filenameSample.exe2
size65536 (0x10000)
md524d76abbc0a10e4c977a28b33c879248
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Malware.BBSwift-1 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1272913
1472995
10804711
1180471
480474
0014
10129
1980349
1197825

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x56b48b8c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0xc000
SizeOfInitializedData0xd000
SizeOfUninitializedData0
AddressOfEntryPoint0xbea0
BaseOfCode0x1000
BaseOfData0xd000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1a000
SizeOfHeaders0x1000
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000xb36b0xc000R-X CODE
.rdata0xd0000x15880x2000R-- IDATA
.data0xf0000xa6280x1000RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xd6180xb4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xd0000x244
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll776lstrlenA
KERNEL32.dll87DeleteFileA
KERNEL32.dll551RemoveDirectoryA
KERNEL32.dll477MoveFileA
KERNEL32.dll275GetFileSizeEx
KERNEL32.dll170FlushFileBuffers
KERNEL32.dll144FindClose
KERNEL32.dll157FindNextFileA
KERNEL32.dll148FindFirstFileA
KERNEL32.dll40CopyFileA
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll68CreateProcessA
KERNEL32.dll510Process32Next
KERNEL32.dll475Module32Next
KERNEL32.dll473Module32First
KERNEL32.dll495OpenProcess
KERNEL32.dll269GetFileAttributesA
KERNEL32.dll76CreateToolhelp32Snapshot
KERNEL32.dll745WriteProcessMemory
KERNEL32.dll540ReadProcessMemory
KERNEL32.dll708VirtualProtectEx
KERNEL32.dll449LeaveCriticalSection
KERNEL32.dll102EnterCriticalSection
KERNEL32.dll355GetTempFileNameA
KERNEL32.dll357GetTempPathA
KERNEL32.dll138FileTimeToSystemTime
KERNEL32.dll125ExitProcess
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll392GlobalFree
KERNEL32.dll385GlobalAlloc
KERNEL32.dll85DeleteCriticalSection
KERNEL32.dll74CreateThread
KERNEL32.dll426InitializeCriticalSection
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll662Sleep
KERNEL32.dll282GetLastError
KERNEL32.dll618SetFilePointer
KERNEL32.dll735WriteFile
KERNEL32.dll52CreateFileA
KERNEL32.dll274GetFileSize
KERNEL32.dll456LocalAlloc
KERNEL32.dll536ReadFile
KERNEL32.dll460LocalFree
KERNEL32.dll27CloseHandle
KERNEL32.dll381GetWindowsDirectoryA
KERNEL32.dll45CreateDirectoryA
KERNEL32.dll508Process32First
KERNEL32.dll283GetLocalTime
WINSPOOL.DRV124OpenPrinterA
WINSPOOL.DRV150SetPrinterA
WINSPOOL.DRV28ClosePrinter
WINSPOOL.DRV79EnumJobsA
ADVAPI32.dll327OpenServiceA
ADVAPI32.dll120DeleteService
ADVAPI32.dll245LookupPrivilegeValueA
ADVAPI32.dll23AdjustTokenPrivileges
ADVAPI32.dll322OpenProcessToken
ADVAPI32.dll208GetTokenInformation
ADVAPI32.dll62ConvertSidToStringSidA
ADVAPI32.dll64ConvertStringSecurityDescriptorToSecurityDescriptorA
ADVAPI32.dll325OpenSCManagerA
ADVAPI32.dll430SetServiceStatus
ADVAPI32.dll398RegisterServiceCtrlHandlerA
ADVAPI32.dll435StartServiceCtrlDispatcherA
ADVAPI32.dll52CloseServiceHandle
SHELL32.dll148StrStrIA
SHLWAPI.dll71PathMatchSpecA
SHLWAPI.dll200StrTrimA
WININET.dll73HttpSendRequestA
WININET.dll71HttpQueryInfoA
WININET.dll119InternetReadFile
WININET.dll116InternetQueryDataAvailable
WININET.dll69HttpOpenRequestA
WININET.dll86InternetCloseHandle
WININET.dll90InternetConnectA
WININET.dll111InternetOpenA
MSVCP60.dll1010private: void __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::_Split(void)

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

MSVCP60.dll856private: void __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::_Freeze(void)

?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

MSVCP60.dll1056public: class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > & __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::assign(char const *, unsigned int)

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

MSVCP60.dll1037public: class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > & __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::append(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const &, unsigned int, unsigned int)

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

MSVCP60.dll1633public: static unsigned int const std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::npos

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

MSVCP60.dll1052public: class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > & __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::assign(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const &, unsigned int, unsigned int)

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

MSVCP60.dll813char const `private: static char const * __cdecl std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::_Nullstr(void)'::`2'::_C

?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

MSVCP60.dll233public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::~basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(void)

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

MSVCP60.dll1599public: unsigned int __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::max_size(void)const

?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ

MSVCP60.dll1029void __cdecl std::_Xlen(void)

?_Xlen@std@@YAXXZ

MSVCP60.dll1016private: void __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::_Tidy(bool)

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

MSVCP60.dll824private: void __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::_Copy(unsigned int)

?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

MSVCP60.dll842private: void __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::_Eos(unsigned int)

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

MSVCP60.dll914private: bool __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::_Grow(unsigned int, bool)

?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

MSVCP60.dll1030void __cdecl std::_Xran(void)

?_Xran@std@@YAXXZ

MSVCRT.dll657malloc
MSVCRT.dll85__dllonexit
MSVCRT.dll709strstr
MSVCRT.dll390_onexit
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll100__p___initenv
MSVCRT.dll183_controlfp
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll202_except_handler3
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll703strncat
MSVCRT.dll106__p__commode
MSVCRT.dll588fclose
MSVCRT.dll600fprintf
MSVCRT.dll599fopen
MSVCRT.dll481_vsnprintf
MSVCRT.dll328_makepath
MSVCRT.dll690sprintf
MSVCRT.dll606free
MSVCRT.dll707strrchr
MSVCRT.dll447_strdup
MSVCRT.dll678rand
MSVCRT.dll441_splitpath
MSVCRT.dll430_snprintf
MSVCRT.dll576calloc
MSVCRT.dll695strchr
MSVCRT.dll693sscanf
MSVCRT.dll627isdigit
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll705strncpy
MSVCRT.dll712strtol
MSVCRT.dll449_stricmp
MSVCRT.dll453_strnicmp
MSVCRT.dll142_access
MSVCRT.dll573atoi
MSVCRT.dll720time
MSVCRT.dll670printf
MSVCRT.dll664memmove
offsetsizetypecomment
065536EXE02/05/2016 11:46:20#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK