windows.exe - Trojan.Downloader-11579

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	windows.exe
size	22016 (0x5600)
md5	162c8a584c208673744f1970eec0ffa0

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Trojan.Downloader-11579 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
19	9049	2
28	9178	1
64	9210	9
25	9210	13
1	0	74
96	3077	16
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x46706c27
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x4e00
SizeOfInitializedData	0x1a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x34d0
BaseOfCode	0x1000
BaseOfData	0x6000
ImageBase	0x15110000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x9000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4cb0	0x4e00	RWX CODE
.data	0x6000	0x17d0	0x200	RW- IDATA
.bdata	0x8000	0x6f	0x200	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x5648	0xa0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1000	0x144
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.dll	696		ResumeThread
KERNEL32.dll	802		SetThreadContext
KERNEL32.dll	451		GetThreadContext
KERNEL32.dll	96		CreateProcessA
KERNEL32.dll	925		lstrcatA
KERNEL32.dll	934		lstrcpyA
KERNEL32.dll	681		ReleaseMutex
KERNEL32.dll	883		WaitForSingleObject
KERNEL32.dll	940		lstrlenA
KERNEL32.dll	831		TerminateProcess
KERNEL32.dll	421		GetStartupInfoA
KERNEL32.dll	175		ExitProcess
KERNEL32.dll	124		DeleteFileA
KERNEL32.dll	928		lstrcmpA
KERNEL32.dll	262		GetComputerNameA
KERNEL32.dll	867		VirtualAlloc
KERNEL32.dll	832		TerminateThread
KERNEL32.dll	90		CreateMutexA
KERNEL32.dll	77		CreateFileA
KERNEL32.dll	570		LoadLibraryA
KERNEL32.dll	47		CloseHandle
KERNEL32.dll	61		CopyFileA
KERNEL32.dll	353		GetLastError
KERNEL32.dll	364		GetModuleFileNameA
KERNEL32.dll	366		GetModuleHandleA
KERNEL32.dll	431		GetSystemDirectoryA
KERNEL32.dll	233		FreeLibrary
KERNEL32.dll	400		GetProcAddress
KERNEL32.dll	571		LoadLibraryExA
KERNEL32.dll	789		SetPriorityClass
KERNEL32.dll	468		GetVersionExA
KERNEL32.dll	308		GetCurrentProcess
KERNEL32.dll	671		ReadProcessMemory
KERNEL32.dll	868		VirtualAllocEx
KERNEL32.dll	874		VirtualProtectEx
KERNEL32.dll	909		WriteProcessMemory
KERNEL32.dll	870		VirtualFree
KERNEL32.dll	309		GetCurrentProcessId
KERNEL32.dll	105		CreateThread
KERNEL32.dll	176		ExitThread
KERNEL32.dll	458		GetTickCount
KERNEL32.dll	470		GetVolumeInformationA
KERNEL32.dll	823		Sleep
USER32.dll	728		wsprintfA
ADVAPI32.dll	424		OpenProcessToken
ADVAPI32.dll	331		LookupPrivilegeValueA
ADVAPI32.dll	28		AdjustTokenPrivileges
ADVAPI32.dll	459		RegCreateKeyA
ADVAPI32.dll	504		RegSetValueExA
ADVAPI32.dll	480		RegOpenKeyA
ADVAPI32.dll	463		RegDeleteKeyA
ADVAPI32.dll	456		RegCloseKey
WS2_32.dll		12
WS2_32.dll		115
WS2_32.dll		23
WS2_32.dll		20
WS2_32.dll		9
WS2_32.dll		4
WS2_32.dll		19
WS2_32.dll		11
WS2_32.dll		52
WS2_32.dll		8
WS2_32.dll		3
WS2_32.dll		57
WS2_32.dll		21
WININET.dll	111		InternetConnectA
WININET.dll	85		HttpOpenRequestA
WININET.dll	89		HttpSendRequestA
WININET.dll	154		InternetReadFile
WININET.dll	105		InternetCloseHandle
WININET.dll	146		InternetOpenA
DNSAPI.dll	73		DnsQuery_A
DNSAPI.dll	80		DnsRecordListFree
ntdll.dll	207		NtQuerySystemInformation

show previews

offset	size	type	comment
0	22016	EXE	06/13/2007 22:13:59	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

windows.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

windows.exe
-