA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetThreadPriority
GetCurrentThread
SetEvent
Sleep
WaitForSingleObject
CreateEventA
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
ExitProcess
HeapFree
RtlUnwind
HeapReAlloc
HeapAlloc
RaiseException
GetLastError
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ResumeThread
CreateThread
TlsSetValue
TlsGetValue
ExitThread
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCurrentThreadId
TlsAlloc
SetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapSize
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetFilePointer
FlushFileBuffers
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetACP
GetOEMCP
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
SetStdHandle
SetEndOfFile
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetLocalTime
GetSystemTime
MoveFileA
DeleteFileA
SetVolumeLabelA
GetDriveTypeA
GetFileAttributesA
SetFileAttributesA
GetDiskFreeSpaceA
MultiByteToWideChar
EnterCriticalSection
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
LockResource
LeaveCriticalSection
DeleteCriticalSection
GetEnvironmentStringsW
InitializeCriticalSection
SetEnvironmentVariableW
USER32.dll KillTimer
SetTimer
GetClassInfoA
LoadCursorA
RegisterClassA
GetSystemMetrics
CreateWindowExA
ShowWindow
UpdateWindow
GetClientRect
BeginPaint
EndPaint
PostQuitMessage
PostMessageA
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
LoadBitmapA
MessageBoxA
GDI32.dll DeleteObject
SelectObject
CreateCompatibleDC
DeleteDC
BitBlt
GetObjectA
ADVAPI32.dll RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Delayed Imports

_Java_com_regexlab_j2e_Handler_loadResourceData@12

Ordinal 1
Address 0x1a90

_Java_com_regexlab_j2e_Jar2ExeClassLoader_findClass@12

Ordinal 2
Address 0x1080

_Java_com_regexlab_j2e_Jar2ExeClassLoader_findResource@12

Ordinal 3
Address 0x1880

_Java_com_regexlab_j2e_Jar2ExeClassLoader_findResources@12

Ordinal 4
Address 0x1d70

_Java_com_regexlab_j2e_SplashScreen_nativeAutoClose@12

Ordinal 5
Address 0xd840

_Java_com_regexlab_j2e_SplashScreen_nativeClose@8

Ordinal 6
Address 0xd860

_Java_com_regexlab_j2e_SplashScreen_nativeGetSplashScreen@8

Ordinal 7
Address 0xd7f0

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.05936
MD5 1d038f55de4d9b4c0f29316e96d71a0b 🔍
SHA1 4a643cd832845e7ce81ddad237d0bb4158e53b31 🔍
SHA256 cde27416f65d7f95f0608244f034c0514998a1f81b0966f3e4d79ae4061371fb 🔍
SHA3 683bbfbbd348f7550c716fbd8ef5b879a629a3ee91149b6d79362de41dbc8215 🔍

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.2547
MD5 7242d3020aded4e9328cd7e26c12adb2 🔍
SHA1 15b5ba0a6a9ee3e433f2d4d48686bf2bb2457a2f 🔍
SHA256 39e959f256c26a2de99fb3f565120edc91201728922c2828ecd460dd6ea5c18d 🔍
SHA3 24650e06a72fd8da39b070b4c22c7857eef6e6ecfe7110129b5b60b9747f392b 🔍

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.73295
MD5 e3554c76818f34081aa7350e6602a47f 🔍
SHA1 91676dfccf6adf14ed489f6aeefc9b6d5005b61a 🔍
SHA256 67656964f3a3731f8671d57724e538316af7040fa7ce4824bc0555fb47a7acaf 🔍
SHA3 db9bfaa0a9f627b1af0eb766b13cf57907d8904e73c8ab370cc31f1f8e4b9793 🔍

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.69747
MD5 baecd4acce8fdf20a18259e8edbad4d8 🔍
SHA1 5544bae9b1a4e23f265be9d24bf8b561eca8c80e 🔍
SHA256 66283069f836bd8740c0dbff343590cb7b67b74f221d92cefc2366f885b47acf 🔍
SHA3 a4b67c2a242c37768491588fa7e1d0e61f7200d59042813afc5a1dcd641ebb74 🔍

1 (#2)

Type RT_STRING
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x144
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.44305
MD5 615361d318f26d9f4cc8bb296e6f956c 🔍
SHA1 8646c8557312bc01ea055b95dfb7e917ccb4c8eb 🔍
SHA256 665f025f0ea264c044efba4048bab85a63d7aafd0f5747a348e7a42e424f62a0 🔍
SHA3 c5b0b5964bdd2d328966501e384b4d010806b5c3b3dc80c85fbf787ab76da0b5 🔍

1 (#3)

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x34c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2066
MD5 32fa271a674ca22151964e08af6fbfe1 🔍
SHA1 182d8814161bc6d32b70ba51e37d090b068697d6 🔍
SHA256 6f50a79543e778d7ab79c8ba248ed8fcee8b7716f9ae388b15d601cd40eb5081 🔍
SHA3 9b030aa7be29d2f3066b820ffe750671b5cdc43ba628c4c95bfbc0d263203274 🔍

1 (#4)

Type RT_STRING
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x146
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.41995
MD5 f771084e3986b6ada8bec4ea3dfa0343 🔍
SHA1 dc353fd836280fae9349a468065c88587939242d 🔍
SHA256 d51bf0ef89660a1fd520f56333c84c0f579a0adaec02e19a0e0ccdffae99ad25 🔍
SHA3 c7458f084be32ad540c4b9996c51fcc34617179671058d293f056f231bcbe31d 🔍

128

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0xb418
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.99563
MD5 834069dd2cad1d36621064526809ab2c 🔍
SHA1 c9c2b400b1e4c9663c345fff3389097f5639009e 🔍
SHA256 a2dbd438b0b46557d488cc45658006f8b2613597685947b9bb9063a60445a13f 🔍
SHA3 9064b0ec6417485552104371b4bc353abfe3f21f62518c4413a91faba0b2be3d 🔍

1 (#5)

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x3e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.74259
Detected Filetype Icon file
MD5 1ef04dcda310f168317c2d113e4a610c 🔍
SHA1 0e995398b74ad692cf9d3bc3267fdb01ffbcb3c3 🔍
SHA256 02aec4257b2859e36a2b08073d1529b614f408829f19c78b16c9fec109b488c0 🔍
SHA3 029d46d3ff512f36ca50a5cb40dace763cf27630d3536d19d63a7a8511ae165a 🔍

1 (#6)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x7f4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.50698
MD5 350f4d7de1ec0763fd9d632ed18516cd 🔍
SHA1 04371508687b804d2b5f7531972ec05d4ff7904c 🔍
SHA256 3b6796c943e9a6298e8cdfe8fbd0b34aab4cabf88fbebc7c2d798b26a06ce886 🔍
SHA3 7910bad7c69f5ff4102d2fce01fe0c2331e9bfe290f6bb7f11de95438712f9d9 🔍

String Table contents

Java 運行環境未找到。
Java 運行環境無效。
Java 虛擬機初始化失敗。
Java 虛擬機創建失敗。
未能獲取 Java 虛擬機版本。
Java 虛擬機版本 %d.%d 太低,需要 %d.%d 或更高版本。
主啟動類未找到。
主啟動類無效,缺少 main 方法。
可執行檔生成之後不允許被修改。
錯誤
Java Runtime Environment not found.
Java Runtime Environment not valid.
Java Virtual Machine initialize failed.
Java Virtual Machine starts failed.
Can not get the virtual machine version.
Java virtual machine version %d.%d is too low, require %d.%d or higher.
The main startup class could not be found.
The main startup class is not valid, main method missing.
The exe can not be modified after it generated.
Error
Java 运行环境未找到。
Java 运行环境无效。
Java 虚拟机初始化失败。
Java 虚拟机创建失败。
未能获取 Java 虚拟机版本。
Java 虚拟机版本 %d.%d 太低,需要 %d.%d 或更高版本。
主启动类未找到。
主启动类无效,缺少 main 方法。
可执行文件生成之后不允许被修改。
错误

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.8.4.444
ProductVersion 1.8.4.444
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language UNKNOWN
Comments Java Executive Created by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com)
CompanyName RegExLab's Friends Group(Created by J2E 1.8 Trial, RegExLab.com)
FileDescription Java Executive by Jar2Exe, RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com)
FileVersion (#2) 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com)
InternalName J2E(Created by J2E 1.8 Trial, RegExLab.com)
LegalCopyright Copyright (c) 2007 - 2010(Created by J2E 1.8 Trial, RegExLab.com)
LegalTrademarks RegExLab.com(Created by J2E 1.8 Trial, RegExLab.com)
OriginalFilename J2E.exe(Created by J2E 1.8 Trial, RegExLab.com)
ProductName Java Executive by Jar2Exe(Created by J2E 1.8 Trial, RegExLab.com)
ProductVersion (#2) 1, 8, 4, 444(Created by J2E 1.8 Trial, RegExLab.com)
PrivateBuild (Created by J2E 1.8 Trial, RegExLab.com)
SpecialBuild (Created by J2E 1.8 Trial, RegExLab.com)
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x8c1c9d81
Unmarked objects 0
19 (8034) 9
Total imports 151
12 (7291) 4
14 (7299) 27
C++ objects (8047) 12
C objects (8047) 6
C objects (VS98 SP6 build 8804) 167
C++ objects (VS98 SP6 build 8804) 40
Resource objects (VS98 SP6 cvtres build 1736) 1
Linker (VC++ 6.0 SP5 imp/exp build 8447) 1

Errors

Leave a comment

No comments yet.