filename | bd_32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf | |
---|---|---|
size | 3723264 (0x38d000) | |
md5 | d5dcd28612f4d6ffca0cfeaefd606bcf | |
type | PE32 executable (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | Win.Ransomware.WannaCry-6313787-0 FOUND | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xf8 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
.text | 0x1000 | 0x8bca | 0x9000 | R-X CODE | |
.rdata | 0xa000 | 0x998 | 0x1000 | R-- IDATA | |
.data | 0xb000 | 0x30489c | 0x27000 | RW- IDATA | |
.rsrc | 0x310000 | 0x35a454 | 0x35b000 | R-- IDATA |
Data Directory
type | va | size | |
---|---|---|---|
EXPORT | 0 | 0 | |
IMPORT | 0xa1e0 | 0xa0 | |
RESOURCE | 0x310000 | 0x35a454 | |
EXCEPTION | 0 | 0 | |
SECURITY | 0 | 0 | |
BASERELOC | 0 | 0 | |
DEBUG | 0 | 0 | |
ARCHITECTURE | 0 | 0 | |
GLOBALPTR | 0 | 0 | |
TLS | 0 | 0 | |
LOAD_CONFIG | 0 | 0 | |
Bound_IAT | 0 | 0 | |
IAT | 0xa000 | 0x188 | |
Delay_IAT | 0 | 0 | |
CLR_Header | 0 | 0 |
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.dll | 912 | WaitForSingleObject | |
KERNEL32.dll | 556 | InterlockedIncrement | |
KERNEL32.dll | 326 | GetCurrentThreadId | |
KERNEL32.dll | 325 | GetCurrentThread | |
KERNEL32.dll | 693 | ReadFile | |
KERNEL32.dll | 355 | GetFileSize | |
KERNEL32.dll | 83 | CreateFileA | |
KERNEL32.dll | 623 | MoveFileExA | |
KERNEL32.dll | 853 | SizeofResource | |
KERNEL32.dll | 863 | TerminateThread | |
KERNEL32.dll | 599 | LoadResource | |
KERNEL32.dll | 227 | FindResourceA | |
KERNEL32.dll | 416 | GetProcAddress | |
KERNEL32.dll | 386 | GetModuleHandleW | |
KERNEL32.dll | 185 | ExitProcess | |
KERNEL32.dll | 381 | GetModuleFileNameA | |
KERNEL32.dll | 604 | LocalFree | |
KERNEL32.dll | 600 | LocalAlloc | |
KERNEL32.dll | 52 | CloseHandle | |
KERNEL32.dll | 552 | InterlockedDecrement | |
KERNEL32.dll | 152 | EnterCriticalSection | |
KERNEL32.dll | 593 | LeaveCriticalSection | |
KERNEL32.dll | 547 | InitializeCriticalSection | |
KERNEL32.dll | 504 | GlobalAlloc | |
KERNEL32.dll | 511 | GlobalFree | |
KERNEL32.dll | 676 | QueryPerformanceFrequency | |
KERNEL32.dll | 675 | QueryPerformanceCounter | |
KERNEL32.dll | 479 | GetTickCount | |
KERNEL32.dll | 613 | LockResource | |
KERNEL32.dll | 854 | Sleep | |
KERNEL32.dll | 439 | GetStartupInfoA | |
KERNEL32.dll | 383 | GetModuleHandleA | |
ADVAPI32.dll | 586 | StartServiceCtrlDispatcherA | |
ADVAPI32.dll | 524 | RegisterServiceCtrlHandlerA | |
ADVAPI32.dll | 52 | ChangeServiceConfig2A | |
ADVAPI32.dll | 580 | SetServiceStatus | |
ADVAPI32.dll | 429 | OpenSCManagerA | |
ADVAPI32.dll | 100 | CreateServiceA | |
ADVAPI32.dll | 62 | CloseServiceHandle | |
ADVAPI32.dll | 585 | StartServiceA | |
ADVAPI32.dll | 150 | CryptGenRandom | |
ADVAPI32.dll | 133 | CryptAcquireContextA | |
ADVAPI32.dll | 431 | OpenServiceA | |
WS2_32.dll | 3 | ||
WS2_32.dll | 16 | ||
WS2_32.dll | 19 | ||
WS2_32.dll | 8 | ||
WS2_32.dll | 14 | ||
WS2_32.dll | 115 | ||
WS2_32.dll | 12 | ||
WS2_32.dll | 10 | ||
WS2_32.dll | 18 | ||
WS2_32.dll | 9 | ||
WS2_32.dll | 23 | ||
WS2_32.dll | 4 | ||
WS2_32.dll | 11 | ||
MSVCP60.dll | 267 | public: __thiscall std::_Lockit::~_Lockit(void) ??1_Lockit@std@@QAE@XZ | |
MSVCP60.dll | 162 | public: __thiscall std::_Lockit::_Lockit(void) ??0_Lockit@std@@QAE@XZ | |
iphlpapi.dll | 28 | GetAdaptersInfo | |
iphlpapi.dll | 64 | GetPerAdapterInfo | |
WININET.dll | 146 | InternetOpenA | |
WININET.dll | 147 | InternetOpenUrlA | |
WININET.dll | 105 | InternetCloseHandle | |
MSVCRT.dll | 129 | __set_app_type | |
MSVCRT.dll | 449 | _stricmp | |
MSVCRT.dll | 111 | __p__fmode | |
MSVCRT.dll | 106 | __p__commode | |
MSVCRT.dll | 202 | _except_handler3 | |
MSVCRT.dll | 131 | __setusermatherr | |
MSVCRT.dll | 271 | _initterm | |
MSVCRT.dll | 88 | __getmainargs | |
MSVCRT.dll | 143 | _acmdln | |
MSVCRT.dll | 157 | _adjust_fdiv | |
MSVCRT.dll | 183 | _controlfp | |
MSVCRT.dll | 585 | exit | |
MSVCRT.dll | 72 | _XcptFilter | |
MSVCRT.dll | 211 | _exit | |
MSVCRT.dll | 390 | _onexit | |
MSVCRT.dll | 85 | __dllonexit | |
MSVCRT.dll | 606 | free | |
MSVCRT.dll | 15 | void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z | |
MSVCRT.dll | 241 | _ftol | |
MSVCRT.dll | 690 | sprintf | |
MSVCRT.dll | 197 | _endthreadex | |
MSVCRT.dll | 705 | strncpy | |
MSVCRT.dll | 678 | rand | |
MSVCRT.dll | 166 | _beginthreadex | |
MSVCRT.dll | 73 | __CxxFrameHandler | |
MSVCRT.dll | 692 | srand | |
MSVCRT.dll | 720 | time | |
MSVCRT.dll | 98 | __p___argc |
StringTable 040904B0
CompanyName | Microsoft Corporation |
FileDescription | Microsoft® Disk Defragmenter |
FileVersion | 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
InternalName | lhdfrgui.exe |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | lhdfrgui.exe |
ProductName | Microsoft® Windows® Operating System |
ProductVersion | 6.1.7601.17514 |
VS_FIXEDFILEINFO
FileVersion | 6.1.7601.17514 |
ProductVersion | 6.1.7601.17514 |
StrucVersion | 0x10000 |
FileFlagsMask | 0x3f |
FileFlags | 0 |
FileOS | 0x40004 |
FileType | 1 |
FileSubtype | 0 |
Scanning the drive for archives: 1 file, 3723264 bytes (3636 KiB) -- Type = PE Physical Size = 3723264 CPU = x86 Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms Created = 2010-11-20 09:03:08 Headers Size = 4096 Checksum = 0 Name = lhdfrgui.exe Image Size = 6729728 Section Alignment = 4096 File Alignment = 4096 Code Size = 36864 Initialized Data Size = 3682304 Uninitialized Data Size = 0 Linker Version = 6.0 OS Version = 4.0 Image Version = 0.0 Subsystem Version = 4.0 Subsystem = Windows GUI Stack Reserve = 1048576 Stack Commit = 4096 Heap Reserve = 1048576 Heap Commit = 4096 Image Base = 4194304 Comment = FileVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) ProductVersion: 6.1.7601.17514 CompanyName: Microsoft Corporation FileDescription: Microsoft® Disk Defragmenter InternalName: lhdfrgui.exe LegalCopyright: © Microsoft Corporation. All rights reserved. OriginalFilename: lhdfrgui.exe ProductName: Microsoft® Windows® Operating System ---- Path = .rsrc/R/1831 Size = 3514368 Packed Size = 3514368 -- Path = .rsrc/R/1831 Type = PE Physical Size = 3514368 CPU = x86 Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms Created = 2010-11-20 09:05:05 Headers Size = 4096 Checksum = 0 Name = diskpart.exe Image Size = 3514368 Section Alignment = 4096 File Alignment = 4096 Code Size = 28672 Initialized Data Size = 3481600 Uninitialized Data Size = 0 Linker Version = 6.0 OS Version = 4.0 Image Version = 0.0 Subsystem Version = 4.0 Subsystem = Windows GUI Stack Reserve = 1048576 Stack Commit = 4096 Heap Reserve = 1048576 Heap Commit = 4096 Image Base = 4194304 Comment = FileVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) ProductVersion: 6.1.7601.17514 CompanyName: Microsoft Corporation FileDescription: DiskPart InternalName: diskpart.exe LegalCopyright: © Microsoft Corporation. All rights reserved. OriginalFilename: diskpart.exe ProductName: Microsoft® Windows® Operating System ---- Path = .rsrc/XIA/2058 Size = 3446325 Packed Size = 3446325 -- Path = .rsrc/XIA/2058 Type = zip Physical Size = 3446325 Date Time Attr Size Compressed Name ------------------- ----- ------------ ------------ ------------------------ 2017-05-11 11:13:18 ....A 1440054 14164 b.wnry 2017-05-11 11:11:57 ....A 780 177 c.wnry 2010-11-19 19:16:58 ....A 47879 9404 msg/m_bulgarian.wnry 2010-11-19 19:16:58 ....A 54359 11044 msg/m_chinese (simplified).wnry 2010-11-19 19:16:58 ....A 79346 11633 msg/m_chinese (traditional).wnry 2010-11-19 19:16:58 ....A 39070 8905 msg/m_croatian.wnry 2010-11-19 19:16:58 ....A 40512 9079 msg/m_czech.wnry 2010-11-19 19:16:58 ....A 37045 8688 msg/m_danish.wnry 2010-11-19 19:16:58 ....A 36987 8694 msg/m_dutch.wnry 2010-11-19 19:16:58 ....A 36973 8700 msg/m_english.wnry 2010-11-19 19:16:58 ....A 37580 8795 msg/m_filipino.wnry 2010-11-19 19:16:58 ....A 38377 8786 msg/m_finnish.wnry 2010-11-19 19:16:58 ....A 38437 8841 msg/m_french.wnry 2010-11-19 19:16:58 ....A 37181 8787 msg/m_german.wnry 2010-11-19 19:16:58 ....A 49044 9554 msg/m_greek.wnry 2010-11-19 19:16:58 ....A 37196 8691 msg/m_indonesian.wnry 2010-11-19 19:16:58 ....A 36883 8735 msg/m_italian.wnry 2010-11-19 19:16:58 ....A 81844 11242 msg/m_japanese.wnry 2010-11-19 19:16:58 ....A 91501 11209 msg/m_korean.wnry 2010-11-19 19:16:58 ....A 41169 9023 msg/m_latvian.wnry 2010-11-19 19:16:58 ....A 37577 8707 msg/m_norwegian.wnry 2010-11-19 19:16:58 ....A 39896 8950 msg/m_polish.wnry 2010-11-19 19:16:58 ....A 37917 8752 msg/m_portuguese.wnry 2010-11-19 19:16:58 ....A 52161 9499 msg/m_romanian.wnry 2010-11-19 19:16:58 ....A 47108 9419 msg/m_russian.wnry 2010-11-19 19:16:58 ....A 41391 9124 msg/m_slovak.wnry 2010-11-19 19:16:58 ....A 37381 8727 msg/m_spanish.wnry 2010-11-19 19:16:58 ....A 38483 8771 msg/m_swedish.wnry 2010-11-19 19:16:58 ....A 42582 9084 msg/m_turkish.wnry 2010-11-19 19:16:58 ....A 93778 11224 msg/m_vietnamese.wnry 2017-05-11 06:59:13 ....A 864 484 r.wnry 2017-05-09 07:58:43 ....A 3038286 3009375 s.wnry 2017-05-11 17:22:55 ..... 65816 65828 t.wnry 2017-05-11 17:22:55 ....A 20480 3457 taskdl.exe 2017-05-11 17:22:55 ....A 20480 2555 taskse.exe 2017-05-11 17:22:55 ....A 245760 82980 u.wnry ------------------- ----- ------------ ------------ ------------------------ 2017-05-11 17:22:55 6162177 3441087 36 files
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
everything is OK