filenameVirus.Win9x.Arianne.1022.b
size94112 (0x16fa0)
md5166dbceace92b0f8dd5bc22b6e35fb9d
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.W-48 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x344d1e40
PointerToSymbolTable0
NumberOfSymbols0x590
SizeOfOptionalHeader0xe0
Characteristics0x307
Magic0x10b
LinkerVersion5.10
SizeOfCode0xee00
SizeOfInitializedData0x13800
SizeOfUninitializedData0
AddressOfEntryPoint0x25000
BaseOfCode0x1000
BaseOfData0x10000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion5.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x25e00
SizeOfHeaders0x200
CheckSum0x1a75a
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000xed3c0xee00R-X CODE
.data0x100000x120d40x4800RW- IDATA
.rsrc0x230000x14280x1600R-- IDATA
.t00fic0x250000x10000x400RWX

Data Directory

typevasize
EXPORT00
IMPORT0xee880xa0
RESOURCE0x230000x1428
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12d00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x2c4
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#13040
ICON#27440
DIALOG#200310360
STRING#1740
STRING#631340
STRING#64560
STRING#651060
STRING#66800
STRING#5631560
STRING#5645220
STRING#565740
STRING#5711100
GROUP_ICON#100340
VERSION#18680
idlangstring
110333D FlowerBox (OpenGL)
10001033Smooth
10011033Slanted
10021033Cycle
10031033Spin
10041033Bloom
10051033Subdiv
10061033ColorPick
10071033ImageSize
10081033Geom
10091033TwoSided
10251033Cube
10261033Tetrahedron
10271033Pyramids
10281033Cylinder
10291033Spring
10511033Screen Saver.3DFlowerBox
90011033Copyright (c) 1994 Microsoft Corporation
90031033ScreenSaver
90061033control.ini
90141033Warning
90151033Error
90161033The texture must not be larger than %ld by %ld pixels.
90171033The texture you selected is not valid.
90181033Please select another texture for the screen saver. %s is not valid.
90191033Screen saver failed to start.
90211033Texture files (*.bmp)
90221033Choose Texture File
90231033BMP
90241033.BMP
90251033*.BMP
90301033RGB
90311033.RGB
90321033*.RGB
91261033Texture
91271033TextureFileOffset
91291033Size
91301033Tesselation
module_namehintordfunction_name
ADVAPI32.dll357RegQueryValueExA
ADVAPI32.dll347RegOpenKeyA
ADVAPI32.dll348RegOpenKeyExA
ADVAPI32.dll325RegCloseKey
ADVAPI32.dll1072305460
ADVAPI32.dll1072306602
ADVAPI32.dll1072305361
ADVAPI32.dll1072305732
KERNEL32.dll271GetModuleFileNameA
KERNEL32.dll160FreeEnvironmentStringsA
KERNEL32.dll459MultiByteToWideChar
KERNEL32.dll161FreeEnvironmentStringsW
KERNEL32.dll242GetEnvironmentStrings
KERNEL32.dll635TerminateProcess
KERNEL32.dll244GetEnvironmentStringsW
KERNEL32.dll684WideCharToMultiByte
KERNEL32.dll173GetCPInfo
KERNEL32.dll167GetACP
KERNEL32.dll284GetOEMCP
KERNEL32.dll589SetHandleCount
KERNEL32.dll317GetStdHandle
KERNEL32.dll256GetFileType
KERNEL32.dll388HeapDestroy
KERNEL32.dll386HeapCreate
KERNEL32.dll665VirtualFree
KERNEL32.dll352GetVersionExA
KERNEL32.dll661VirtualAlloc
KERNEL32.dll347GetTimeZoneInformation
KERNEL32.dll422LCMapStringA
KERNEL32.dll423LCMapStringW
KERNEL32.dll318GetStringTypeA
KERNEL32.dll321GetStringTypeW
KERNEL32.dll261GetLastError
KERNEL32.dll31CompareStringA
KERNEL32.dll32CompareStringW
KERNEL32.dll579SetEnvironmentVariableA
KERNEL32.dll587SetFilePointer
KERNEL32.dll393HeapReAlloc
KERNEL32.dll604SetStdHandle
KERNEL32.dll152FlushFileBuffers
KERNEL32.dll384HeapAlloc
KERNEL32.dll262GetLocalTime
KERNEL32.dll351GetVersion
KERNEL32.dll509ReadFile
KERNEL32.dll25CloseHandle
KERNEL32.dll227GetCurrentProcess
KERNEL32.dll286GetPriorityClass
KERNEL32.dll599SetPriorityClass
KERNEL32.dll435LocalFree
KERNEL32.dll738lstrlenA
KERNEL32.dll182GetCommandLineA
KERNEL32.dll315GetStartupInfoA
KERNEL32.dll117ExitProcess
KERNEL32.dll344GetTickCount
KERNEL32.dll425LoadLibraryA
KERNEL32.dll390HeapFree
KERNEL32.dll162FreeLibrary
KERNEL32.dll297GetProcAddress
KERNEL32.dll627Sleep
KERNEL32.dll648UnhandledExceptionFilter
KERNEL32.dll287GetPrivateProfileIntA
KERNEL32.dll530RtlUnwind
KERNEL32.dll697WriteFile
KERNEL32.dll703WritePrivateProfileStringA
KERNEL32.dll273GetModuleHandleA
KERNEL32.dll431LocalAlloc
KERNEL32.dll1073182447
KERNEL32.dll1073303362
KERNEL32.dll1073184121
KERNEL32.dll1073381597
KERNEL32.dll1073257390
KERNEL32.dll1073302792
KERNEL32.dll1073381588
KERNEL32.dll1073184151
KERNEL32.dll1073184198
KERNEL32.dll1073271151
KERNEL32.dll1073283132
KERNEL32.dll1073328776
KERNEL32.dll1073174376
KERNEL32.dll1073174649
KERNEL32.dll1073180315
KERNEL32.dll1073249252
KERNEL32.dll1073230288
KERNEL32.dll1073284545
KERNEL32.dll1073213425
KERNEL32.dll1073347535
KERNEL32.dll1073184091
KERNEL32.dll1073381714
KERNEL32.dll1073184053
KERNEL32.dll1073381678
KERNEL32.dll1073234169
KERNEL32.dll1073350872
KERNEL32.dll1073348659
KERNEL32.dll1073180979
KERNEL32.dll1073180381
KERNEL32.dll1073174444
KERNEL32.dll1073329555
KERNEL32.dll1073180348
KERNEL32.dll1073181132
KERNEL32.dll1073290831
KERNEL32.dll1073180721
KERNEL32.dll1073205355
KERNEL32.dll1073304190
KERNEL32.dll1073336319
KERNEL32.dll1073276312
KERNEL32.dll1073170888
KERNEL32.dll1073181601
KERNEL32.dll1073264071
KERNEL32.dll1073182629
KERNEL32.dll1073267941
KERNEL32.dll1073179184
KERNEL32.dll1073182408
KERNEL32.dll1073180424
KERNEL32.dll1073271020
KERNEL32.dll1073180064
KERNEL32.dll1073290300
KERNEL32.dll1073334144
KERNEL32.dll1073345755
KERNEL32.dll1073247098
KERNEL32.dll1073180617
KERNEL32.dll1073182907
KERNEL32.dll1073182478
KERNEL32.dll1073170604
GDI32.dll59CreatePalette
GDI32.dll13BitBlt
GDI32.dll294GetSystemPaletteUse
GDI32.dll379SelectPalette
GDI32.dll293GetSystemPaletteEntries
GDI32.dll34CreateCompatibleBitmap
GDI32.dll231GetDIBits
GDI32.dll225GetCurrentObject
GDI32.dll273GetObjectA
GDI32.dll278GetPaletteEntries
GDI32.dll392SetDIBColorTable
GDI32.dll274GetObjectType
GDI32.dll40CreateDIBSection
GDI32.dll436SwapBuffers
GDI32.dll77DescribePixelFormat
GDI32.dll432StretchBlt
GDI32.dll155GdiFlush
GDI32.dll35CreateCompatibleDC
GDI32.dll378SelectObject
GDI32.dll76DeleteObject
GDI32.dll73DeleteDC
GDI32.dll441UnrealizeObject
GDI32.dll356RealizePalette
GDI32.dll417SetSystemPaletteUse
GDI32.dll289GetStockObject
GDI32.dll232GetDeviceCaps
GDI32.dll16ChoosePixelFormat
GDI32.dll410SetPixelFormat
GDI32.dll1072832933
GDI32.dll1072833171
GDI32.dll1072833736
GDI32.dll1072836590
GDI32.dll1072832725
GDI32.dll1072835885
GDI32.dll1072829497
GDI32.dll1072842648
GDI32.dll1072829581
GDI32.dll1072832721
GDI32.dll1072832713
GDI32.dll1072844193
GDI32.dll1072836946
GDI32.dll1072855309
GDI32.dll1072855145
GDI32.dll1072833226
GDI32.dll1072837821
GDI32.dll1072833752
GDI32.dll1072833790
GDI32.dll1072834626
GDI32.dll1072834618
GDI32.dll1072834614
GDI32.dll1072836596
GDI32.dll1072833786
GDI32.dll1072843027
GDI32.dll1072830191
GDI32.dll1072855093
GDI32.dll1072855253
USER32.dll584SetSysColors
USER32.dll525SendDlgItemMessageA
USER32.dll398IsWindow
USER32.dll322GetSysColor
USER32.dll212FillRect
USER32.dll600SetWindowPos
USER32.dll332GetUpdateRect
USER32.dll88CreateWindowExA
USER32.dll615ShowWindow
USER32.dll513ReleaseDC
USER32.dll253GetDC
USER32.dll11BeginPaint
USER32.dll187EndPaint
USER32.dll404KillTimer
USER32.dll591SetTimer
USER32.dll142DestroyWindow
USER32.dll413LoadIconA
USER32.dll496RegisterClassA
USER32.dll409LoadCursorA
USER32.dll240GetClientRect
USER32.dll213FindWindowA
USER32.dll558SetForegroundWindow
USER32.dll147DialogBoxParamA
USER32.dll298GetMessageA
USER32.dll639TranslateMessage
USER32.dll149DispatchMessageA
USER32.dll325GetSystemMetrics
USER32.dll26ChangeDisplaySettingsA
USER32.dll36CharNextA
USER32.dll475PeekMessageA
USER32.dll479PostQuitMessage
USER32.dll309GetParent
USER32.dll548SetCursor
USER32.dll252GetCursorPos
USER32.dll477PostMessageA
USER32.dll132DefWindowProcA
USER32.dll622SystemParametersInfoA
USER32.dll530SendMessageA
USER32.dll264GetForegroundWindow
USER32.dll185EndDialog
USER32.dll679wsprintfA
USER32.dll258GetDlgItem
USER32.dll53CheckRadioButton
USER32.dll50CheckDlgButton
USER32.dll426LoadStringA
USER32.dll557SetFocus
USER32.dll1073031831
USER32.dll1073043484
USER32.dll1073041049
USER32.dll1073040454
USER32.dll1073029494
USER32.dll1073026411
USER32.dll1073027261
USER32.dll1073044581
USER32.dll1073029272
USER32.dll1073029264
USER32.dll1073030301
USER32.dll1073027115
USER32.dll1073027196
USER32.dll1073028013
USER32.dll1073033358
USER32.dll1073030351
USER32.dll1073043949
USER32.dll1073038178
USER32.dll1073043971
USER32.dll1073041337
USER32.dll1073043724
USER32.dll1073030331
USER32.dll1073033173
USER32.dll1073043249
USER32.dll1073043293
USER32.dll1073039155
USER32.dll1073042154
USER32.dll1073033845
USER32.dll1073039678
USER32.dll1073043457
USER32.dll1073030335
USER32.dll1073030257
USER32.dll1073032586
USER32.dll1073028846
USER32.dll1073043196
USER32.dll1073044417
USER32.dll1073025641
USER32.dll1073043498
USER32.dll1073041897
USER32.dll1073028009
USER32.dll1073042821
USER32.dll1073041136
USER32.dll1073026956
USER32.dll1073026925
USER32.dll1073042816
USER32.dll1073030277
OPENGL32.dll255glRotated
OPENGL32.dll17glClear
OPENGL32.dll178glMaterialf
OPENGL32.dll98glFlush
OPENGL32.dll97glFinish
OPENGL32.dll343glViewport
OPENGL32.dll259glScissor
OPENGL32.dll346wglCreateContext
OPENGL32.dll357wglMakeCurrent
OPENGL32.dll348wglDeleteContext
OPENGL32.dll356wglGetProcAddress
OPENGL32.dll125glGetString
OPENGL32.dll261glShadeModel
OPENGL32.dll75glDrawElements
OPENGL32.dll11glBegin
OPENGL32.dll191glNormal3fv
OPENGL32.dll329glVertex3fv
OPENGL32.dll82glEnd
OPENGL32.dll196glNormalPointer
OPENGL32.dll342glVertexPointer
OPENGL32.dll81glEnableClientState
OPENGL32.dll72glDisableClientState
OPENGL32.dll182glMatrixMode
OPENGL32.dll20glClearDepth
OPENGL32.dll64glCullFace
OPENGL32.dll159glLightfv
OPENGL32.dll156glLightModeli
OPENGL32.dll71glDisable
OPENGL32.dll80glEnable
OPENGL32.dll179glMaterialfv
OPENGL32.dll165glLoadIdentity
COMCTL32.dll17
COMCTL32.dll1072436256
GLU32.dll21gluLookAt
GLU32.dll32gluPerspective

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionOpenGL 3D Flowerbox Screen Saver
FileVersion5.00.1679.1
InternalNamessflwbox
LegalCopyrightCopyright (C) Microsoft Corp. 1981-1997
OriginalFilenamessflwbox
ProductNameMicrosoft(R) Windows NT(R) Operating System
ProductVersion5.00.1679.1

VS_FIXEDFILEINFO

FileVersion5.0.1679.1
ProductVersion5.0.1679.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
090112EXE10/21/1997 21:27:28#
15c115HTM#
160004000BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK