filenamePatch.exe
size192512 (0x2f000)
md511ba53a7077871f1f9a68ee1488b768f
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-361166 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xc0

Rich Header

lib idversiontimes used
001
198078117
18844423
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x47bae987
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.12
SizeOfCode0x6400
SizeOfInitializedData0x28800
SizeOfUninitializedData0
AddressOfEntryPoint0x10e7
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion4.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x45000
SizeOfHeaders0x400
CheckSum0x165e9
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM / TASM

Sections

namevavsizeraw sizeflags
.text0x10000x62700x6400R-X CODE
.rdata0x80000xad40xc00R-- IDATA
.data0x90000x132ce0x400RW- IDATA
.rsrc0x1d0000x276ec0x27800R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x81b00xb4
RESOURCE0x1d0000x276ec
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x80000x1b0
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#5042641252
ICON#142641252
DIALOG#1005041252
DIALOG#19001361252
RCDATA#1500839681252
RCDATA#151051771252
RCDATA#151149931252
RCDATA#151239591252
RCDATA#151336801252
RCDATA#1530801252
RCDATA#15501311252
RCDATA#1596262801252
RCDATA#1599225641252
RCDATA#2000551252
RCDATA#20014331252
GROUP_CURSOR#1597201252
GROUP_ICON#1598201252
module_namehintordfunction_name
kernel32.dll564SetFileAttributesA
kernel32.dll566SetFilePointer
kernel32.dll607SizeofResource
kernel32.dll608Sleep
kernel32.dll631UnmapViewOfFile
kernel32.dll655WaitForSingleObject
kernel32.dll660WinExec
kernel32.dll670WriteFile
kernel32.dll693lstrcatA
kernel32.dll699lstrcpyA
kernel32.dll703lstrlenA
kernel32.dll521RtlMoveMemory
kernel32.dll386HeapDestroy
kernel32.dll385HeapCreate
kernel32.dll595SetThreadPriority
kernel32.dll70CreateThread
kernel32.dll387HeapFree
kernel32.dll383HeapAlloc
kernel32.dll289GetProcessHeap
kernel32.dll147FindFirstFileA
kernel32.dll143FindClose
kernel32.dll263GetModuleFileNameA
kernel32.dll503ReadFile
kernel32.dll455MultiByteToWideChar
kernel32.dll439LockResource
kernel32.dll425LoadResource
kernel32.dll366GlobalFree
kernel32.dll359GlobalAlloc
kernel32.dll346GetVersionExA
kernel32.dll287GetProcAddress
kernel32.dll265GetModuleHandleA
kernel32.dll26CloseHandle
kernel32.dll245GetFileSize
kernel32.dll169FlushFileBuffers
kernel32.dll162FindResourceA
kernel32.dll130ExpandEnvironmentStringsA
kernel32.dll128ExitProcess
kernel32.dll83DeleteFileA
kernel32.dll64CreateProcessA
kernel32.dll48CreateFileA
user32.dll535SetTimer
user32.dll507SetFocus
user32.dll504SetDlgItemTextA
user32.dll491SetCapture
user32.dll482SendMessageA
user32.dll477SendDlgItemMessageA
user32.dll467ReleaseDC
user32.dll466ReleaseCapture
user32.dll590UpdateWindow
user32.dll445PostMessageA
user32.dll424MoveWindow
user32.dll413MessageBoxA
user32.dll388LoadIconA
user32.dll384LoadCursorA
user32.dll379KillTimer
user32.dll328GetWindowRect
user32.dll308GetSystemMetrics
user32.dll281GetMessageA
user32.dll578TranslateMessage
user32.dll557ShowWindow
user32.dll546SetWindowTextA
user32.dll456RegisterClassExA
user32.dll544SetWindowPos
user32.dll244GetDlgItemTextA
user32.dll242GetDlgItem
user32.dll237GetDC
user32.dll236GetCursorPos
user32.dll173EndDialog
user32.dll171EnableWindow
user32.dll140DispatchMessageA
user32.dll138DialogBoxParamA
user32.dll126DefWindowProcA
user32.dll84CreateWindowExA
user32.dll447PostQuitMessage
comctl32.dll62InitCommonControls
gdi32.dll39CreateDIBSection
gdi32.dll47CreateFontIndirectA
gdi32.dll72DeleteDC
gdi32.dll75DeleteObject
gdi32.dll205GetObjectA
gdi32.dll34CreateCompatibleDC
gdi32.dll302SelectObject
gdi32.dll308SetBkColor
gdi32.dll309SetBkMode
gdi32.dll345SetTextColor
gdi32.dll362TextOutA
gdi32.dll12BitBlt
gdi32.dll235GetTextExtentPointA
gdi32.dll40CreateDIBitmap
comdlg32.dll10GetOpenFileNameA
shell32.dll103ShellExecuteA
shlwapi.dll92PathQuoteSpacesA
shlwapi.dll114PathStripPathA
winmm.dll181waveOutGetPosition
winmm.dll184waveOutOpen
winmm.dll186waveOutPrepareHeader
winmm.dll187waveOutReset
winmm.dll192waveOutUnprepareHeader
winmm.dll193waveOutWrite
winmm.dll172waveOutClose
offsetsizetypecomment
0192512EXE02/19/2008 14:36:55#
15c115HTM#
9fa083968PNG(310 x 300)#
1e7a05177PNG(20 x 144)#
1fbdc4993PNG(20 x 144)#
20f603959PNG(10 x 152)#
21ed83680PNG(12 x 148)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK