filenametest.dat
size22016 (0x5600)
md50ece44bd85d87b9854ad57646d566237
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Upatre-113 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1272911
3787552
2891782
10816811
1472992
481684
10507
25921019
11816841
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4e50a464
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.1
SizeOfCode0x1800
SizeOfInitializedData0x4800
SizeOfUninitializedData0
AddressOfEntryPoint0x2620
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion3.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x8000
SizeOfHeaders0x400
CheckSum0x595e
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

FASM v1.5x

Sections

namevavsizeraw sizeflags
.text0x10000x16500x1800R-X CODE
.rdata0x30000x65c0x800R-- IDATA
.data0x40000xed80x200RW- IDATA
.rsrc0x50000x2f180x3000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x32480x8c
RESOURCE0x50000x2f18
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x30000xb4
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#196400
DIALOG#1003760
RCDATA#504230
GROUP_ICON#200200
VERSION#15840
MANIFEST#15580
module_namehintordfunction_name
USER32.dll567PostQuitMessage
USER32.dll636SendMessageW
USER32.dll166DestroyWindow
USER32.dll156DefWindowProcW
USER32.dll110CreateWindowExW
USER32.dll491LoadCursorW
USER32.dll493LoadIconW
USER32.dll589RegisterClassExW
USER32.dll485LoadAcceleratorsW
USER32.dll349GetMessageW
USER32.dll764TranslateMessage
USER32.dll175DispatchMessageW
KERNEL32.dll1355lstrcpynW
KERNEL32.dll1343lstrcatW
KERNEL32.dll391GetCommandLineW
KERNEL32.dll831LoadLibraryW
KERNEL32.dll645GetTempPathW
KERNEL32.dll960ReadFile
KERNEL32.dll143CreateFileW
KERNEL32.dll659GetTickCount
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll586GetProcessHeap
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll390GetCommandLineA
KERNEL32.dll715HeapAlloc
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll281ExitProcess
GDI32.dll697TextOutW
GDI32.dll676SetTextAlign
GDI32.dll638SetBkColor
GDI32.dll230DeleteObject
GDI32.dll425GetBkColor
GDI32.dll525GetStockObject
GDI32.dll84CreateSolidBrush
COMCTL32.dll123InitCommonControlsEx
SHELL32.dll6CommandLineToArgvW
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll621RegQueryValueExA

StringTable 2A9652A1

CompanyNameSunfull
FileDescriptionSunfull Ind.
FileVersionVersion 1.4
InternalNameSunfull
LegalCopyrightCopyright by Sunfull Ind.
OriginalFilenameSunfull

VS_FIXEDFILEINFO

FileVersion1.0.0.4
ProductVersion1.0.0.4
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0x10004
FileType1
FileSubtype0
offsetsizetypecomment
022016EXE08/21/2011 06:23:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK