|
Download
|
|
|
SHA256
|
f75735379f48e03198d347caeb7777cca79fa458d3bfdc6cfa927d2b84067713
|
|
Referer
|
|
|
Magic
|
Windows executable file (EXE)
|
|
Request
|
GET /download/nsis/20160324_vA.exe HTTP/1.1
User-Agent: Plumbytes Installer Version/1.10
Accept: */*
Connection: keep-alive
Range: bytes=0-
Host: 45.55.29.117
Cache-Control: no-cache
|
|
Response Header
|
HTTP/1.1 206 Partial Content
Date: Fri, 27 Jan 2017 18:32:46 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.4.45
Last-Modified: Thu, 06 Oct 2016 13:41:03 GMT
ETag: "1366fd8-53e3271dab9c0"
Accept-Ranges: bytes
Content-Length: 20344792
Content-Range: bytes 0-20344791/20344792
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream
|
|
HEX Peek (128 B)
|
0000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ..............
0010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 D0 00 00 00 ................
0040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ........!..L.!Th
0050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno
0060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS
0070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$.......
|
|
PE Info
|
Meta-data
================================================================================
Size: 20344792 bytes
MD5: 10fe5d125bf9d3b515846cfacd9d3ff8
SHA1: 6f10d17af619376552eaf90d4bedc2759dc51217
Date: 0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
EP: 0x403883 .text 0/6
CRC: Claimed: 0x1368481, Actual: 0x1368481
Resource entries
================================================================================
Name RVA Size Lang Sublang Type
--------------------------------------------------------------------------------
RT_ICON 0x1b0328 0x10828 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x1c0b50 0x573f LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x1c6290 0x4228 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x1ca4b8 0x25a8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x1cca60 0x10a8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x1cdb08 0x468 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x1cdf70 0xb4 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x1ce028 0x202 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x1ce230 0xf8 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x1ce328 0xa0 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_DIALOG 0x1ce3c8 0xee LANG_ENGLISH SUBLANG_ENGLISH_US
RT_GROUP_ICON 0x1ce4b8 0x5a LANG_ENGLISH SUBLANG_ENGLISH_US
RT_VERSION 0x1ce518 0x25c LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x1ce778 0x3c8 LANG_ENGLISH SUBLANG_ENGLISH_US
Suspicious IAT alerts
================================================================================
CreateProcessW
OpenProcess
ShellExecuteW
Sections
================================================================================
Name VirtAddr VirtSize RawSize Entropy
--------------------------------------------------------------------------------
.text 0x1000 0x6dae 0x6e00 6.508530
.rdata 0x8000 0x2a62 0x2c00 4.390535
.data 0xb000 0x67ebc 0x200 1.430860
.ndata 0x73000 0x13d000 0x0 0.000000 [SUSPICIOUS]
.rsrc 0x1b0000 0x1eb40 0x1ec00 6.300128
.reloc 0x1cf000 0xf32 0x1000 5.617014
Version info
================================================================================
LegalCopyright: Copyright Plumbytes Software
ProductName: Plumbytes Anti-Malware
FileDescription: Plumbytes Anti-Malware
FileVersion: 1.0.1.9
CompanyName: Plumbytes Software
Translation: 0x0000 0x04b0
|