filename0ed965454668c98a06fc2e7c90c5621662c23257.bin
size483328 (0x76000)
md51386b9a87bbd39ef0d72093e97f30d52
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Spyware.Ardamax-17 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x45
blocks_in_file1
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xc0

Rich Header

lib idversiontimes used
9540355
93403525
10432
1105072779
1255072749
10950727222
1145072717
124507271
120507271

DOS stub

00000000: b8 00 4c cd 21 00 00 00                           |..L.!...        |

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x46a47b92
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x58600
SizeOfInitializedData0x1d800
SizeOfUninitializedData0
AddressOfEntryPoint0x27c79
BaseOfCode0x1000
BaseOfData0x5a000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x7b000
SizeOfHeaders0x400
CheckSum0x82db9
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x5854d0x58600R-X CODE
.rdata0x5a0000xf6f00xf800R-- IDATA
.data0x6a0000x4f200x2200RW- IDATA
.rsrc0x6f0000xbdf00xbe00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x675340x104
RESOURCE0x6f0000xbdf0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x660580x40
Bound_IAT00
IAT0x5a0000x640
Delay_IAT0x671ec0x80
CLR_Header00
typenamesizecp
BITMAP#20151601252
BITMAP#20241361252
BITMAP#2037441252
BITMAP#2046161252
BITMAP#20731121252
BITMAP#2084881252
ICON#12961252
ICON#27441252
ICON#32961252
ICON#411281252
ICON#511281252
ICON#611281252
ICON#711281252
ICON#811281252
ICON#911281252
ICON#1011281252
ICON#1111281252
ICON#122961252
ICON#132961252
ICON#142961252
ICON#152961252
ICON#162961252
ICON#172961252
ICON#182961252
ICON#192961252
ICON#2011281252
ICON#212961252
MENU#2093261252
MENU#2402181252
DIALOG#1006061252
DIALOG#1066641252
DIALOG#1077661252
DIALOG#1454061252
DIALOG#2057521252
DIALOG#2065881252
DIALOG#2235941252
DIALOG#2245061252
DIALOG#2354581252
DIALOG#2364341252
DIALOG#2378521252
DIALOG#2387201252
DIALOG#2395761252
DIALOG#2424001252
DIALOG#2447881252
DIALOG#2682941252
DIALOG#2696901252
DIALOG#2703241252
DIALOG#2712361252
DIALOG#2728541252
DIALOG#2734861252
DIALOG#2746801252
DIALOG#2767001252
DIALOG#2775761252
DIALOG#2782361252
STRING#20492141252
STRING#2050441252
GROUP_ICON#1201252
GROUP_ICON#101341252
GROUP_ICON#213201252
GROUP_ICON#214201252
GROUP_ICON#215201252
GROUP_ICON#216201252
GROUP_ICON#217201252
GROUP_ICON#220201252
GROUP_ICON#221201252
GROUP_ICON#222201252
GROUP_ICON#225201252
GROUP_ICON#226201252
GROUP_ICON#227201252
GROUP_ICON#228201252
GROUP_ICON#229201252
GROUP_ICON#230201252
GROUP_ICON#231201252
GROUP_ICON#232201252
GROUP_ICON#233201252
GROUP_ICON#234201252
MANIFEST#14861252
#241#201181252
#241#202161252
#241#203181252
#241#204161252
#241#207141252
#241#208141252
idlangstring
327720 Log
327730 Invisibility
327740 Email
327750 FTP
327760 Security
327770 Web Update
327780 Options
327790 Control
327800 Network
327810 Control
327830 Screenshots
327840 Chats
module_namehintordfunction_name
SHLWAPI.dll310UrlUnescapeW
SHLWAPI.dll244StrDupW
SHLWAPI.dll112PathRemoveExtensionW
SHLWAPI.dll124PathStripPathW
SHLWAPI.dll114PathRemoveFileSpecW
SHLWAPI.dll48PathFindExtensionW
SHLWAPI.dll50PathFindFileNameW
SHLWAPI.dll46PathFileExistsW
SHLWAPI.dll234StrCmpIW
SHLWAPI.dll247StrFormatByteSizeW
WS2_32.dll16
WS2_32.dll19
WS2_32.dll115
WS2_32.dll9
WS2_32.dll116
WS2_32.dll55
WS2_32.dll11
WS2_32.dll52
WS2_32.dll23
WS2_32.dll3
WS2_32.dll22
WS2_32.dll18
WS2_32.dll4
COMCTL32.dll93InitCommonControlsEx
COMCTL32.dll61ImageList_Draw
COMCTL32.dll55ImageList_Create
COMCTL32.dll82ImageList_ReplaceIcon
COMCTL32.dll5CreatePropertySheetPageW
COMCTL32.dll101PropertySheetW
COMCTL32.dll26DestroyPropertySheetPage
COMCTL32.dll76ImageList_LoadImageW
COMCTL32.dll56ImageList_Destroy
COMCTL32.dll71ImageList_GetImageCount
COMCTL32.dll108_TrackMouseEvent
SHELL32.dll126SHChangeNotify
SHELL32.dll266ShellExecuteExW
SHELL32.dll155SHFileOperationW
SHELL32.dll189SHGetPathFromIDListW
SHELL32.dll195SHGetSpecialFolderLocation
SHELL32.dll276Shell_NotifyIconW
SHELL32.dll49ExtractIconW
SHELL32.dll29DoEnvironmentSubstW
SHELL32.dll267ShellExecuteW
WININET.dll137InternetGetLastResponseInfoW
WININET.dll105InternetCloseHandle
WININET.dll54FtpPutFileW
WININET.dll39FtpCreateDirectoryW
WININET.dll56FtpRemoveDirectoryW
WININET.dll41FtpDeleteFileW
WININET.dll60FtpSetCurrentDirectoryW
WININET.dll112InternetConnectW
WININET.dll149InternetOpenW
MPR.dll13WNetCancelConnection2W
MPR.dll7WNetAddConnection2W
KERNEL32.dll445GetStringTypeW
KERNEL32.dll474GetThreadLocale
KERNEL32.dll572IsProcessorFeaturePresent
KERNEL32.dll550InterlockedCompareExchange
KERNEL32.dll787SetEnvironmentVariableA
KERNEL32.dll58CompareStringA
KERNEL32.dll967lstrcpyW
KERNEL32.dll973lstrlenW
KERNEL32.dll86CreateFileW
KERNEL32.dll961lstrcmpW
KERNEL32.dll132DeleteFileW
KERNEL32.dll808SetLastError
KERNEL32.dll386GetModuleHandleW
KERNEL32.dll416GetProcAddress
KERNEL32.dll972lstrlenA
KERNEL32.dll966lstrcpyA
KERNEL32.dll960lstrcmpA
KERNEL32.dll597LoadLibraryW
KERNEL32.dll488GetVersion
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll248FreeLibrary
KERNEL32.dll52CloseHandle
KERNEL32.dll932WriteFile
KERNEL32.dll964lstrcmpiW
KERNEL32.dll328GetDateFormatW
KERNEL32.dll229FindResourceExW
KERNEL32.dll854Sleep
KERNEL32.dll897VirtualAlloc
KERNEL32.dll899VirtualFree
KERNEL32.dll458GetSystemTimeAsFileTime
KERNEL32.dll646OpenProcess
KERNEL32.dll821SetProcessWorkingSetSize
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll515GlobalLock
KERNEL32.dll522GlobalUnlock
KERNEL32.dll970lstrcpynW
KERNEL32.dll958lstrcatW
KERNEL32.dll709RemoveDirectoryW
KERNEL32.dll78CreateDirectoryW
KERNEL32.dll794SetFileAttributesW
KERNEL32.dll111CreateThread
KERNEL32.dll836SetThreadPriority
KERNEL32.dll722ResumeThread
KERNEL32.dll371GetLocalTime
KERNEL32.dll859SystemTimeToFileTime
KERNEL32.dll57CompareFileTime
KERNEL32.dll382GetModuleFileNameW
KERNEL32.dll438GetShortPathNameW
KERNEL32.dll345GetEnvironmentVariableW
KERNEL32.dll817SetPriorityClass
KERNEL32.dll325GetCurrentThread
KERNEL32.dll819SetProcessPriorityBoost
KERNEL32.dll624MoveFileExW
KERNEL32.dll185ExitProcess
KERNEL32.dll323GetCurrentProcessId
KERNEL32.dll97CreateMutexW
KERNEL32.dll369GetLastError
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll679RaiseException
KERNEL32.dll239FlushInstructionCache
KERNEL32.dll613LockResource
KERNEL32.dll556InterlockedIncrement
KERNEL32.dll552InterlockedDecrement
KERNEL32.dll853SizeofResource
KERNEL32.dll599LoadResource
KERNEL32.dll230FindResourceW
KERNEL32.dll596LoadLibraryExW
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll59CompareStringW
KERNEL32.dll326GetCurrentThreadId
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll490GetVersionExW
KERNEL32.dll166EnumResourceNamesW
KERNEL32.dll600LocalAlloc
KERNEL32.dll607LocalReAlloc
KERNEL32.dll693ReadFile
KERNEL32.dll33BeginUpdateResourceW
KERNEL32.dll886UpdateResourceW
KERNEL32.dll151EndUpdateResourceW
KERNEL32.dll795SetFilePointer
KERNEL32.dll604LocalFree
KERNEL32.dll114CreateToolhelp32Snapshot
KERNEL32.dll619Module32FirstW
KERNEL32.dll621Module32NextW
KERNEL32.dll663Process32FirstW
KERNEL32.dll665Process32NextW
KERNEL32.dll500GetWindowsDirectoryW
KERNEL32.dll355GetFileSize
KERNEL32.dll85CreateFileMappingW
KERNEL32.dll616MapViewOfFile
KERNEL32.dll881UnmapViewOfFile
KERNEL32.dll784SetEndOfFile
KERNEL32.dll244FormatMessageW
KERNEL32.dll482GetTimeZoneInformation
KERNEL32.dll481GetTimeFormatW
KERNEL32.dll479GetTickCount
KERNEL32.dll654OutputDebugStringW
KERNEL32.dll279GetComputerNameW
KERNEL32.dll963lstrcmpiA
KERNEL32.dll70CopyFileW
KERNEL32.dll468GetTempFileNameW
KERNEL32.dll470GetTempPathW
KERNEL32.dll197FileTimeToSystemTime
KERNEL32.dll196FileTimeToLocalFileTime
KERNEL32.dll353GetFileAttributesW
KERNEL32.dll625MoveFileW
KERNEL32.dll534HeapFree
KERNEL32.dll528HeapAlloc
KERNEL32.dll538HeapReAlloc
KERNEL32.dll862TerminateProcess
KERNEL32.dll878UnhandledExceptionFilter
KERNEL32.dll842SetUnhandledExceptionFilter
KERNEL32.dll569IsDebuggerPresent
KERNEL32.dll489GetVersionExA
KERNEL32.dll419GetProcessHeap
KERNEL32.dll440GetStartupInfoW
KERNEL32.dll532HeapDestroy
KERNEL32.dll530HeapCreate
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll441GetStdHandle
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll869TlsGetValue
KERNEL32.dll867TlsAlloc
KERNEL32.dll870TlsSetValue
KERNEL32.dll868TlsFree
KERNEL32.dll540HeapSize
KERNEL32.dll260GetCPInfo
KERNEL32.dll253GetACP
KERNEL32.dll403GetOEMCP
KERNEL32.dll480GetTimeFormatA
KERNEL32.dll327GetDateFormatA
KERNEL32.dll246FreeEnvironmentStringsA
KERNEL32.dll341GetEnvironmentStrings
KERNEL32.dll247FreeEnvironmentStringsW
KERNEL32.dll343GetEnvironmentStringsW
KERNEL32.dll272GetCommandLineA
KERNEL32.dll273GetCommandLineW
KERNEL32.dll804SetHandleCount
KERNEL32.dll358GetFileType
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll675QueryPerformanceCounter
KERNEL32.dll727RtlUnwind
KERNEL32.dll553InterlockedExchange
KERNEL32.dll594LoadLibraryA
KERNEL32.dll290GetConsoleCP
KERNEL32.dll307GetConsoleMode
KERNEL32.dll372GetLocaleInfoA
KERNEL32.dll580LCMapStringA
KERNEL32.dll581LCMapStringW
KERNEL32.dll442GetStringTypeA
KERNEL32.dll904VirtualQuery
KERNEL32.dll823SetStdHandle
KERNEL32.dll921WriteConsoleA
KERNEL32.dll309GetConsoleOutputCP
KERNEL32.dll931WriteConsoleW
KERNEL32.dll83CreateFileA
KERNEL32.dll238FlushFileBuffers
USER32.dll564ScrollWindow
USER32.dll492MoveWindow
USER32.dll372GetWindowRect
USER32.dll13BeginPaint
USER32.dll200EndPaint
USER32.dll273GetDlgItem
USER32.dll150DestroyIcon
USER32.dll198EndDialog
USER32.dll552RegisterWindowMessageW
USER32.dll239GetAncestor
USER32.dll575SendMessageTimeoutW
USER32.dll377GetWindowTextLengthW
USER32.dll378GetWindowTextW
USER32.dll576SendMessageW
USER32.dll122DdeInitializeW
USER32.dll111DdeCreateStringHandleW
USER32.dll107DdeConnect
USER32.dll105DdeClientTransaction
USER32.dll103DdeAccessData
USER32.dll112DdeDisconnect
USER32.dll116DdeFreeStringHandle
USER32.dll134DdeUninitialize
USER32.dll379GetWindowThreadProcessId
USER32.dll370GetWindowModuleFileNameW
USER32.dll272GetDlgCtrlID
USER32.dll433IsWindowVisible
USER32.dll253GetClassNameW
USER32.dll362GetWindow
USER32.dll222EnumWindows
USER32.dll587SetClipboardViewer
USER32.dll31ChangeClipboardChain
USER32.dll415IsClipboardFormatAvailable
USER32.dll502OpenClipboard
USER32.dll257GetClipboardData
USER32.dll66CloseClipboard
USER32.dll429IsWindow
USER32.dll516PostQuitMessage
USER32.dll267GetCursorPos
USER32.dll599SetForegroundWindow
USER32.dll230FindWindowW
USER32.dll542RegisterHotKey
USER32.dll694UnregisterHotKey
USER32.dll270GetDesktopWindow
USER32.dll279GetForegroundWindow
USER32.dll364GetWindowDC
USER32.dll162DispatchMessageW
USER32.dll682TranslateMessage
USER32.dll318GetMessageW
USER32.dll143DefWindowProcW
USER32.dll179DrawFocusRect
USER32.dll621SetRectEmpty
USER32.dll145DeleteMenu
USER32.dll57CheckMenuItem
USER32.dll345GetSubMenu
USER32.dll457LoadMenuW
USER32.dll447LoadIconW
USER32.dll28CallWindowProcW
USER32.dll159DialogBoxParamW
USER32.dll403InvalidateRect
USER32.dll643SetWindowPos
USER32.dll300GetMenu
USER32.dll2AdjustWindowRectEx
USER32.dll536RegisterClassExW
USER32.dll248GetClassInfoExW
USER32.dll153DestroyWindow
USER32.dll423IsMenu
USER32.dll151DestroyMenu
USER32.dll306GetMenuItemCount
USER32.dll309GetMenuItemInfoW
USER32.dll611SetMenuItemInfoW
USER32.dll700UpdateWindow
USER32.dll325GetParent
USER32.dll255GetClientRect
USER32.dll460LoadStringW
USER32.dll44CharNextW
USER32.dll191DrawTextW
USER32.dll251GetClassLongW
USER32.dll641SetWindowLongW
USER32.dll554ReleaseDC
USER32.dll589SetCursor
USER32.dll445LoadCursorW
USER32.dll347GetSysColorBrush
USER32.dll666SystemParametersInfoW
USER32.dll367GetWindowLongW
USER32.dll394InflateRect
USER32.dll181DrawFrameControl
USER32.dll97CreateWindowExW
USER32.dll594SetDlgItemInt
USER32.dll553ReleaseCapture
USER32.dll243GetCapture
USER32.dll580SetCapture
USER32.dll561ScreenToClient
USER32.dll724WindowFromPoint
USER32.dll316GetMessagePos
USER32.dll289GetKeyState
USER32.dll233FrameRect
USER32.dll501OffsetRect
USER32.dll178DrawEdge
USER32.dll430IsWindowEnabled
USER32.dll41CharLowerW
USER32.dll513PeekMessageW
USER32.dll524PtInRect
USER32.dll278GetFocus
USER32.dll488ModifyMenuW
USER32.dll677TrackPopupMenuEx
USER32.dll320GetMonitorInfoW
USER32.dll489MonitorFromPoint
USER32.dll474MapWindowPoints
USER32.dll226FillRect
USER32.dll686UnhookWindowsHookEx
USER32.dll26CallNextHookEx
USER32.dll651SetWindowsHookExW
USER32.dll728wsprintfW
USER32.dll473MapVirtualKeyW
USER32.dll288GetKeyNameTextW
USER32.dll691UnregisterClassA
USER32.dll74CopyRect
USER32.dll349GetSystemMetrics
USER32.dll346GetSysColor
USER32.dll676TrackPopupMenu
USER32.dll486MessageBoxW
USER32.dll449LoadImageW
USER32.dll515PostMessageW
USER32.dll437KillTimer
USER32.dll634SetTimer
USER32.dll268GetDC
USER32.dll235GetActiveWindow
USER32.dll196EnableWindow
USER32.dll647SetWindowTextW
USER32.dll596SetDlgItemTextW
USER32.dll274GetDlgItemInt
USER32.dll658ShowWindow
USER32.dll276GetDlgItemTextW
USER32.dll598SetFocus
USER32.dll478MessageBeep
GDI32.dll407GetObjectW
GDI32.dll61CreateFontIndirectW
GDI32.dll143DeleteObject
GDI32.dll477PatBlt
GDI32.dll50CreateDIBSection
GDI32.dll45CreateCompatibleDC
GDI32.dll533SetBkColor
GDI32.dll18BitBlt
GDI32.dll140DeleteDC
GDI32.dll44CreateCompatibleBitmap
GDI32.dll70CreatePatternBrush
GDI32.dll537SetBrushOrgEx
GDI32.dll362GetDIBits
GDI32.dll71CreatePen
GDI32.dll499RealizePalette
GDI32.dll39CreateBitmap
GDI32.dll445GetTextMetricsW
GDI32.dll76CreateRectRgnIndirect
GDI32.dll33CombineRgn
GDI32.dll215ExcludeClipRect
GDI32.dll572SetTextColor
GDI32.dll421GetStockObject
GDI32.dll80CreateSolidBrush
GDI32.dll62CreateFontW
GDI32.dll591TextOutW
GDI32.dll493Polygon
GDI32.dll564SetPolyFillMode
GDI32.dll534SetBkMode
GDI32.dll526SelectObject
GDI32.dll437GetTextExtentPoint32W
comdlg32.dll12GetSaveFileNameW
comdlg32.dll10GetOpenFileNameW
ole32.dll101CoTaskMemFree
ole32.dll16CoCreateInstance
ole32.dll105CoUninitialize
ole32.dll100CoTaskMemAlloc
ole32.dll102CoTaskMemRealloc
ole32.dll59CoInitialize
OLEAUT32.dll277
OLEAUT32.dll6
offsetsizetypecomment
0483328EXE07/23/2007 09:57:38#
15c115HTM#
645c0506HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK