ed170d301a4c3510dccc74886000b649b0606a56b9bcdda7fe574cf6bb43b4e0

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2001-Aug-10 19:20:12
Detected languages English - United States
CompanyName Microsoft Corporation
FileDescription Age of Empires II Expansion
FileVersion 00.07.26.0809
InternalName AGE2_X1
LegalCopyright Copyright © Microsoft Corp. 2001
OriginalFilename AGE2_X1.EXE
ProductName Age of Empires II Expansion
ProductVersion 2.1

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Microsoft Visual C++ v5.0/v6.0 (MFC)
Suspicious PEiD Signature: SafeDisc v4
UPolyX V0.1 -> Delikon
SafeDisc 4
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Suspicious The PE is possibly packed. Unusual section name found: THIS_COD
Unusual section name found: THIS_DAT
Unusual section name found: Inf32Dat
Unusual section name found: .patch
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • FindWindowA
Code injection capabilities (PowerLoader):
  • FindWindowA
  • GetWindowLongA
Can access the registry:
  • RegCreateKeyExA
  • RegSetValueExA
  • RegCloseKey
  • RegQueryValueExA
Possibly launches other programs:
  • WinExec
Can create temporary files:
  • GetTempPathA
  • CreateFileA
Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetForegroundWindow
  • GetAsyncKeyState
Enumerates local disk drives:
  • GetDriveTypeA
  • GetVolumeInformationA
Can take screenshots:
  • FindWindowA
  • GetDC
Reads the contents of the clipboard:
  • GetClipboardData
Safe VirusTotal score: 0/71 (Scanned on 2026-05-29 17:21:24) All the AVs think this file is safe.

Hashes

MD5 298e6c66f52a05306b1f56c4b9440e7a 🔍
SHA1 71339da7f8c94ea3e4a8b9b1d0b6ee029b55c3db 🔍
SHA256 ed170d301a4c3510dccc74886000b649b0606a56b9bcdda7fe574cf6bb43b4e0 🔍
SHA3 1f7e653beccc51302f3dc70cc4f624a43f9b09044228e2e4f6f118495b2e278a 🔍
SSDeep 49152:oso6B34HdejCw8plPGyw2yOD8ywpfKxvmZRGJvR:osoTd7w8lw2yOYywpf6mZRG 🔍
Imports Hash 123bac45e54331dfbdfcac9f7bac931f 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 9
TimeDateStamp 2001-Aug-10 19:20:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x234000
SizeOfInitializedData 0x170000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00217522 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x235000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x412000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 0b7287582afcb57b977992eeac7b6da2 🔍
SHA1 ab5e04f8aef8bec49f9073f1243eaadfecca28ec 🔍
SHA256 a33068ca96432dbba48780f59d78c218b7dbe060f53ab67495c301afc4f2e714 🔍
SHA3 03c27fd7f52e334322d927a5ca23ce94984a6fc24289300707108271a0aaf44e 🔍
VirtualSize 0x227199
VirtualAddress 0x1000
SizeOfRawData 0x228000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.51113

THIS_COD

MD5 8f97c57637770de3c9e617c50c5b6425 🔍
SHA1 34b2b8249692d7df358234d80506e11450aa8054 🔍
SHA256 221ff66431490865dda0be1cb729156b291b13bb8b3b1564a393f0d54361d3ce 🔍
SHA3 82650bf1382396a76bbb8fa436fa973bfcad9e84e71ef7ddecf713e329a0f26f 🔍
VirtualSize 0xb979
VirtualAddress 0x229000
SizeOfRawData 0xc000
PointerToRawData 0x229000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.98275

.rdata

MD5 4c0efefbc7b8dd984b8c699490b83d21 🔍
SHA1 6353db55c1890f68e08afb2ac366d526eab433e0 🔍
SHA256 7f88f6ebbb898a05798dcf4eb2d5e5667b471c9a6dd4a0b623503cbbf1acaeb6 🔍
SHA3 b70da786349dd8b0df8039c38b796c4de498e2e0b2009b6b58206b9e79456adf 🔍
VirtualSize 0x35475
VirtualAddress 0x235000
SizeOfRawData 0x36000
PointerToRawData 0x235000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.43859

.data

MD5 aec59f6615aaed813379ac35dd8038a2 🔍
SHA1 ed2c2e65225c690367649b643712add01c5fcfc3 🔍
SHA256 4eb0d008b8deb6f5929d93cf9c4695c7feacb8ae0cc2470a5b16abaeb56a05c1 🔍
SHA3 2d48ae8adea312db9d0121d44be1f04b6a99687ecf30d087e258f3357ccb1ade 🔍
VirtualSize 0x129168
VirtualAddress 0x26b000
SizeOfRawData 0x18000
PointerToRawData 0x26b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.19307

THIS_DAT

MD5 620f0b67a91f7f74151bc5be745b7110 🔍
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 🔍
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7 🔍
SHA3 a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563 🔍
VirtualSize 0xbc
VirtualAddress 0x395000
SizeOfRawData 0x1000
PointerToRawData 0x283000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

Inf32Dat

MD5 c324946ce1884cae603d6f4aa055ac8c 🔍
SHA1 cab3203eedd68ad0cea45ee47b1d7866bb208b9a 🔍
SHA256 61d9e6520ef1b93e440f9c235baca40cac8a44cd938a93019acb62f220d02cb9 🔍
SHA3 e727ea3958170dc0f6d6ceb95fd01f78ecb72e1a27df89d7d18143e9e82d9fd3 🔍
VirtualSize 0xad90
VirtualAddress 0x396000
SizeOfRawData 0xb000
PointerToRawData 0x284000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 bfbe9a506e752cf8c2deefaef159057e 🔍
SHA1 54867d029a9f311749ef1c479f587c7d6486a17a 🔍
SHA256 a5654fdb8d4a31701671eeafaae26eda9b9761a6359f79d107c182e8923bfcb9 🔍
SHA3 33af59e377efc7d824543b048371943b8418f96a0a0425f6c919af9e5fd52304 🔍
VirtualSize 0x3866
VirtualAddress 0x3a1000
SizeOfRawData 0x4000
PointerToRawData 0x28f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.1099

.pdata

MD5 c6718b060128b51e63fe309d5ee63680 🔍
SHA1 3b1c39658acda47134a0f5852fc8dc129ad03b34 🔍
SHA256 962fc6cc07538339c944d1c30ae71be11499dc148f583ed74b054b40d0e1272c 🔍
SHA3 8051fbc70e77ae86a2eb7be72c5b6954d842524252544d458259c085fd6f8242 🔍
VirtualSize 0x1000
VirtualAddress 0x3a5000
SizeOfRawData 0x1000
PointerToRawData 0x293000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.199875

.patch

MD5 c00d19754edc40e6ab01cc6ccfe835a7 🔍
SHA1 31532a4b75c65dd4573721bda6a0a8c6a3be317f 🔍
SHA256 c0bcec7249c80eadc6b6c097e04a74bb07129be6a495b380c9e4cb1bcd240c80 🔍
SHA3 987d6d139e1260206576d6ed8862712fd5fb223fd5159530874f75d17e51a0e5 🔍
VirtualSize 0x6c000
VirtualAddress 0x3a6000
SizeOfRawData 0x6c000
PointerToRawData 0x294000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.63141

Imports

VERSION.dll GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
MSVFW32.dll ICInfo
MCIWndCreateA
WINMM.dll mixerGetControlDetailsA
timeGetTime
mixerSetControlDetails
mixerGetLineControlsA
timeEndPeriod
mciGetErrorStringA
mixerClose
timeBeginPeriod
mixerOpen
mciSendCommandA
mixerGetNumDevs
mixerGetLineInfoA
KERNEL32.dll GetProcAddress
GetVersionExA
SetEndOfFile
MapViewOfFile
GetDiskFreeSpaceA
CreateFileMappingA
UnmapViewOfFile
GetTempFileNameA
VirtualFree
ReleaseSemaphore
SetThreadPriority
SetPriorityClass
GetPriorityClass
GetThreadPriority
WaitForSingleObject
CreateSemaphoreA
GetCurrentProcess
GetCurrentThread
IsDBCSLeadByte
GlobalUnlock
GlobalLock
GlobalMemoryStatus
FreeLibrary
GetTempPathA
GetFileAttributesA
CreateDirectoryA
SetLastError
GetFileSize
SetFilePointer
DeleteFileA
GetACP
FindResourceA
GlobalHandle
_lclose
_hread
GlobalReAlloc
OpenFile
_lread
_llseek
FindNextFileA
GetCurrentDirectoryA
MulDiv
ReleaseMutex
CreateMutexA
UnhandledExceptionFilter
FreeEnvironmentStringsA
WriteFile
FindFirstFileA
FindClose
GlobalAlloc
ReadFile
GlobalFree
CompareStringA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringW
WinExec
OutputDebugStringA
GetModuleFileNameA
GetDriveTypeA
GetSystemTime
CreateFileA
CloseHandle
GetTimeFormatA
GetVolumeInformationA
GetDateFormatA
LoadLibraryA
IsBadWritePtr
VirtualAlloc
HeapReAlloc
SetHandleCount
TerminateProcess
WideCharToMultiByte
GetCPInfo
GetStdHandle
SetStdHandle
GetModuleHandleA
GetOEMCP
HeapCreate
MultiByteToWideChar
LCMapStringA
LCMapStringW
RaiseException
HeapSize
GetStringTypeA
GetStringTypeW
LockResource
LoadResource
GetLastError
GetLocalTime
GetTimeZoneInformation
FileTimeToLocalFileTime
FileTimeToSystemTime
RtlUnwind
HeapFree
HeapAlloc
GetFileType
SetEnvironmentVariableA
SetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
USER32.dll PostQuitMessage
GetCapture
TranslateMessage
SystemParametersInfoA
GetWindowThreadProcessId
GetSysColor
SetSysColors
DrawTextExA
FillRect
UpdateWindow
GetSystemMetrics
KillTimer
GetFocus
SetTimer
SetWindowTextA
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
MessageBeep
FindWindowA
GetCaretBlinkTime
SetRect
DrawTextA
GetKeyNameTextA
MapVirtualKeyA
GetParent
DefWindowProcA
ReleaseDC
ShowWindow
SetFocus
LoadCursorA
CallWindowProcA
SendMessageA
GetWindowLongA
SetWindowLongA
GetClientRect
MoveWindow
InvalidateRect
SetCursor
SetClassLongA
MessageBoxA
CreateWindowExA
CharUpperA
DestroyWindow
IsWindow
SetCursorPos
GetKeyState
ClientToScreen
ScreenToClient
GetKeyboardState
GetForegroundWindow
GetWindowRect
GetCursorPos
PostMessageA
GetUpdateRect
SetForegroundWindow
GetLastActivePopup
BringWindowToTop
LoadIconA
RegisterClassA
GetMessageA
GetActiveWindow
ClipCursor
GetAsyncKeyState
SetWindowPos
LoadStringA
ReleaseCapture
SetCapture
ValidateRect
PeekMessageA
DispatchMessageA
wsprintfA
GetDC
IsIconic
GetWindowTextA
GDI32.dll DeleteObject
GetStockObject
GetDeviceCaps
TextOutA
SetTextColor
SetBkMode
SelectObject
GetNearestPaletteIndex
CreateRectRgn
SetTextAlign
LineTo
SelectClipRgn
GetPaletteEntries
SetBkColor
MoveToEx
GetTextMetricsA
SetPaletteEntries
GetTextExtentPoint32A
CreateICA
RealizePalette
DeleteDC
CreatePalette
SelectPalette
ResizePalette
GetSystemPaletteEntries
CreatePen
GetObjectA
CreateFontIndirectA
DPLAYX.dll #1
#4
#2
DSOUND.dll #1
DDRAW.dll DirectDrawCreate
IMM32.dll ImmReleaseContext
ImmGetDefaultIMEWnd
ImmSetOpenStatus
ImmNotifyIME
ImmGetContext
ImmGetOpenStatus
ImmAssociateContext
ADVAPI32.dll RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
ole32.dll CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize
WSOCK32.dll gethostname
WSAStartup
gethostbyname
WSACleanup

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x128
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.1503
MD5 5543c081260452a898e6593c801a4afe 🔍
SHA1 61c7da09af5da4845d12a8ef8bffb9600dea4df6 🔍
SHA256 f70b50ca2a9f4d1e81164d55c2d07dd64898e39da497689eac06b82ed68a07cf 🔍
SHA3 e7a0554be284e8cdf55e590d64c9f661c38f2a7ad868ac4937a486ef5f22675f 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.05083
MD5 925f02d817951966dcc3e1097ef91da7 🔍
SHA1 c021a66177475cd48cef93a825fdce4b0e3fcf8a 🔍
SHA256 8b8322051a16c7aa5750988212270e9ed4432fecd73d0a768f82786d2dda162a 🔍
SHA3 561f2451e8b66fcacca9935bca2b9e079241aa8fc966ff02968b0536a8d306b5 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25287
MD5 130cff2c1e5e14a57e0257cf93e1721e 🔍
SHA1 b4339ec471366424cd9d856af18d160fa4fe655b 🔍
SHA256 5498971339b61da75f0061e562dd6ab2e5e6d91bba7fc14dace35af248b6bae8 🔍
SHA3 6ec4d91a094768a4e57db4b18de8f26ce61797de3057b3c20d4459447abdb014 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.83038
MD5 c31adfbc928e026b9a42cbcbd2bcf253 🔍
SHA1 e87d536c5045755b2428ebf6afb9c515c7aea3e4 🔍
SHA256 3b3d2332cbc0a3aced5dfe70f75857bd9e02e99570795cef773b852cb43314e5 🔍
SHA3 9fed895ce3dfa68febfd43523007d904cc9f025ed3afd6f425266e08a1e0bd26 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xa68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.03884
MD5 434142683147e4975cfd4dd2fe2ee396 🔍
SHA1 76a3df466386ee4e19472e38923f043d797f7be3 🔍
SHA256 eac559b2e02813037a2b1046c3da742a3c9fb480879ecef64fc0679485575a44 🔍
SHA3 6810452c8b159a95a7dc4b3a084ec425f3fea656c73ed2cc56a417b73561b29b 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1628
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.61053
MD5 cad780f20f65f56be27875a34c3b3531 🔍
SHA1 42c9a09e582ac75830d00f8e45b7a1eb8e3b495f 🔍
SHA256 b59146e09964818a05a6c4a69e19b6578c35f1dd53565c5ccdb07e12f4695aef 🔍
SHA3 7e1bddbf58d5d9110b883c01bf864b96610ec505cdf53833151da9e03a216d0c 🔍

APPICON

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8973
Detected Filetype Icon file
MD5 6a060fdc177aa059e18207a2d38e18be 🔍
SHA1 cab9f0f1fee4a98f9038b8b2eab4fc27bfde95a4 🔍
SHA256 5deb499ba496389cfdb3c1d0f1a79c54170126e35aa7b24de44a83b781be9c9b 🔍
SHA3 8568663ab9b3ebeb31c15508c10260916ad4f61fca029daefca3363da55aeb14 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x320
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.47232
MD5 ce5b674470c35869cb4838c8b71eb786 🔍
SHA1 3c3762c824e95cb6b652349572b2bf97fd77ec6b 🔍
SHA256 483b68dbb5bec17cd0c3e67b8a51e45911042c1fdfd48dadae1743e48c9dcb70 🔍
SHA3 b62474acb0073cec82a77f6a21ec5f8118a6e81dd2e228ddaede7f1d4b16035f 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.7.26.809
ProductVersion 2.1.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Microsoft Corporation
FileDescription Age of Empires II Expansion
FileVersion (#2) 00.07.26.0809
InternalName AGE2_X1
LegalCopyright Copyright © Microsoft Corp. 2001
OriginalFilename AGE2_X1.EXE
ProductName Age of Empires II Expansion
ProductVersion (#2) 2.1
Resource LangID English - United States

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xfa7e0a70
Unmarked objects 0
12 (7291) 11
14 (7299) 33
C objects (VS98 build 8168) 153
C++ objects (VS98 build 8168) 16
Total imports 275
19 (8034) 32
C objects (VC++ 6.0 SP5 imp/exp build 8447) 2
C++ objects (VC++ 6.0 SP5 imp/exp build 8447) 304
Unmarked objects (#2) 20
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors

Leave a comment

No comments yet.