test_3 - Worm.Downadup-23

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	test_3
size	118260 (0x1cdf4)
md5	0a99af778c6b564fe78fd5ab050ab7cd

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Worm.Downadup-23 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000090: 00 00 00 00 00 00 00 00                           |........        |

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4534cfdd
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	5.0
SizeOfCode	0x3600
SizeOfInitializedData	0x11400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x44db
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x17000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x358a	0x3600	R-X CODE
.rdata	0x5000	0x876	0xa00	R-- IDATA
.data	0x6000	0xfdb0	0xf400	RW- IDATA
.reloc	0x16000	0xa58	0xc00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x5160	0xa0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x16000	0x930
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5000	0x158
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.dll	450		LoadLibraryA
KERNEL32.dll	429		InterlockedDecrement
KERNEL32.dll	430		InterlockedExchange
KERNEL32.dll	292		GetModuleFileNameA
KERNEL32.dll	318		GetProcAddress
KERNEL32.dll	369		GetUserDefaultLCID
KERNEL32.dll	441		IsDBCSLeadByte
KERNEL32.dll	351		GetSystemTimeAsFileTime
KERNEL32.dll	699		VirtualAlloc
KERNEL32.dll	707		VirtualProtect
KERNEL32.dll	95		DosDateTimeToFileTime
KERNEL32.dll	365		GetTickCount
KERNEL32.dll	373		GetVersionExA
KERNEL32.dll	662		Sleep
KERNEL32.dll	519		QueryPerformanceFrequency
KERNEL32.dll	518		QueryPerformanceCounter
KERNEL32.dll	443		IsDebuggerPresent
KERNEL32.dll	282		GetLastError
KERNEL32.dll	247		GetCurrentProcess
KERNEL32.dll	320		GetProcessHeap
KERNEL32.dll	438		IsBadStringPtrA
KERNEL32.dll	440		IsBadWritePtr
KERNEL32.dll	483		MulDiv
USER32.dll	401		IsWindowUnicode
USER32.dll	339		GetWindowContextHelpId
USER32.dll	350		GetWindowTextA
USER32.dll	385		IsCharLowerA
USER32.dll	387		IsCharUpperA
USER32.dll	382		IsCharAlphaNumericA
USER32.dll	381		IsCharAlphaA
USER32.dll	340		GetWindowDC
USER32.dll	390		IsClipboardFormatAvailable
USER32.dll	680		WindowFromDC
USER32.dll	264		GetForegroundWindow
USER32.dll	267		GetIconInfo
USER32.dll	66		CopyIcon
USER32.dll	225		GetAncestor
USER32.dll	338		GetWindow
USER32.dll	281		GetLastActivePopup
USER32.dll	354		GetWindowThreadProcessId
USER32.dll	332		GetTopWindow
USER32.dll	403		IsZoomed
USER32.dll	265		GetGUIThreadInfo
USER32.dll	367		InSendMessage
USER32.dll	309		GetParent
USER32.dll	348		GetWindowRect
ADVAPI32.dll	403		RevertToSelf
ADVAPI32.dll	215		GetUserNameA
ADVAPI32.dll	27		AreAnyAccessesGranted
ADVAPI32.dll	231		IsValidAcl
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	657		malloc
MSVCRT.dll	271		_initterm
MSVCRT.dll	606		free
MSVCRT.dll	385		_memicmp
MSVCRT.dll	460		_swab
MSVCRT.dll	473		_ultoa
MSVCRT.dll	54		_CIcosh
MSVCRT.dll	56		_CIfmod
MSVCRT.dll	584		div
MSVCRT.dll	61		_CIsinh
MSVCRT.dll	49		_CIacos
MSVCRT.dll	326		_ltoa
MSVCRT.dll	86		__doserrno
MSVCRT.dll	597		floor
MSVCRT.dll	652		localeconv
MSVCRT.dll	398		_pctype
MSVCRT.dll	277		_isctype
MSVCRT.dll	268		_hypot
MSVCRT.dll	97		__mb_cur_max
MSVCRT.dll	308		_itoa
GDI32.dll	262		GetBitmapDimensionEx
GDI32.dll	345		GetROP2
GDI32.dll	264		GetBkMode
GDI32.dll	263		GetBkColor
GDI32.dll	215		GdiFlush
ole32.dll	18		CoFileTimeNow
SHELL32.dll		64
SHELL32.dll		524

show previews

offset	size	type	comment
0	82944	DLL	10/17/2006 12:43:09	#
15c1	15	HTM		#
14400	35316	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 118260 bytes (116 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

test_3-

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

test_3
-