| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Jan-18 06:30:13 |
| Detected languages |
Chinese - PRC
|
| FileVersion | 1.7.0.0 |
| FileDescription | å¤§ç½æ å°-大ä¼å¥¥è¿ªIAæä»¶è½¬æ¢å·¥å · |
| ProductName | iaæä»¶è½¬æ¢å·¥å · |
| ProductVersion | 1.7.0.0 |
| LegalCopyright | ä½è çæææ 请å°éå¹¶ä½¿ç¨æ£ç |
| Comments | æ¬ç¨åºä½¿ç¨æè¯è¨ç¼å(http://www.eyuyan.com) |
| Suspicious | PEiD Signature: |
UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX v2.0 -> Markus, Laszlo & Reiser (h) UPX -> www.upx.sourceforge.net UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Suspicious | The PE is possibly packed. |
Unusual section name found: L_jI6i
Section L_jI6i is both writable and executable. Unusual section name found: L_Yqk5 Section L_Yqk5 is both writable and executable. |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. |
Resource 3 is possibly compressed or encrypted.
Resource 1 is possibly compressed or encrypted. Resource 2 is possibly compressed or encrypted. Resource 3 is possibly compressed or encrypted. Resource IEXT_IDB_STATEIMAGES is possibly compressed or encrypted. Resource 1031 is possibly compressed or encrypted. Resource 1038 is possibly compressed or encrypted. Resource 1138 is possibly compressed or encrypted. Resource 1139 is possibly compressed or encrypted. Resource 1140 is possibly compressed or encrypted. Resource 1141 is possibly compressed or encrypted. Resource 1142 is possibly compressed or encrypted. Resource 1143 is possibly compressed or encrypted. Resource 1144 is possibly compressed or encrypted. Resource 1145 is possibly compressed or encrypted. Resource 26567 is possibly compressed or encrypted. Resource 30995 is possibly compressed or encrypted. Resource 30996 is possibly compressed or encrypted. Resource 1 is possibly compressed or encrypted. Resource 2 is possibly compressed or encrypted. Resource 1039 is possibly compressed or encrypted. Resource 286 is possibly compressed or encrypted. Resource 554 is possibly compressed or encrypted. Resource 1037 is possibly compressed or encrypted. Resource 1084 is possibly compressed or encrypted. Resource 30722 is possibly compressed or encrypted. Resource 3857 is possibly compressed or encrypted. Resource 3858 is possibly compressed or encrypted. Resource 3859 is possibly compressed or encrypted. Resource 3867 is possibly compressed or encrypted. Resource 3868 is possibly compressed or encrypted. |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x120 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2025-Jan-18 06:30:13 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x89000 |
| SizeOfInitializedData | 0x2d000 |
| SizeOfUninitializedData | 0x1f9000 |
| AddressOfEntryPoint | 0x00281CA0 (Section: L_Yqk5) |
| BaseOfCode | 0x1fa000 |
| BaseOfData | 0x283000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x2b0000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
RegCloseKey
|
|---|---|
| COMCTL32.dll |
#17
|
| comdlg32.dll |
ChooseFontA
|
| GDI32.dll |
LineTo
|
| KERNEL32.DLL |
LoadLibraryA
ExitProcess GetProcAddress VirtualProtect |
| ole32.dll |
OleRun
|
| OLEAUT32.dll |
VariantCopy
|
| SHELL32.dll |
ShellExecuteA
|
| USER32.dll |
GetDC
|
| VERSION.dll |
VerLanguageNameA
|
| WINMM.dll |
waveOutOpen
|
| WINSPOOL.DRV |
ClosePrinter
|
| WLDAP32.dll |
#29
|
| WS2_32.dll |
WSAGetLastError
|
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0 |
| FileVersion | 1.7.0.0 |
| ProductVersion | 1.7.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | Chinese - PRC |
| FileVersion (#2) | 1.7.0.0 |
| FileDescription | å¤§ç½æ å°-大ä¼å¥¥è¿ªIAæä»¶è½¬æ¢å·¥å · |
| ProductName | iaæä»¶è½¬æ¢å·¥å · |
| ProductVersion (#2) | 1.7.0.0 |
| LegalCopyright | ä½è çæææ 请å°éå¹¶ä½¿ç¨æ£ç |
| Comments | æ¬ç¨åºä½¿ç¨æè¯è¨ç¼å(http://www.eyuyan.com) |
| Resource LangID | Chinese - PRC |
|---|
| XOR Key | 0xf04bba5f |
|---|---|
| Unmarked objects | 0 |
| C++ objects (8047) | 9 |
| C objects (8047) | 6 |
| 14 (7299) | 44 |
| 12 (7291) | 5 |
| 19 (8022) | 44 |
| 19 (8034) | 26 |
| Total imports | 676 |
| Imports (2179) | 3 |
| C objects (VS98 SP6 build 8804) | 232 |
| C++ objects (VS98 SP6 build 8804) | 109 |
| C++ objects (VS98 build 8168) | 94 |
| C objects (VS98 build 8168) | 27 |
| Unmarked objects (#2) | 53 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
No comments yet.