filenamefinfisher.1.exe.bin
size790016 (0xc0e00)
md5074919f13d07cd6ce92bb0738971afc7
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Agent-247743 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
125507277
123507272
1105072716
1990499
10147
1095072775
126507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x4cc96531
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x2c00
SizeOfInitializedData0xbde00
SizeOfUninitializedData0
AddressOfEntryPoint0x29b9
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion5.0
Reserved10
SizeOfImage0xc3000
SizeOfHeaders0x400
CheckSum0xcc1ad
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x2a700x2c00R-X CODE
.data0x40000xc840x400RW- IDATA
.rsrc0x50000xbd8cc0xbda00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x32d40x78
RESOURCE0x50000xbd8cc
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x11800x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13a00x40
Bound_IAT00
IAT0x10000x160
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#71016401252
ICON#7117441252
ICON#7122961252
ICON#71337521252
ICON#71422161252
ICON#71513841252
ICON#716583301252
ICON#71796401252
ICON#71842641252
ICON#71911281252
DIALOG#16149121252
DIALOG#2771751252
DIALOG#341252
GROUP_ICON#1011461252
module_namehintordfunction_name
KERNEL32.dll343GetProcAddress
KERNEL32.dll46CopyFileW
KERNEL32.dll51CreateDirectoryW
KERNEL32.dll387GetTempPathW
KERNEL32.dll317GetModuleFileNameW
KERNEL32.dll319GetModuleHandleW
KERNEL32.dll30CloseHandle
KERNEL32.dll600ResumeThread
KERNEL32.dll719TerminateProcess
KERNEL32.dll562QueueUserAPC
KERNEL32.dll738UnmapViewOfFile
KERNEL32.dll505MapViewOfFile
KERNEL32.dll112DuplicateHandle
KERNEL32.dll269GetCurrentProcess
KERNEL32.dll533OpenProcess
KERNEL32.dll270GetCurrentProcessId
KERNEL32.dll76CreateProcessW
KERNEL32.dll760VirtualProtect
KERNEL32.dll318GetModuleHandleA
KERNEL32.dll144ExitProcess
KERNEL32.dll189FlushFileBuffers
KERNEL32.dll786WriteFile
KERNEL32.dll59CreateFileW
KERNEL32.dll664SetFileAttributesW
KERNEL32.dll295GetFileAttributesW
KERNEL32.dll97DeleteFileW
KERNEL32.dll769WaitForSingleObject
KERNEL32.dll795WriteProcessMemory
KERNEL32.dll692SetThreadContext
KERNEL32.dll388GetThreadContext
KERNEL32.dll416GlobalAlloc
KERNEL32.dll423GlobalFree
KERNEL32.dll378GetSystemTimeAsFileTime
KERNEL32.dll272GetCurrentThreadId
KERNEL32.dll394GetTickCount
KERNEL32.dll559QueryPerformanceCounter
KERNEL32.dll700SetUnhandledExceptionFilter
KERNEL32.dll363GetStartupInfoW
KERNEL32.dll459InterlockedCompareExchange
KERNEL32.dll711Sleep
KERNEL32.dll461InterlockedExchange
KERNEL32.dll735UnhandledExceptionFilter
USER32.dll647TranslateMessage
USER32.dll645TranslateAcceleratorW
USER32.dll305GetMessageW
USER32.dll411LoadAcceleratorsW
USER32.dll432LoadStringW
USER32.dll152DispatchMessageW
USER32.dll485PostQuitMessage
USER32.dll189EndPaint
USER32.dll12BeginPaint
USER32.dll150DialogBoxParamW
USER32.dll144DestroyWindow
USER32.dll135DefWindowProcW
USER32.dll419LoadIconW
USER32.dll417LoadCursorW
USER32.dll91CreateWindowExW
USER32.dll623ShowWindow
USER32.dll662UpdateWindow
USER32.dll187EndDialog
USER32.dll504RegisterClassExW
msvcrt.dll225__wgetmainargs
msvcrt.dll276_cexit
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll1167exit
msvcrt.dll999_wcmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll245_adjust_fdiv
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll295_controlfp
msvcrt.dll1262memset
msvcrt.dll862_stricmp
msvcrt.dll974_vsnwprintf
ntdll.dll80NtContinue
ntdll.dll664RtlUnwind
SHELL32.dll141ShellExecuteW
SHELL32.dll140ShellExecuteExW
offsetsizetypecomment
0790016EXE10/28/2010 11:57:37#
15c115HTM#
5e2858330PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER