filenameindex.html
size1578496 (0x181600)
md5aba2d86ed17f587eb6d57e6c75f64f05
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Virtob-1557 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0x56b664a6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.23
SizeOfCode0x13800
SizeOfInitializedData0x181200
SizeOfUninitializedData0x4c00
AddressOfEntryPoint0x12a0
BaseOfCode0x1000
BaseOfData0x15000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x18c000
SizeOfHeaders0x400
CheckSum0x18a65e
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

PolyEnE 0.01+ by Lennart Hedlund

Sections

namevavsizeraw sizeflags
.text0x10000x137d00x13800R-X CODE IDATA
.data0x150000x4640x600RW- IDATA
.rdata0x160000x28140x2a00R-- IDATA
.eh_fram0x190000x3f80x400R-- IDATA
.bss0x1a0000x4b4c0RW- UDATA
.idata0x1f0000xd980xe00RW- IDATA
.CRT0x200000x1c0x200RW- IDATA
.tls0x210000x200x200RW- IDATA
.rsrc0x220000x1692300x169400RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1f0000xd98
RESOURCE0x220000x169230
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x210000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x1f2600x1e8
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4210190x42101c0x41ea780x42000400
typenamesizecp
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#7197120
ICON#896400
ICON#942640
ICON#1011280
RCDATARCDATA114336000
GROUP_ICONICON11460
module_namehintordfunction_name
WININET.DLL46FtpFindFirstFileA
WININET.DLL50FtpGetFileA
WININET.DLL54FtpOpenFileA
WININET.DLL56FtpPutFileA
WININET.DLL116InternetCloseHandle
WININET.DLL122InternetConnectA
WININET.DLL134InternetFindNextFileA
WININET.DLL157InternetOpenA
WININET.DLL158InternetOpenUrlA
WININET.DLL165InternetReadFile
WININET.DLL178InternetSetOptionA
KERNEL32.dll3AddAtomA
KERNEL32.dll82CloseHandle
KERNEL32.dll129CreateEventA
KERNEL32.dll135CreateFileA
KERNEL32.dll154CreateMutexA
KERNEL32.dll169CreateSemaphoreA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll209DeleteFileA
KERNEL32.dll230DuplicateHandle
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll282ExpandEnvironmentStringsA
KERNEL32.dll298FindAtomA
KERNEL32.dll329FindResourceA
KERNEL32.dll363GetAtomNameA
KERNEL32.dll388GetCommandLineA
KERNEL32.dll446GetCurrentProcess
KERNEL32.dll450GetCurrentThread
KERNEL32.dll451GetCurrentThreadId
KERNEL32.dll507GetHandleInformation
KERNEL32.dll510GetLastError
KERNEL32.dll527GetModuleFileNameA
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll578GetProcessAffinityMask
KERNEL32.dll606GetStartupInfoA
KERNEL32.dll642GetThreadContext
KERNEL32.dll650GetThreadPriority
KERNEL32.dll656GetTickCount
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll743InterlockedDecrement
KERNEL32.dll745InterlockedExchangeAdd
KERNEL32.dll747InterlockedIncrement
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll822LoadResource
KERNEL32.dll841LockResource
KERNEL32.dll922QueryPerformanceCounter
KERNEL32.dll923QueryPerformanceFrequency
KERNEL32.dll974ReleaseMutex
KERNEL32.dll978ReleaseSemaphore
KERNEL32.dll995ResetEvent
KERNEL32.dll999ResumeThread
KERNEL32.dll1065SetEvent
KERNEL32.dll1091SetLastError
KERNEL32.dll1102SetProcessAffinityMask
KERNEL32.dll1121SetThreadContext
KERNEL32.dll1129SetThreadPriority
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1151SizeofResource
KERNEL32.dll1152Sleep
KERNEL32.dll1160SuspendThread
KERNEL32.dll1171TlsAlloc
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1174TlsSetValue
KERNEL32.dll1180TryEnterCriticalSection
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1221WaitForMultipleObjects
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1267WriteFile
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll142_beginthread
msvcrt.dll143_beginthreadex
msvcrt.dll147_cexit
msvcrt.dll178_endthread
msvcrt.dll179_endthreadex
msvcrt.dll225_ftime
msvcrt.dll266_iob
msvcrt.dll383_onexit
msvcrt.dll422_setjmp
msvcrt.dll426_setmode
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll595calloc
msvcrt.dll604exit
msvcrt.dll607fclose
msvcrt.dll618fopen
msvcrt.dll619fprintf
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll625free
msvcrt.dll628fscanf
msvcrt.dll633fwrite
msvcrt.dll675longjmp
msvcrt.dll676malloc
msvcrt.dll681memcmp
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll689printf
msvcrt.dll697rand
msvcrt.dll698realloc
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll711srand
msvcrt.dll715strcmp
msvcrt.dll717strcpy
msvcrt.dll721strlen
msvcrt.dll724strncpy
msvcrt.dll728strstr
msvcrt.dll748vfprintf
SHELL32.DLL144ShellExecuteA
offsetsizetypecomment
01578496EXE02/06/2016 21:24:54#
15c115HTM#
1abe419712PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x1ea78