dkfe8.exe - MSRSAAP.EXE - Remote Service Application

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	dkfe8.exe
size	240640 (0x3ac00)
md5	2ec2f5ebdda6b658cc9ab1fbb5145139

type	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
mimetype	application/x-dosexec

clamav	WIN.Trojan.DarkKomet-350 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x40
blocks_in_file	1
num_relocs	0
header_paragraphs	2
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0xa
overlay_number	0
reserved0	0xeba1f0e00000000
oem_id	0xb400
oem_info	0xcd09
reserved2	0x4c01b821
reserved3	0x695721cd
reserved4	0x2032336e
reserved5	0x4558452e
reserved6	0x240a0d2e
lfanew	0x40

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 57 69  |........!..L.!Wi|
00000010: 6e 33 32 20 2e 45 58 45  2e 0d 0a 24 40 00 00 00  |n32 .EXE...$@...|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4fd0cff9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x838e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x8f400
SizeOfInitializedData	0x15200
SizeOfUninitializedData	0
AddressOfEntryPoint	0xb262d
BaseOfCode	0x1000
BaseOfData	0x91000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xb5000
SizeOfHeaders	0x200
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x7000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MPRESS v2.12 (MATCODE Software)

Sections

name	va	vsize	raw size	flags
.MPRESS1	0x1000	0xb1000	0x38c00	RWX CODE IDATA UDATA
.MPRESS2	0xb2000	0x11e8	0x1200	RWX CODE IDATA UDATA
.rsrc	0xb4000	0xa18	0xc00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xb2000	0x630
RESOURCE	0xb4000	0xa18
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xb3198	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xb22bc	0xa8
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x4b31b0	0x4b31e8	0x4b31a4	0	0	0

show previews

type	name	size	cp
CURSOR	#1	308	1252
CURSOR	#2	308	1252
CURSOR	#3	308	1252
CURSOR	#4	308	1252
CURSOR	#5	308	1252
CURSOR	#6	308	1252
CURSOR	#7	308	1252
STRING	#4083	524	1252
STRING	#4084	1020	1252
STRING	#4085	168	1252
STRING	#4086	320	1252
STRING	#4087	1144	1252
STRING	#4088	816	1252
STRING	#4089	876	1252
STRING	#4090	1008	1252
STRING	#4091	204	1252
STRING	#4092	176	1252
STRING	#4093	684	1252
STRING	#4094	952	1252
STRING	#4095	852	1252
STRING	#4096	752	1252
RCDATA	DCDATA	842	1252
RCDATA	DVCLAL	16	1252
RCDATA	PACKAGEINFO	2036	1252
GROUP_CURSOR	#32761	20	1252
GROUP_CURSOR	#32762	20	1252
GROUP_CURSOR	#32763	20	1252
GROUP_CURSOR	#32764	20	1252
GROUP_CURSOR	#32765	20	1252
GROUP_CURSOR	#32766	20	1252
GROUP_CURSOR	#32767	20	1252
VERSION	#1	856	1252

module_name	hint	ord	function_name
KERNEL32.DLL			GetModuleHandleA
KERNEL32.DLL			GetProcAddress
oleaut32.dll			SysFreeString
advapi32.dll			RegCloseKey
user32.dll			CharNextA
gdi32.dll			SaveDC
version.dll			VerQueryValueA
wsock32.dll			send
ole32.dll			CoTaskMemFree
shell32.dll			ShellExecuteA
URLMON.DLL			URLDownloadToFileA
comctl32.dll			ImageList_Add
wininet.dll			FtpPutFileA
winmm.dll			waveInOpen
netapi32.dll			Netbios
gdiplus.dll			GdipFree
msacm32.dll			acmStreamSize
ntdll.dll			NtQuerySystemInformation
WS2_32.DLL			WSAIoctl
SHFolder.dll			SHGetFolderPathA
ntdll			NtUnmapViewOfSection
AVICAP32.DLL			capGetDriverDescriptionA

StringTable 040904b0

Comments	Remote Service Application
CompanyName	Microsoft Corp.
FileDescription	Remote Service Application
FileVersion	1, 0, 0, 1
InternalName	MSRSAAPP
LegalCopyright	Copyright (C) 1999
OriginalFilename	MSRSAAP.EXE
ProductName	Remote Service Application
ProductVersion	4, 0, 0, 0

VS_FIXEDFILEINFO

FileVersion	4.0.0.0
ProductVersion	4.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	240640	EXE	06/07/2012 15:59:53	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xad6bc

[?] can't find file_offset of VA 0xad7f0

[?] can't find file_offset of VA 0xad924

[?] can't find file_offset of VA 0xada58

[?] can't find file_offset of VA 0xadb8c

[?] can't find file_offset of VA 0xadcc0

[?] can't find file_offset of VA 0xaddf4

[?] can't find file_offset of VA 0xadf28

[?] can't find file_offset of VA 0xae134

[?] can't find file_offset of VA 0xae530

[?] can't find file_offset of VA 0xae5d8

[?] can't find file_offset of VA 0xae718

[?] can't find file_offset of VA 0xaeb90

[?] can't find file_offset of VA 0xaeec0

[?] can't find file_offset of VA 0xaf22c

[?] can't find file_offset of VA 0xaf61c

[?] can't find file_offset of VA 0xaf6e8

[?] can't find file_offset of VA 0xaf798

[?] can't find file_offset of VA 0xafa44

[?] can't find file_offset of VA 0xafdfc

[?] can't find file_offset of VA 0xb0150

[?] can't find file_offset of VA 0xb0440

[?] can't find file_offset of VA 0xb078c

[?] can't find file_offset of VA 0xb079c

[?] can't find file_offset of VA 0xb0f90

[?] can't find file_offset of VA 0xb0fa4

[?] can't find file_offset of VA 0xb0fb8

[?] can't find file_offset of VA 0xb0fcc

[?] can't find file_offset of VA 0xb0fe0

[?] can't find file_offset of VA 0xb0ff4

[?] can't find file_offset of VA 0xb1008

dkfe8.exe- MSRSAAP.EXE - Remote Service Application- WIN.Trojan.DarkKomet-350