a7ac0003d2f36841dc217fe78fcdeeed_spyeye

info
MZ
PE
resources
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	a7ac0003d2f36841dc217fe78fcdeeed_spyeye
size	639488 (0x9c200)
md5	10a44d65ee55c13f06c4ea5c13058e0e

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Trojan.Spy.SpyEyes-8 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

DOS stub

00000000: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000090:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x4d3420ba
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x2600
SizeOfInitializedData	0x5ee00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2d43
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x65000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0x8540
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig2(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2520	0x2600	R-X CODE
.rdata	0x4000	0x6b4	0x800	R-- IDATA
.data	0x5000	0x4b59c	0x4b600	RW- IDATA
.rsrc	0x51000	0x128fc	0x12a00	RWX IDATA
.reloc	0x64000	0x4e4	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x4164	0x3c
RESOURCE	0x51000	0x128fc
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
C	C1	1248	1252
C	C2	68762	1252
C	C3	33	1252
SC	SC1	3072	1252
SC	SC2	2560	1252

module_name	hint	ord	function_name
KERNEL32.DLL			GetFileSize
KERNEL32.DLL			GetModuleFileNameA
KERNEL32.DLL			CreateMutexA
KERNEL32.DLL			SetEnvironmentVariableA
KERNEL32.DLL			CreateToolhelp32Snapshot
KERNEL32.DLL			Process32First
KERNEL32.DLL			lstrcmpiA
KERNEL32.DLL			OpenProcess
KERNEL32.DLL			CreateRemoteThread
KERNEL32.DLL			WaitForSingleObject
KERNEL32.DLL			GetExitCodeThread
KERNEL32.DLL			Process32Next
KERNEL32.DLL			Sleep
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			SetLastError
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			HeapAlloc
KERNEL32.DLL			GetProcessHeap
KERNEL32.DLL			HeapFree
KERNEL32.DLL			HeapValidate
KERNEL32.DLL			FindClose
KERNEL32.DLL			FindNextFileA
KERNEL32.DLL			DeleteFileA
KERNEL32.DLL			RemoveDirectoryA
KERNEL32.DLL			MoveFileExA
KERNEL32.DLL			FindFirstFileA
KERNEL32.DLL			QueryDosDeviceA
KERNEL32.DLL			GetLogicalDriveStringsA
KERNEL32.DLL			WriteFile
KERNEL32.DLL			CloseHandle
KERNEL32.DLL			SetFilePointer
KERNEL32.DLL			SetFileAttributesW
KERNEL32.DLL			GetFileAttributesW
KERNEL32.DLL			ReadFile
KERNEL32.DLL			SizeofResource
KERNEL32.DLL			LoadResource
KERNEL32.DLL			FindResourceExA
KERNEL32.DLL			WideCharToMultiByte
KERNEL32.DLL			MultiByteToWideChar
KERNEL32.DLL			HeapReAlloc
KERNEL32.DLL			IsBadReadPtr
KERNEL32.DLL			OutputDebugStringA
KERNEL32.DLL			GetCurrentThreadId
KERNEL32.DLL			GetLastError
KERNEL32.DLL			GetProcAddress
ntdll.dll			_strcmpi
ntdll.dll			RtlAdjustPrivilege
ntdll.dll			NtWriteVirtualMemory
ntdll.dll			NtAllocateVirtualMemory
ntdll.dll			NtProtectVirtualMemory
ntdll.dll			NtFreeVirtualMemory
ntdll.dll			_chkstk
ntdll.dll			_snprintf
ntdll.dll			_vsnprintf
ntdll.dll			strncmp
ntdll.dll			_strlwr
ntdll.dll			memset
ntdll.dll			memcpy
ntdll.dll			NtQueryInformationFile
ntdll.dll			strstr

show previews

offset	size	type	comment
0	399360	EXE	01/17/2011 10:58:02	#
15c1	15	HTM		#
61800	240128	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 639488 bytes (625 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

a7ac0003d2f36841dc217fe78fcdeeed_spyeye-

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

a7ac0003d2f36841dc217fe78fcdeeed_spyeye
-