parent | mks.exe | |
---|---|---|
filename | mks.unpacked.exe | |
size | 2658304 (0x289000) | |
md5 | 33949704b9fc698eff14e9a47b2d2f9b | |
type | PE32 executable (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | Trojan.Banker-6962 FOUND | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0x80 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
.code | 0x1000 | 0x183c | 0x1a00 | R-X CODE | |
.text | 0x3000 | 0x5011 | 0x5200 | R-X CODE | |
.rdata | 0x9000 | 0x4fa | 0x600 | R-- IDATA | |
.data | 0xa000 | 0x1448 | 0x1200 | RW- IDATA | |
.rsrc | 0xc000 | 0x280694 | 0x280800 | R-- IDATA |
Data Directory
type | va | size | |
---|---|---|---|
EXPORT | 0 | 0 | |
IMPORT | 0xa3d8 | 0xa0 | |
RESOURCE | 0xc000 | 0x280694 | |
EXCEPTION | 0 | 0 | |
SECURITY | 0 | 0 | |
BASERELOC | 0 | 0 | |
DEBUG | 0 | 0 | |
ARCHITECTURE | 0 | 0 | |
GLOBALPTR | 0 | 0 | |
TLS | 0 | 0 | |
LOAD_CONFIG | 0 | 0 | |
Bound_IAT | 0 | 0 | |
IAT | 0 | 0 | |
Delay_IAT | 0 | 0 | |
CLR_Header | 0 | 0 |
StringTable 040904E4
CompanyName | FreeSoft |
FileDescription | mini-KMS Activator |
FileVersion | 1,0,5,3 |
ProductName | mini-KMS Activator v1.053 ENG |
InternalName | mini-KMS_Activator_v1.053_ENG_FIXED.exe |
ProductVersion | 1,0,5,3 |
LegalCopyright | © 2010, FreeSoft |
VS_FIXEDFILEINFO
FileVersion | 1.0.5.3 |
ProductVersion | 1.0.5.3 |
StrucVersion | 0x10000 |
FileFlagsMask | 0x3f |
FileFlags | 0xb |
FileOS | 0x10001 |
FileType | 1 |
FileSubtype | 0 |
offset | size | type | comment | |
---|---|---|---|---|
0 | 2658304 | EXE | 02/07/2009 06:33:08 | # |
15c1 | 15 | HTM | # | |
1719a7 | 251 | PNG | (48 x 48) | # |
171aa3 | 8069 | PNG | (128 x 128) | # |
173a2b | 381 | PNG | (68 x 433) | # |
173bab | 488 | PNG | (136 x 36) | # |
173d93 | 1311 | PNG | (275 x 116) | # |
1742b3 | 211 | PNG | (58 x 24) | # |
174387 | 572 | PNG | (90 x 13) | # |
1745c3 | 109 | PNG | (27 x 9) | # |
174633 | 256 | PNG | (307 x 10) | # |
174733 | 491 | PNG | (92 x 85) | # |
17491f | 510 | PNG | (155 x 18) | # |
174b1f | 2655 | PNG | (302 x 27) | # |
17557f | 359 | PNG | (68 x 433) | # |
1848bf | 767 | PNG | (16 x 16) | # |
184bbf | 791 | PNG | (16 x 16) | # |
184ed7 | 735 | PNG | (16 x 16) | # |
186233 | 1038 | BMP | (75 x 23) | # |
1866a2 | 1038 | BMP | (75 x 23) | # |
186b12 | 1038 | BMP | (75 x 23) | # |
25b2b4 | 1258 | GIF | (81 x 77) | # |
25b846 | 49988 | PNG | (411 x 2500) | # |
2682ab | 11365 | PNG | (129 x 97) | # |
26b30f | 11365 | PNG | (129 x 97) | # |
26e385 | 11365 | PNG | (129 x 97) | # |
2713ed | 11365 | PNG | (129 x 97) | # |
2743f5 | 4379 | PNG | (28 x 51) | # |
27590b | 11365 | PNG | (129 x 97) | # |
27896a | 11365 | PNG | (129 x 97) | # |
27bdb7 | 11365 | PNG | (129 x 97) | # |
27ee1e | 11365 | PNG | (129 x 97) | # |
28224f | 11365 | PNG | (129 x 97) | # |
285282 | 763 | PNG | (16 x 16) | # |
285983 | 11365 | PNG | (129 x 97) | # |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
everything is OK