win32.i-worm.happy99.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	win32.i-worm.happy99.exe
size	10000 (0x2710)
md5	02dd0eaa9649a11e55fa5467fa4b8ef8

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x8ed7259f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0xa00
SizeOfInitializedData	0x1600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x10000
BaseOfCode	0x10000
BaseOfData	0x20000
ImageBase	0x400000
SectionAlignment	0x10000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	3.10
Reserved1	0
SizeOfImage	0x50000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
CODE	0x10000	0x1000	0xa00	R-X CODE
DATA	0x20000	0x1000	0x1000	RW- IDATA
.idata	0x30000	0x1000	0x400	RW- IDATA
.reloc	0x40000	0x1000	0x200	R-- IDATA SHARED

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x30000	0x340
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x40000	0x168
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.dll			WriteFile
KERNEL32.dll			UnmapViewOfFile
KERNEL32.dll			GetWindowsDirectoryA
KERNEL32.dll			GetModuleHandleA
KERNEL32.dll			CopyFileA
KERNEL32.dll			GetProcAddress
KERNEL32.dll			ExitProcess
KERNEL32.dll			GetFileSize
KERNEL32.dll			GetModuleFileNameA
KERNEL32.dll			LocalAlloc
KERNEL32.dll			CreateFileMappingA
KERNEL32.dll			GetVersionExA
KERNEL32.dll			GetSystemDirectoryA
KERNEL32.dll			CreateFileA
KERNEL32.dll			CloseHandle
KERNEL32.dll			LocalFree
KERNEL32.dll			MapViewOfFile
KERNEL32.dll			ReadFile
ADVAPI32.dll			RegSetValueExA
ADVAPI32.dll			RegCreateKeyExA
ADVAPI32.dll			RegCloseKey
USER32.dll			ReleaseDC
USER32.dll			RegisterClassA
USER32.dll			PostQuitMessage
USER32.dll			PeekMessageA
USER32.dll			GetDC
USER32.dll			DispatchMessageA
USER32.dll			DefWindowProcA
USER32.dll			CreateWindowExA
USER32.dll			ShowWindow
USER32.dll			UpdateWindow
USER32.dll			TranslateMessage
GDI32.dll			SetPixelV

show previews

offset	size	type	comment
0	9728	EXE	12/09/2045 20:35:43	#
15c1	15	HTM		#
2600	272	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 10000 bytes (10 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK