filenameVirusShare_0ca6e2ad69826c8e3287fc8576112814
size15872 (0x3e00)
md50ca6e2ad69826c8e3287fc8576112814
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-195578 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
497822
1472992
10804711
480474
9340359
1092
1197825
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x490524e8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x2400
SizeOfInitializedData0x1800
SizeOfUninitializedData0
AddressOfEntryPoint0x310f
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x7000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x23d20x2400R-X CODE
.rdata0x40000xa500xc00R-- IDATA
.data0x50000x8340x800RW- IDATA
.rsrc0x60000xa00x200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x42800xa0
RESOURCE0x60000xa0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x184
Delay_IAT00
CLR_Header00
typenamesizecp
STRING#1620
idlangstring
12052Hello from MFC!
module_namehintordfunction_name
KERNEL32.dll194FileTimeToLocalFileTime
KERNEL32.dll49CloseHandle
KERNEL32.dll416GetProcessTimes
KERNEL32.dll628OpenProcess
KERNEL32.dll644Process32First
KERNEL32.dll111CreateToolhelp32Snapshot
KERNEL32.dll838TerminateProcess
KERNEL32.dll313GetCurrentDirectoryA
KERNEL32.dll240FreeLibrary
KERNEL32.dll407GetProcAddress
KERNEL32.dll577LoadLibraryA
KERNEL32.dll79CreateFileA
KERNEL32.dll129DeleteFileA
KERNEL32.dll454GetTempFileNameA
KERNEL32.dll456GetTempPathA
KERNEL32.dll675ReadFile
KERNEL32.dll195FileTimeToSystemTime
KERNEL32.dll98CreateProcessA
KERNEL32.dll63CopyFileA
KERNEL32.dll438GetSystemDirectoryA
KERNEL32.dll428GetStartupInfoA
KERNEL32.dll97CreatePipe
KERNEL32.dll830Sleep
KERNEL32.dll371GetModuleFileNameA
KERNEL32.dll798SetProcessPriorityBoost
KERNEL32.dll813SetThreadPriority
KERNEL32.dll317GetCurrentThread
KERNEL32.dll796SetPriorityClass
KERNEL32.dll932lstrcatA
KERNEL32.dll941lstrcpyA
KERNEL32.dll336GetEnvironmentVariableA
KERNEL32.dll426GetShortPathNameA
KERNEL32.dll360GetLastError
KERNEL32.dll646Process32Next
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll639PeekNamedPipe
KERNEL32.dll373GetModuleHandleA
WININET.dll105InternetCloseHandle
WININET.dll154InternetReadFile
WININET.dll147InternetOpenUrlA
WININET.dll146InternetOpenA
WININET.dll128InternetGetConnectedState
WININET.dll111InternetConnectA
WININET.dll85HttpOpenRequestA
WININET.dll89HttpSendRequestA
ADVAPI32.dll333LookupPrivilegeValueA
ADVAPI32.dll426OpenProcessToken
ADVAPI32.dll28AdjustTokenPrivileges
MSVCRT.dll390_onexit
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll690sprintf
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll85__dllonexit
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll183_controlfp
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll241_ftol
MSVCRT.dll597floor
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll573atoi
MSVCRT.dll705strncpy
MSVCRT.dll695strchr
MSVCRT.dll106__p__commode
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll585exit
SHELL32.dll265ShellExecuteExA
SHELL32.dll126SHChangeNotify
MFC42.DLL4203
MFC42.DLL540
MFC42.DLL941
MFC42.DLL939
MFC42.DLL535
MFC42.DLL815
MFC42.DLL561
MFC42.DLL800
MFC42.DLL537
MFC42.DLL859
MFC42.DLL858
MFC42.DLL940
MSVCP60.dll165public: __thiscall std::_Winit::_Winit(void)

??0_Winit@std@@QAE@XZ

MSVCP60.dll265public: __thiscall std::ios_base::Init::~Init(void)

??1Init@ios_base@std@@QAE@XZ

MSVCP60.dll158public: __thiscall std::ios_base::Init::Init(void)

??0Init@ios_base@std@@QAE@XZ

MSVCP60.dll269public: __thiscall std::_Winit::~_Winit(void)

??1_Winit@std@@QAE@XZ

offsetsizetypecomment
015872EXE10/27/2008 02:18:16#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK