YHY_Setup.exe
First submission 2024-10-15 19:42:34
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 1601.25 KB (1639678 bytes) |
Compile time: | 1992-06-20 00:22:17 |
MD5: | d443c5e14df0a22a4f9b1a4f7fa0ecb7 |
SHA1: | 5bf789c6ca2fe23fe972a17271ff15bb84f4ca8d |
SHA256: | b3d75355c374e53960d22d6c5f1f929731a6aff79d841ffcd61834e69f3e528e |
Import Hash : | b8494300a1f7342d4c600a7b12e15925 |
Sections 8 | CODE DATA BSS .idata .tls .rdata .reloc .rsrc |
Directories 4 | import resource tls relocation |
URLs, FQDN and IP indicators 1
PE Sections 3 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
CODE | 0x1000 | 0x244cc | 148992 | d71f59b9a5e078f9ba9facd24daf3e466ea0fea6 | bac8bae7a5e5326cf49943b90d1c062a | |
DATA | 0x26000 | 0x2894 | 10752 | e6d34e556463e08e8b1c5b5cbb9967c3c662c029 | abafcbfbd7f8ac0226ca496a92a0cf06 | |
BSS | 0x29000 | 0x10f5 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.idata | 0x2b000 | 0x1798 | 6144 | ef5533e0aa30ca3fb193ac5f2701611d033f3215 | 7a4934595db0efc364c3982c4e335d8c | |
.tls | 0x2d000 | 0x8 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.rdata | 0x2e000 | 0x18 | 512 | 7d9ccb6391020266050c96487449a1aadfbe589d | c4fdd0c5c9efb616fcc85d66056ca490 | |
.reloc | 0x2f000 | 0x1884 | 6656 | 4d98e9a5cd438d32008aa2db9c2af8f5714c89fd | 867a1120317d51734587a74f6ee70016 | |
.rsrc | 0x31000 | 0x62a8 | 25600 | 10d7fea2c158b13fb1ec83dbbf7a949438b7085e | 25520b49ccb29a324fef22a3c449aaf9 |
PE Resources 5
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x34498 | 9640 | |
RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x36a50 | 272 | |
RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x36b60 | 90 | |
RT_VERSION | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x36bbc | 884 | |
RT_MANIFEST | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x36f30 | 886 |
Meta infos 6
LegalCopyright: | \x798f\x5efa\x4ebf\x534e\x6e90\x80fd\x6e90\x7ba1\x7406\x6709\x9650\x516c\x53f8 |
FileVersion: | 1.4.4 |
CompanyName: | \x798f\x5efa\x4ebf\x534e\x6e90\x80fd\x6e90\x7ba1\x7406\x6709\x9650\x516c\x53f8 |
Translation: | 0x0409 0x04e4 |
FileDescription: | \x4ebf\x534e\x6e90\x751f\x4ea7\x4fe1\x606f\x7ba1\x7406\x7cfb\x7edf 1.4.4 Installation |
Comments: |
Packers detected 4
Borland Delphi 3.0 (???) |
Borland Delphi 4.0 |
Borland Delphi v3.0 |
BobSoft Mini Delphi -> BoB / BobSoft |
Anti debug functions 5
FindWindowA |
GetLastError |
RaiseException |
TerminateProcess |
UnhandledExceptionFilter |
Strings analysis - File found
Temporary |
$inst\7.tmp |
$inst\5.tmp |
$inst\8.tmp |
Library |
USER32.dll |
cabinet.dll |
UxTheme.dll |
PSAPI.DLL |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
WINMM.dll |
ADVAPI32.dll |
OLEAUT32.dll |
ole32.dll |
SHELL32.dll |
Strings analysis - Possible URLs found 1
http:// |
Import functions
Name | Latest seen | MD5 |
---|---|---|
XW_Setup.exe | 2024-10-15 19:43:12 | 5fafebcba3e76e2c9938b628ec620dbb |