filenameAntiTrojan.exe
size63488 (0xf800)
md5410cdce0a859193dd727d0afd3c45af7
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
152201151
158402191
1704021919
156402194
171402195
147307299
1096
175402193
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4f46537c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x1a00
SizeOfInitializedData0xda00
SizeOfUninitializedData0
AddressOfEntryPoint0x2278
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x13000
SizeOfHeaders0x400
CheckSum0x13d84
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x18520x1a00R-X CODE
.rdata0x30000xeb80x1000R-- IDATA
.data0x40000x5840x200RW- IDATA
.rsrc0x50000xc04c0xc200R-- IDATA
.reloc0x120000x4940x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x35d00x8c
RESOURCE0x50000xc04c
EXCEPTION00
SECURITY00
BASERELOC0x120000x308
DEBUG0x31c00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x32d80x40
Bound_IAT00
IAT0x30000x194
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17441252
ICON#22961252
ICON#337521252
ICON#422161252
ICON#513841252
ICON#696401252
ICON#742641252
ICON#811281252
ICON#97441252
ICON#102961252
ICON#1137521252
ICON#1222161252
ICON#1313841252
ICON#1496401252
ICON#1542641252
ICON#1611281252
MENU#109941252
DIALOG#1033201252
STRING#7721252
ACCELERATORS#109161252
GROUP_ICON#1071181252
GROUP_ICON#1081181252
MANIFEST#13461252
idlangstring
1031049AntiTrojan
1091049ANTITROJAN
module_namehintordfunction_name
KERNEL32.dll644GetTempPathA
KERNEL32.dll642GetTempFileNameA
KERNEL32.dll306FindFirstFileA
KERNEL32.dll323FindNextFileA
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll862MoveFileA
KERNEL32.dll211DeleteFileA
KERNEL32.dll704GlobalMemoryStatusEx
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll723HeapSetInformation
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll202DecodePointer
KERNEL32.dll234EncodePointer
USER32.dll626SendDlgItemMessageA
USER32.dll218EndDialog
USER32.dll567PostQuitMessage
USER32.dll220EndPaint
USER32.dll14BeginPaint
USER32.dll156DefWindowProcW
USER32.dll297GetDlgItemTextA
USER32.dll166DestroyWindow
USER32.dll172DialogBoxParamW
USER32.dll785UpdateWindow
USER32.dll109CreateWindowExA
USER32.dll110CreateWindowExW
USER32.dll589RegisterClassExW
USER32.dll491LoadCursorW
USER32.dll493LoadIconW
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll762TranslateAcceleratorW
USER32.dll349GetMessageW
USER32.dll485LoadAcceleratorsW
USER32.dll506LoadStringW
USER32.dll735ShowWindow
GDI32.dll696TextOutA
SHLWAPI.dll138PathRemoveFileSpecA
MSVCP100.dll652void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCR100.dll289_CxxThrowException
MSVCR100.dll238public: void __thiscall type_info::_type_info_dtor_internal_method(void)

?_type_info_dtor_internal_method@type_info@@QAEXXZ

MSVCR100.dll545_except_handler4_common
MSVCR100.dll696_invoke_watson
MSVCR100.dll314__CxxFrameHandler3
MSVCR100.dll258void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR100.dll495_controlfp_s
MSVCR100.dll1409fopen
MSVCR100.dll1425fseek
MSVCR100.dll1417fread
MSVCR100.dll1398fclose
MSVCR100.dll1420freopen
MSVCR100.dll1430fwrite
MSVCR100.dll122void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

MSVCR100.dll1399feof
MSVCR100.dll1404fgets
MSVCR100.dll1382atoi
MSVCR100.dll101void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR100.dll1526strcat_s
MSVCR100.dll1531strcpy_s
MSVCR100.dll99void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR100.dll269public: virtual char const * __thiscall std::exception::what(void)const

?what@exception@std@@UBEPBDXZ

MSVCR100.dll93public: virtual __thiscall std::exception::~exception(void)

??1exception@std@@UAE@XZ

MSVCR100.dll34public: __thiscall std::exception::exception(char const * const &)

??0exception@std@@QAE@ABQBD@Z

MSVCR100.dll36public: __thiscall std::exception::exception(class std::exception const &)

??0exception@std@@QAE@ABV01@@Z

MSVCR100.dll1165_unlock
MSVCR100.dll347__dllonexit
MSVCR100.dll803_lock
MSVCR100.dll969_onexit
MSVCR100.dll453_amsg_exit
MSVCR100.dll438__wgetmainargs
MSVCR100.dll476_cexit
MSVCR100.dll554_exit
MSVCR100.dll301_XcptFilter
MSVCR100.dll1395exit
MSVCR100.dll1233_wcmdln
MSVCR100.dll688_initterm
MSVCR100.dll689_initterm_e
MSVCR100.dll492_configthreadlocale
MSVCR100.dll418__setusermatherr
MSVCR100.dll491_commode
MSVCR100.dll581_fmode
MSVCR100.dll415__set_app_type
MSVCR100.dll507_crt_debugger_hook
MSVCR100.dll1491memset
offsetsizetypecomment
063488EXE02/23/2012 14:55:56#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK