filename | 038707ae48c5db96548aa8853bf8988a.bender.exe | |
---|---|---|
size | 402543 (0x6246f) | |
md5 | 038707ae48c5db96548aa8853bf8988a | |
type | PE32 executable (DLL) (console) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | Win.Trojan.7028635 FOUND | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xf8 |
Rich Header
lib id | version | times used |
---|---|---|
150 | 20413 | 3 |
149 | 30729 | 25 |
132 | 30729 | 70 |
131 | 30729 | 170 |
123 | 50727 | 11 |
1 | 0 | 156 |
138 | 30729 | 45 |
146 | 30729 | 1 |
145 | 30729 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
Data Directory
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.dll | 1174 | WriteProcessMemory | |
KERNEL32.dll | 486 | GetLastError | |
KERNEL32.dll | 909 | ResumeThread | |
KERNEL32.dll | 1124 | WaitForSingleObject | |
KERNEL32.dll | 505 | GetModuleHandleW | |
KERNEL32.dll | 504 | GetModuleHandleExW | |
KERNEL32.dll | 544 | GetProcAddress | |
KERNEL32.dll | 501 | GetModuleFileNameW | |
KERNEL32.dll | 172 | CreateToolhelp32Snapshot | |
KERNEL32.dll | 836 | Process32FirstW | |
KERNEL32.dll | 838 | Process32NextW | |
KERNEL32.dll | 101 | CopyFileW | |
KERNEL32.dll | 451 | GetEnvironmentVariableW | |
KERNEL32.dll | 601 | GetTempFileNameW | |
KERNEL32.dll | 195 | DeleteFileW | |
KERNEL32.dll | 327 | FormatMessageA | |
KERNEL32.dll | 765 | LocalFree | |
KERNEL32.dll | 67 | CloseHandle | |
KERNEL32.dll | 1131 | WaitNamedPipeW | |
KERNEL32.dll | 144 | CreateNamedPipeW | |
KERNEL32.dll | 86 | ConnectNamedPipe | |
KERNEL32.dll | 127 | CreateFileW | |
KERNEL32.dll | 872 | ReadFile | |
KERNEL32.dll | 1165 | WriteFile | |
KERNEL32.dll | 152 | CreateRemoteThread | |
KERNEL32.dll | 819 | OpenProcess | |
KERNEL32.dll | 332 | FreeLibrary | |
KERNEL32.dll | 756 | LoadLibraryW | |
KERNEL32.dll | 704 | InterlockedIncrement | |
KERNEL32.dll | 700 | InterlockedDecrement | |
KERNEL32.dll | 1146 | WideCharToMultiByte | |
KERNEL32.dll | 698 | InterlockedCompareExchange | |
KERNEL32.dll | 701 | InterlockedExchange | |
KERNEL32.dll | 794 | MultiByteToWideChar | |
KERNEL32.dll | 692 | InitializeCriticalSection | |
KERNEL32.dll | 190 | DeleteCriticalSection | |
KERNEL32.dll | 217 | EnterCriticalSection | |
KERNEL32.dll | 751 | LeaveCriticalSection | |
KERNEL32.dll | 973 | SetEndOfFile | |
KERNEL32.dll | 281 | FindClose | |
KERNEL32.dll | 292 | FindFirstFileW | |
KERNEL32.dll | 304 | FindNextFileW | |
KERNEL32.dll | 1004 | SetLastError | |
KERNEL32.dll | 1109 | VirtualAllocEx | |
KERNEL32.dll | 19 | AreFileApisANSI | |
KERNEL32.dll | 1069 | TerminateProcess | |
KERNEL32.dll | 425 | GetCurrentProcess | |
KERNEL32.dll | 1086 | UnhandledExceptionFilter | |
KERNEL32.dll | 628 | GetVersion | |
KERNEL32.dll | 721 | IsDebuggerPresent | |
KERNEL32.dll | 429 | GetCurrentThreadId | |
KERNEL32.dll | 367 | GetCommandLineA | |
KERNEL32.dll | 673 | HeapFree | |
KERNEL32.dll | 591 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 669 | HeapAlloc | |
KERNEL32.dll | 260 | ExitProcess | |
KERNEL32.dll | 858 | RaiseException | |
KERNEL32.dll | 914 | RtlUnwind | |
KERNEL32.dll | 576 | GetStringTypeW | |
KERNEL32.dll | 347 | GetCPInfo | |
KERNEL32.dll | 737 | LCMapStringA | |
KERNEL32.dll | 739 | LCMapStringW | |
KERNEL32.dll | 1076 | TlsGetValue | |
KERNEL32.dll | 1074 | TlsAlloc | |
KERNEL32.dll | 1077 | TlsSetValue | |
KERNEL32.dll | 1075 | TlsFree | |
KERNEL32.dll | 1000 | SetHandleCount | |
KERNEL32.dll | 571 | GetStdHandle | |
KERNEL32.dll | 471 | GetFileType | |
KERNEL32.dll | 569 | GetStartupInfoA | |
KERNEL32.dll | 500 | GetModuleFileNameA | |
KERNEL32.dll | 330 | FreeEnvironmentStringsA | |
KERNEL32.dll | 447 | GetEnvironmentStrings | |
KERNEL32.dll | 331 | FreeEnvironmentStringsW | |
KERNEL32.dll | 449 | GetEnvironmentStringsW | |
KERNEL32.dll | 671 | HeapCreate | |
KERNEL32.dll | 672 | HeapDestroy | |
KERNEL32.dll | 1111 | VirtualFree | |
KERNEL32.dll | 852 | QueryPerformanceCounter | |
KERNEL32.dll | 614 | GetTickCount | |
KERNEL32.dll | 426 | GetCurrentProcessId | |
KERNEL32.dll | 1108 | VirtualAlloc | |
KERNEL32.dll | 676 | HeapReAlloc | |
KERNEL32.dll | 387 | GetConsoleCP | |
KERNEL32.dll | 405 | GetConsoleMode | |
KERNEL32.dll | 991 | SetFilePointer | |
KERNEL32.dll | 321 | FlushFileBuffers | |
KERNEL32.dll | 338 | GetACP | |
KERNEL32.dll | 531 | GetOEMCP | |
KERNEL32.dll | 731 | IsValidCodePage | |
KERNEL32.dll | 753 | LoadLibraryA | |
KERNEL32.dll | 693 | InitializeCriticalSectionAndSpinCount | |
KERNEL32.dll | 678 | HeapSize | |
KERNEL32.dll | 616 | GetTimeFormatA | |
KERNEL32.dll | 430 | GetDateFormatA | |
KERNEL32.dll | 621 | GetUserDefaultLCID | |
KERNEL32.dll | 488 | GetLocaleInfoA | |
KERNEL32.dll | 248 | EnumSystemLocalesA | |
KERNEL32.dll | 733 | IsValidLocale | |
KERNEL32.dll | 573 | GetStringTypeA | |
KERNEL32.dll | 490 | GetLocaleInfoW | |
KERNEL32.dll | 1154 | WriteConsoleA | |
KERNEL32.dll | 409 | GetConsoleOutputCP | |
KERNEL32.dll | 1164 | WriteConsoleW | |
KERNEL32.dll | 1020 | SetStdHandle | |
KERNEL32.dll | 120 | CreateFileA | |
KERNEL32.dll | 619 | GetTimeZoneInformation | |
KERNEL32.dll | 547 | GetProcessHeap | |
KERNEL32.dll | 82 | CompareStringA | |
KERNEL32.dll | 85 | CompareStringW | |
KERNEL32.dll | 976 | SetEnvironmentVariableA | |
KERNEL32.dll | 1045 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 163 | CreateThread | |
KERNEL32.dll | 502 | GetModuleHandleA | |
KERNEL32.dll | 1057 | Sleep | |
WININET.dll | 106 | InternetCloseHandle | |
WININET.dll | 158 | InternetReadFile | |
WININET.dll | 93 | HttpSendRequestW | |
WININET.dll | 87 | HttpOpenRequestW | |
WININET.dll | 113 | InternetConnectW | |
WININET.dll | 153 | InternetOpenW | |
CRYPT32.dll | 212 | CryptStringToBinaryA | |
CRYPT32.dll | 122 | CryptBinaryToStringA | |
ADVAPI32.dll | 578 | RegDeleteValueW | |
ADVAPI32.dll | 616 | RegQueryValueExW | |
ADVAPI32.dll | 554 | RegCloseKey | |
ADVAPI32.dll | 563 | RegCreateKeyExW | |
ADVAPI32.dll | 632 | RegSetValueExW | |
ole32.dll | 15 | CoCreateGuid |
ord | entry_va | function_name | |
---|---|---|---|
1 | 0x14f2 | RunDllEntry |
Signers (1)
issuer: /emailAddress=foxcon@foxcon.com/CN=fox
serial: -6DDCD0906A137479BF6369A0FD4F3923
Certificates (1)
Certificate: Data: Version: 3 (0x2) Serial Number: (Negative)6d:dc:d0:90:6a:13:74:79:bf:63:69:a0:fd:4f:39:23 Signature Algorithm: md5WithRSAEncryption Issuer: emailAddress=foxcon@foxcon.com, CN=fox Validity Not Before: Feb 1 20:00:00 2002 GMT Not After : Feb 1 20:00:00 2019 GMT Subject: emailAddress=foxcon@foxcon.com, CN=fox Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: 00:db:95:78:48:f9:6d:f6:8e:30:7d:fc:12:6c:0c: 39:22:f8:a2:81:77:d1:32:0a:c1:ae:a8:91:18:a4: a7:8a:b5:f3:40:a7:22:10:ae:06:da:f1:76:e0:e2: fb:cd:42:ea:ef:5e:10:df:24:00:3b:89:d6:e6:a9: 20:8d:b9:37:85:10:31:50:6c:79:80:34:be:21:fa: 13:d7:2f:7f:c3:b1:9e:5a:8d:7e:47:6a:fd:bc:50: 67:4a:60:d7:c9:68:45:66:87:9e:17:ce:ad:d9:da: ad:cd:3e:f0:42:5a:9a:51:9d:dd:88:68:e9:d8:2c: b8:b6:e4:fd:56:f4:6e:70:7f Exponent: 65537 (0x10001) X509v3 extensions: 2.5.29.1: 0X.....'W}.f.JT....2.2001 0...*.H.. .....foxcon@foxcon.com1.0 ..U....fox...#/o....@.._.... Signature Algorithm: md5WithRSAEncryption Signature Value: 31:83:92:6d:71:2e:10:1f:6e:68:db:8e:86:4b:20:c3:19:18: 10:6f:d1:35:c5:91:39:3a:61:e5:b9:fe:f8:a6:bf:b2:ec:e7: 4d:d1:9c:64:9a:9e:fd:fd:9c:68:83:20:7a:20:b9:01:da:e2: b8:45:93:8b:98:8f:5d:c8:63:e8:54:67:96:95:15:f0:47:36: ac:14:53:18:9e:3f:27:a6:e9:61:79:89:3d:79:65:58:fd:eb: 02:68:b1:39:b7:42:87:61:31:68:f3:06:13:42:50:6d:4d:9d: 8f:f7:31:f3:9e:b9:3d:7f:b5:ab:4e:06:29:49:bf:78:0e:66: 77:15
pkcs7-signedData
- 1
- MD5: nil
- 1.3.6.1.4.1.311.2.1.4
- #0
- 1.3.6.1.4.1.311.2.1.15
- :
00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
- :
- MD5
7e 0d 2d b7 1f 52 c5 49 ab 08 8e 52 95 a6 ce af |~.-..R.I...R....|
- 1.3.6.1.4.1.311.2.1.15
- #0
- #2
- 2
- -146032387032315384498298756922533165347
- RSA-MD5: nil
- #2
- emailAddress: foxcon@foxcon.com
- CN: fox
- 2002-02-01 20:00:00 UTC: 2019-02-01 20:00:00 UTC
- #4
- emailAddress: foxcon@foxcon.com
- CN: fox
- #5
- rsaEncryption: nil
- DB:95:78:48:F9:6D:F6:8E:30:7D:FC:12:6C:0C:39:22:
F8:A2:81:77:D1:32:0A:C1:AE:A8:91:18:A4:A7:8A:B5:
F3:40:A7:22:10:AE:06:DA:F1:76:E0:E2:FB:CD:42:EA:
EF:5E:10:DF:24:00:3B:89:D6:E6:A9:20:8D:B9:37:85:
10:31:50:6C:79:80:34:BE:21:FA:13:D7:2F:7F:C3:B1:
9E:5A:8D:7E:47:6A:FD:BC:50:67:4A:60:D7:C9:68:45:
66:87:9E:17:CE:AD:D9:DA:AD:CD:3E:F0:42:5A:9A:51:
9D:DD:88:68:E9:D8:2C:B8:B6:E4:FD:56:F4:6E:70:7F: 0x010001
- 2.5.29.1
8a cd 00 27 57 7d b6 66 89 4a 54 f2 ec f2 dd 32 |...'W}.f.JT....2|
- #0
- emailAddress: foxcon@foxcon.com
- CN: fox
92 23 2f 6f 95 ec 8b 86 40 9c 96 5f 02 b0 c6 dd |.#/o....@.._....|
- #0
- RSA-MD5:
31 83 92 6d 71 2e 10 1f 6e 68 db 8e 86 4b 20 c3 |1..mq...nh...K .| 19 18 10 6f d1 35 c5 91 39 3a 61 e5 b9 fe f8 a6 |...o.5..9:a.....| bf b2 ec e7 4d d1 9c 64 9a 9e fd fd 9c 68 83 20 |....M..d.....h. | 7a 20 b9 01 da e2 b8 45 93 8b 98 8f 5d c8 63 e8 |z .....E....].c.| 54 67 96 95 15 f0 47 36 ac 14 53 18 9e 3f 27 a6 |Tg....G6..S..?'.| e9 61 79 89 3d 79 65 58 fd eb 02 68 b1 39 b7 42 |.ay.=yeX...h.9.B| 87 61 31 68 f3 06 13 42 50 6d 4d 9d 8f f7 31 f3 |.a1h...BPmM...1.| 9e b9 3d 7f b5 ab 4e 06 29 49 bf 78 0e 66 77 15 |..=...N.)I.x.fw.|
- 2
- 1
- unnamed
- #0
- emailAddress: foxcon@foxcon.com
- CN: fox
- -146032387032315384498298756922533165347
- #0
- MD5: nil
- #2
- 1.3.6.1.4.1.311.2.1.12
- nil
- contentType: 1.3.6.1.4.1.311.2.1.4
- messageDigest:
4e 8d 81 69 e5 ca 4c 4f 53 0f 49 08 a8 cd 9a 70 |N..i..LOS.I....p|
- 1.3.6.1.4.1.311.2.1.12
- rsaEncryption:
41 71 2e 7a 75 1e d7 40 db fa 76 54 dc 01 b0 e8 |Aq.zu..@..vT....| 1e 4a 13 56 b8 0b 75 5b c0 e1 65 bc 8e 09 46 fb |.J.V..u[..e...F.| 54 03 8d 20 14 5a 06 e7 cc 95 0f 03 e3 a4 a1 55 |T.. .Z.........U| 17 09 cd b9 33 24 8e b8 cf 68 fe ff ae d3 6c ad |....3$...h....l.| 75 19 10 ab 33 b2 0e e9 77 b9 a0 9a ae 7b e3 3a |u...3...w....{.:| 47 8f e1 dc 74 17 1f f4 e0 9b 62 51 85 09 f9 8e |G...t.....bQ....| d9 4a d1 71 c4 70 0e 66 58 12 63 4e a7 02 33 5e |.J.q.p.fX.cN..3^| d2 db 62 e1 c8 63 04 20 24 24 c9 53 37 4c fc 5c |..b..c. $$.S7L.\|
- unnamed
offset | size | type | comment | |
---|---|---|---|---|
0 | 401408 | DLL | 11/07/2011 09:40:37 | # |
15c1 | 15 | HTM | # | |
62000 | 1072 | PKCS7 | Authenticode Signature | # |
62430 | 63 | BIN | overlay data past EOF | # |
Scanning the drive for archives: 1 file, 402543 bytes (394 KiB) Errors: 1
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
everything is OK