filenameVirusShare_0a83777e95be86c5701aaba0d9531015
size967680 (0xec400)
md50a83777e95be86c5701aaba0d9531015
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-119768 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
158303191
1713031916
1563031915
10208
1703031964
1743031924
126507271
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4d7622f9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion10.0
SizeOfCode0xd200
SizeOfInitializedData0xdee00
SizeOfUninitializedData0
AddressOfEntryPoint0xc350
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.2
Reserved10
SizeOfImage0xf2000
SizeOfHeaders0x400
CheckSum0xeed2a
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000xd1e40xd200R-X CODE
.data0xf0000x27640x800RW- IDATA
.pdata0x120000x57c0x600R-- IDATA
.rsrc0x130000xddc580xdde00R-- IDATA
.reloc0xf10000x1440x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xd1700xa0
RESOURCE0x130000xddc58
EXCEPTION0x120000x57c
SECURITY00
BASERELOC0xf10000x14
DEBUG0x15400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x508
Delay_IAT00
CLR_Header00
typenamesizecp
AVI#3001118021252
ICON#116401252
ICON#27441252
ICON#34881252
ICON#42961252
ICON#537521252
ICON#622161252
ICON#717361252
ICON#813841252
ICON#9557621252
ICON#1096401252
ICON#1142641252
ICON#1224401252
ICON#1311281252
ICON#1413841252
ICON#1522161252
ICON#162961252
ICON#177441252
ICON#1816401252
ICON#1937521252
DIALOG#20017541252
DIALOG#20024321252
DIALOG#20033581252
DIALOG#20044481252
DIALOG#20053041252
DIALOG#20062881252
STRING#631401252
STRING#7613121252
STRING#7714841252
STRING#8012001252
STRING#8310981252
STRING#859741252
RCDATAADMQCMD71252
RCDATACABINET7866161252
RCDATAEXTRACTOPT41252
RCDATAFILESIZES361252
RCDATAFINISHMSG71252
RCDATALICENSE71252
RCDATAPACKINSTSPACE41252
RCDATAPOSTRUNPROGRAM91252
RCDATAREBOOT41252
RCDATARUNPROGRAM91252
RCDATASHOWWINDOW41252
RCDATATITLE381252
RCDATAUPROMPT71252
RCDATAUSRQCMD71252
GROUP_ICON#3000901252
GROUP_ICON#30001881252
VERSION#110681252
MANIFEST#112641252
idlangstring
10001033Please select a folder to store the extracted files.
10011033%s
12001033Failed to get disk space information from: %s. System Message: %s.
12011033A required resource cannot be located.
12021033Are you sure you want to cancel?
12041033Unable to retrieve operating system version information.
12051033Memory allocation request failed.
12081033Unable to create extraction thread.
12101033Cabinet is not valid.
12111033Filetable full.
12121033Can not change to destination folder.
12131033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.
12141033That folder is invalid. Please make sure the folder exists and is writable.
12151033You must specify a folder with fully qualified pathname or choose Cancel.
12161033Could not update folder edit box.
12171033Could not load functions required for browser dialog.
12181033Could not load Shell32.dll required for browser dialog.
12201033Error creating process <%s>. Reason: %s
12211033The cluster size in this system is not supported.
12221033A required resource appears to be corrupted.
12231033Windows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
12241033Error loading %s
12251033GetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used.
12261033Windows 95 or Windows NT is required to install
12271033Could not create folder '%s'
12281033To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue. Do you still want to continue?
12641033Error retrieving Windows folder
12691033NT Shutdown: OpenProcessToken error.
12701033NT Shutdown: AdjustTokenPrivileges error.
12711033NT Shutdown: ExitWindowsEx error.
12721033Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.
12731033The setup program could not retrieve the volume information for drive (%s) . System message: %s.
12741033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.
12751033The installation program appears to be damaged or corrupted. Contact the vendor of this application.
13121033Command line option syntax error. Type Command /? for Help.
13131033Command line options: /Q -- Quiet modes for package, /T:<full path> -- Specifies temporary working folder, /C -- Extract files only to the folder when used also with /T. /C:<Cmd> -- Override Install Command defined by author.
13141033You must restart your computer before the new settings will take effect. Do you want to restart your computer now?
13161033Another copy of the '%s' package is already running on your system. Do you want to run another copy?
13171033Could not find the file: %s.
13511033You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
13541033The folder '%s' does not exist. Do you want to create it?
13551033Another copy of the '%s' package is already running on your system. You can only run one copy at a time.
13561033The '%s' package is not compatible with the version of Windows you are running.
13571033The '%s' package is not compatible with the version of the file: %s on your system.
module_namehintordfunction_name
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll263EqualSid
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll406LookupPrivilegeValueA
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll615RegQueryInfoKeyA
ADVAPI32.dll583RegDeleteValueA
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll288FreeSid
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll560RegCloseKey
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll710GlobalLock
KERNEL32.dll1353_lclose
KERNEL32.dll290ExpandEnvironmentStringsA
KERNEL32.dll694GetWindowsDirectoryA
KERNEL32.dll699GlobalAlloc
KERNEL32.dll578GetPrivateProfileIntA
KERNEL32.dll492GetFileAttributesA
KERNEL32.dll768IsDBCSLeadByte
KERNEL32.dll630GetSystemDirectoryA
KERNEL32.dll717GlobalUnlock
KERNEL32.dll615GetShortPathNameA
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll312FindFirstFileA
KERNEL32.dll520GetLastError
KERNEL32.dll588GetProcAddress
KERNEL32.dll1027RemoveDirectoryA
KERNEL32.dll1132SetFileAttributesA
KERNEL32.dll706GlobalFree
KERNEL32.dll308FindClose
KERNEL32.dll584GetPrivateProfileStringA
KERNEL32.dll830LoadLibraryA
KERNEL32.dll838LocalAlloc
KERNEL32.dll1337WritePrivateProfileStringA
KERNEL32.dll537GetModuleFileNameA
KERNEL32.dll329FindNextFileA
KERNEL32.dll97CompareStringA
KERNEL32.dll1357_lopen
KERNEL32.dll82CloseHandle
KERNEL32.dll842LocalFree
KERNEL32.dll212DeleteFileA
KERNEL32.dll287ExitProcess
KERNEL32.dll232DosDateTimeToFileTime
KERNEL32.dll360FreeLibrary
KERNEL32.dll337FindResourceA
KERNEL32.dll1140SetFilePointer
KERNEL32.dll363FreeResource
KERNEL32.dll835LoadResource
KERNEL32.dll1288WaitForSingleObject
KERNEL32.dll1127SetEvent
KERNEL32.dll542GetModuleHandleW
KERNEL32.dll355FormatMessageA
KERNEL32.dll1144SetFileTime
KERNEL32.dll1332WriteFile
KERNEL32.dll473GetDriveTypeA
KERNEL32.dll685GetVolumeInformationA
KERNEL32.dll1231TerminateThread
KERNEL32.dll1215SizeofResource
KERNEL32.dll130CreateEventA
KERNEL32.dll486GetExitCodeProcess
KERNEL32.dll1376lstrlenA
KERNEL32.dll963ReadFile
KERNEL32.dll1114SetCurrentDirectoryA
KERNEL32.dll649GetTempFileNameA
KERNEL32.dll1042ResetEvent
KERNEL32.dll854LockResource
KERNEL32.dll634GetSystemInfo
KERNEL32.dll831LoadLibraryExA
KERNEL32.dll155CreateMutexA
KERNEL32.dll452GetCurrentDirectoryA
KERNEL32.dll683GetVersionExA
KERNEL32.dll682GetVersion
KERNEL32.dll651GetTempPathA
KERNEL32.dll180CreateThread
KERNEL32.dll840LocalFileTimeToFileTime
KERNEL32.dll1216Sleep
KERNEL32.dll136CreateFileA
KERNEL32.dll1355_llseek
KERNEL32.dll1364lstrcmpA
KERNEL32.dll618GetStartupInfoW
KERNEL32.dll907OutputDebugStringA
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll666GetTickCount
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll1230TerminateProcess
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll256EnumResourceLanguagesA
KERNEL32.dll872MulDiv
KERNEL32.dll467GetDiskFreeSpaceA
KERNEL32.dll164CreateProcessA
GDI32.dll459GetDeviceCaps
USER32.dll617ReleaseDC
USER32.dll566PeekMessageA
USER32.dll530MessageBoxA
USER32.dll291GetDC
USER32.dll635SendMessageA
USER32.dll665SetForegroundWindow
USER32.dll544MsgWaitForMultipleObjects
USER32.dll630SendDlgItemMessageA
USER32.dll408GetWindowLongPtrA
USER32.dll416GetWindowRect
USER32.dll718SetWindowPos
USER32.dll743ShowWindow
USER32.dll714SetWindowLongPtrA
USER32.dll174DispatchMessageA
USER32.dll722SetWindowTextA
USER32.dll216EnableWindow
USER32.dll29CallWindowProcA
USER32.dll168DialogBoxIndirectParamA
USER32.dll299GetDlgItemTextA
USER32.dll509LoadStringA
USER32.dll529MessageBeep
USER32.dll57CharUpperA
USER32.dll47CharNextA
USER32.dll245ExitWindowsEx
USER32.dll50CharPrevA
USER32.dll218EndDialog
USER32.dll293GetDesktopWindow
USER32.dll661SetDlgItemTextA
USER32.dll297GetDlgItem
USER32.dll384GetSystemMetrics
msvcrt.dll128__set_app_type
msvcrt.dll1152memcpy
msvcrt.dll1156memset
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll280_fmode
msvcrt.dll148_acmdln
msvcrt.dll1056exit
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll160_amsg_exit
msvcrt.dll179_cexit
msvcrt.dll392_ismbblead
msvcrt.dll255_exit
msvcrt.dll82_XcptFilter
msvcrt.dll83__C_specific_handler
msvcrt.dll113__getmainargs
msvcrt.dll246_errno
msvcrt.dll850_vsnprintf
msvcrt.dll364_initterm
COMCTL32.dll17
VERSION.dllGetFileVersionInfoA
VERSION.dll3GetFileVersionInfoSizeA
VERSION.dll13VerQueryValueA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWin32 Cabinet Self-Extractor
FileVersion9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
InternalNameWextract
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWEXTRACT.EXE .MUI
ProductNameWindows® Internet Explorer
ProductVersion9.00.8112.16421

VS_FIXEDFILEINFO

FileVersion9.0.8112.16421
ProductVersion9.0.8112.16421
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
ef3011794AVI#
14d2c55762PNG(256 x 256)#
226fe826626BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 967680 bytes (945 KiB)


--
Type = PE
WARNING = Checksum error
Physical Size = 967680
CPU = x64
64-bit = +
Characteristics = Executable LargeAddress
Created = 2011-03-08 12:37:13
Headers Size = 1024
Checksum = 978218
Name = WEXTRACT.EXE            .MUI
Image Size = 991232
Section Alignment = 4096
File Alignment = 512
Code Size = 53760
Initialized Data Size = 912896
Uninitialized Data Size = 0
Linker Version = 10.0
OS Version = 6.1
Image Version = 6.1
Subsystem Version = 5.2
Subsystem = Windows GUI
DLL Characteristics = Relocated NX-Compatible TerminalServerAware
Stack Reserve = 524288
Stack Commit = 8192
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4294967296
Comment = FileVersion: 9.0.8112.16421
FileVersion: 9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
ProductVersion: 9.0.8112.16421
ProductVersion: 9.00.8112.16421
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Windows® Internet Explorer
----
Path = .rsrc/1033/RCDATA/CABINET
Size = 786616
Packed Size = 786616
--
Path = .rsrc/1033/RCDATA/CABINET
Type = Cab
Physical Size = 786616
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 1554

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2012-05-29 14:17:56 ....A       489088               basi.exe
2012-05-29 14:22:40 ....A       776192               calc.exe
------------------- ----- ------------ ------------  ------------------------
2012-05-29 14:22:40            1265280       967680  2 files

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER