wmp9.exe
First submission 2024-10-16 20:09:03
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive |
Mime type: | application/x-dosexec |
File size: | 12789.13 KB (13096072 bytes) |
Compile time: | 2001-08-18 03:42:57 |
MD5: | 10529c0d8a84161a1f806fad4d58e40f |
SHA1: | bebf458e7c473f4f7a80f04196570a3ddead1075 |
SHA256: | 0118a308c8713dcc7b23cad9018e76ba08aa45f9bce7d7299a90006ec8d91502 |
Import Hash : | 1494de9b53e05fc1f40cb92afbdd6ce4 |
Sections 3 | .text .data .rsrc |
Directories 4 | import resource debug security |
File features detected
URLs, FQDN and IP indicators 1
PE Sections 1 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0x861a | 34816 | 03418ebc42b91a08a6b42629c02703d9d905e7a2 | 43984be5cb414e4634db17caa4d1c30b | |
.data | 0xa000 | 0x1be4 | 1024 | 8d38660485ad9cbae834e4aa747167ff99f25bae | 730893b14fc930a187215e7fb53bc0a5 | |
.rsrc | 0xc000 | 0xc73000 | 13052416 | 271cb0988cbf2cef83a1c2af186f1a52b9aca9ae | 1b7016823d5039624b9a915d2323bd6f |
PE Resources 7
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
AVI | LANG_TURKISH | SUBLANG_DEFAULT | 0xc7e0 | 11802 | |
RT_ICON | LANG_TURKISH | SUBLANG_DEFAULT | 0xf8e4 | 296 | |
RT_DIALOG | LANG_TURKISH | SUBLANG_DEFAULT | 0x10320 | 284 | |
RT_STRING | LANG_TURKISH | SUBLANG_DEFAULT | 0x11914 | 818 | |
RT_RCDATA | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xc7e390 | 394 | |
RT_GROUP_ICON | LANG_TURKISH | SUBLANG_DEFAULT | 0xc7e51c | 34 | |
RT_VERSION | LANG_TURKISH | SUBLANG_DEFAULT | 0xc7e540 | 968 |
Meta infos 9
LegalCopyright: | (C) Microsoft Corporation. All rights reserved. |
InternalName: | Wextract |
FileVersion: | 9.00.00.2980 |
CompanyName: | Microsoft Corporation |
ProductVersion: | 9.00.00.2980 |
FileDescription: | Windows Media Component Setup Application |
Translation: | 0x041f 0x04b0 |
OriginalFilename: | WEXTRACT.EXE |
ProductName: | Windows Media Component Setup Application |
Packers detected 2
Borland Delphi 3.0 (???) |
Microsoft Visual C++ v6.0 |
Anti debug functions 1
GetLastError |
File signature
MD5 | SHA1 | Block size | Virtual Address |
---|---|---|---|
8e4b9dcad1a66fdb67fea8b72b5aae3b | 9e78c1a51fe8281ace34a33bf11469a0bbe730cc | 6792 | 13089280 |
Strings analysis - File found
Temporary |
IXP%03d.TMP |
msdownld.tmp |
TMP4351$.TMP |
Object |
wmp.ocx |
Archive Java |
wmpns.jar |
Compressed |
npdrmv2.zip |
XML |
control.xml |
Text |
eula.txt |
Library |
SHELL32.dll |
wmpdxm.dll |
wmpband.dll |
wmp.dll |
WMDMPS.dll |
blackbox.dll |
mpg4dmod.dll |
migrate.dll |
wmpcd.dll |
wmpasf.dll |
wmerror.dll |
9xmigrat.dll |
wmidx.dll |
setupx.dll |
dwintl.dll |
WMVDMOD.DLL |
npdrmv2.dll |
WMADMOD.DLL |
mpvis.DLL |
msoobci.dll |
wmpcore.dll |
WMDMLOG.dll |
WMNetMgr.dll |
MEDIAPLAYERV2.DLL |
MsPMSP.dll |
WMASF.DLL |
custsat.dll |
WMSDMOE2.DLL |
CDENGINE.DLL |
wmpui.dll |
rsl.dll |
drmstor.dll |
W95INF32.DLL |
CDDATAPS.DLL |
SETUPAPI.dll |
NPWMSDrm.dll |
LAPRXY.DLL |
pidgen.dll |
WMPNS.dll |
GDI32.dll |
drmv2clt.dll |
MP43DMOD.DLL |
ADVAPI32.dll |
#S\KERNEL32.DLL |
ISO9660.DLL |
unicows.dll |
KERNEL32.dll |
WMADMOE.DLL |
wmvcore.dll |
COMCTL32.dll |
qasf.dll |
DRMClien.dll |
msscp.dll |
MsPMSNSv.dll |
asferror.dll |
JOLIET.DLL |
WMVDMOE2.DLL |
wmpshell.dll |
MSWMDM.dll |
msnetobj.dll |
advpack.dll |
USER32.dll |
msdmo.dll |
VERSION.dll |
WMSPDMOD.DLL |
WMSDMOD.DLL |
W95INF16.DLL |
MP4SDMOD.DLL |
WMSPDMOE.DLL |
CEWMDM.dll |
wmploc.DLL |
Strings analysis - Possible URLs found 5
https://www.verisign.com/rpa |
https://www.verisign.com/rpa0 |
http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0 |
http://www.microsoft.com/windows/windowsmedia |
http://ocsp.verisign.com/ocsp/status0 |