filenamebdf71c6dee19cfdba956bc742a24fb0f6ba490ff0b5be3e6fc17270b75729058
size888832 (0xd9000)
md53272b63e12c844a52999cca42f001d5e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Malware.Cridex-7639981-0 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
131307297
1255072724
10950727144
11050727111
1473072921
10499
114507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4409abb6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x5e000
SizeOfInitializedData0x7a000
SizeOfUninitializedData0
AddressOfEntryPoint0xaf80
BaseOfCode0x1000
BaseOfData0x5f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xef000
SizeOfHeaders0x1000
CheckSum0xe7f8e
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Armadillo v6.0 (Silicon Realms Toolworks)

Sections

namevavsizeraw sizeflags
.text0x10000x5dcac0x5e000R-X CODE
.rdata0x5f0000x647ca0x65000R-- IDATA
.data0xc40000x203780xb000RW- IDATA
.rsrc0xe50000x906c0xa000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xc222c0xa0
RESOURCE0xe50000x906c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x5f4900x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x5f0000x3fc
Delay_IAT0xc21940x40
CLR_Header00
typenamesizecp
ICON#1169361252
ICON#296401252
ICON#342641252
ICON#424401252
ICON#511281252
DIALOG#261361252
DIALOG#291441252
STRING#12941252
STRING#2801252
GROUP_ICONNATURE201252
GROUP_ICON#100621252
VERSION#19361252
MANIFEST#1861252
idlangstring
31033Newnear
41033baby
51033Large joy train
61033nation
71033showchair
81033push gas
91033system wear Vary
101033Need test wide round
111033ring
121033Nor you tie even
131033offer
141033reply only
151033what effect
161033Write thenstone opposite
module_namehintordfunction_name
KERNEL32.dll771GlobalFlags
KERNEL32.dll545GetModuleHandleA
KERNEL32.dll837InterlockedExchange
KERNEL32.dll1322WriteFile
KERNEL32.dll1147SetFilePointer
KERNEL32.dll371FlushFileBuffers
KERNEL32.dll501GetCurrentProcess
KERNEL32.dll437GetCommandLineA
KERNEL32.dll803HeapFree
KERNEL32.dll813HeapAlloc
KERNEL32.dll665GetProcessHeap
KERNEL32.dll620GetStartupInfoA
KERNEL32.dll976RaiseException
KERNEL32.dll1130RtlUnwind
KERNEL32.dll789HeapReAlloc
KERNEL32.dll730HeapSize
KERNEL32.dll316ExitProcess
KERNEL32.dll1295TerminateProcess
KERNEL32.dll1332UnhandledExceptionFilter
KERNEL32.dll1197SetUnhandledExceptionFilter
KERNEL32.dll860IsDebuggerPresent
KERNEL32.dll377GetCPInfo
KERNEL32.dll419GetACP
KERNEL32.dll632GetOEMCP
KERNEL32.dll851LCMapStringA
KERNEL32.dll853LCMapStringW
KERNEL32.dll709GetStdHandle
KERNEL32.dll623GetModuleFileNameA
KERNEL32.dll406FreeEnvironmentStringsA
KERNEL32.dll531GetEnvironmentStrings
KERNEL32.dll385FreeEnvironmentStringsW
KERNEL32.dll478GetEnvironmentStringsW
KERNEL32.dll1232SetHandleCount
KERNEL32.dll584GetFileType
KERNEL32.dll721HeapDestroy
KERNEL32.dll732HeapCreate
KERNEL32.dll1261VirtualFree
KERNEL32.dll998QueryPerformanceCounter
KERNEL32.dll754GetTickCount
KERNEL32.dll684GetSystemTimeAsFileTime
KERNEL32.dll1329VirtualAlloc
KERNEL32.dll679GetStringTypeA
KERNEL32.dll710GetStringTypeW
KERNEL32.dll534GetLocaleInfoA
KERNEL32.dll475GetConsoleCP
KERNEL32.dll485GetConsoleMode
KERNEL32.dll1189SetStdHandle
KERNEL32.dll1370WriteConsoleA
KERNEL32.dll484GetConsoleOutputCP
KERNEL32.dll1350WriteConsoleW
KERNEL32.dll197CreateFileA
KERNEL32.dll721GetThreadLocale
KERNEL32.dll701GlobalAddAtomW
KERNEL32.dll739GlobalFindAtomW
KERNEL32.dll730GlobalDeleteAtom
KERNEL32.dll857LoadLibraryW
KERNEL32.dll887LoadLibraryA
KERNEL32.dll1354lstrcmpW
KERNEL32.dll700GetVersionExA
KERNEL32.dll689GetVersion
KERNEL32.dll829InterlockedIncrement
KERNEL32.dll934MultiByteToWideChar
KERNEL32.dll103CloseHandle
KERNEL32.dll407FormatMessageW
KERNEL32.dll378FreeLibrary
KERNEL32.dll782InterlockedDecrement
KERNEL32.dll549GetModuleHandleW
KERNEL32.dll626GetProcAddress
KERNEL32.dll1313TlsFree
KERNEL32.dll763GlobalFree
KERNEL32.dll267DeleteCriticalSection
KERNEL32.dll873LocalReAlloc
KERNEL32.dll1246TlsSetValue
KERNEL32.dll1309TlsAlloc
KERNEL32.dll837InitializeCriticalSection
KERNEL32.dll760GlobalAlloc
KERNEL32.dll725GlobalHandle
KERNEL32.dll719GlobalUnlock
KERNEL32.dll719GlobalReAlloc
KERNEL32.dll709GlobalLock
KERNEL32.dll318EnterCriticalSection
KERNEL32.dll1283TlsGetValue
KERNEL32.dll832LeaveCriticalSection
KERNEL32.dll846LocalFree
KERNEL32.dll871LocalAlloc
KERNEL32.dll1429lstrlenW
KERNEL32.dll1330WideCharToMultiByte
KERNEL32.dll534GetCurrentProcessId
KERNEL32.dll563GetModuleFileNameW
KERNEL32.dll408FindResourceW
KERNEL32.dll912LoadResource
KERNEL32.dll941LockResource
KERNEL32.dll1263SizeofResource
KERNEL32.dll562GetLastError
KERNEL32.dll1220SetLastError
KERNEL32.dll221CreateProcessW
KERNEL32.dll1249Sleep
KERNEL32.dll656GetTempPathW
KERNEL32.dll1029RemoveDirectoryW
KERNEL32.dll702GetSystemInfo
KERNEL32.dll1337VirtualProtect
KERNEL32.dll308FindFirstChangeNotificationW
KERNEL32.dll510GetCurrentThreadId
KERNEL32.dll749GetWindowsDirectoryW
GDI32.dll247DeleteDC
GDI32.dll284EndPage
GDI32.dll65CreateFontIndirectW
GDI32.dll680Rectangle
GDI32.dll407ExtTextOutW
GDI32.dll787StartDocW
GDI32.dll684RestoreDC
GDI32.dll535GetStockObject
GDI32.dll645ScaleWindowExtEx
GDI32.dll764SetWindowExtEx
GDI32.dll713ScaleViewportExtEx
GDI32.dll768SetViewportExtEx
GDI32.dll658OffsetViewportOrgEx
GDI32.dll738SetViewportOrgEx
GDI32.dll687SelectObject
GDI32.dll339Escape
GDI32.dll795TextOutW
GDI32.dll646RectVisible
GDI32.dll685PtVisible
GDI32.dll725SetMapMode
GDI32.dll702SaveDC
GDI32.dll254DeleteObject
GDI32.dll645SetBkColor
GDI32.dll711SetTextColor
GDI32.dll522GetClipBox
GDI32.dll54CreateBitmap
GDI32.dll551GetDeviceCaps
USER32.dll528IsIconic
USER32.dll749SystemParametersInfoA
USER32.dll760SetWindowPos
USER32.dll807SetWindowLongW
USER32.dll87CallWindowProcW
USER32.dll220DefWindowProcW
USER32.dll346GetDlgCtrlID
USER32.dll619PtInRect
USER32.dll107CopyRect
USER32.dll37AdjustWindowRectEx
USER32.dll674RegisterClassW
USER32.dll301GetClassInfoW
USER32.dll345GetClassInfoExW
USER32.dll195CreateWindowExW
USER32.dll637PostMessageW
USER32.dll427GetMenu
USER32.dll336GetClientRect
USER32.dll698SetForegroundWindow
USER32.dll599MapWindowPoints
USER32.dll357GetMessageTime
USER32.dll170DestroyWindow
USER32.dll406GetTopWindow
USER32.dll353GetDlgItem
USER32.dll305GetForegroundWindow
USER32.dll548IsWindow
USER32.dll680RemovePropW
USER32.dll367GetPropW
USER32.dll576LoadCursorW
USER32.dll334GetClassLongW
USER32.dll294GetCapture
USER32.dll506GetWindowPlacement
USER32.dll854WinHelpW
USER32.dll538LoadIconW
USER32.dll702RegisterWindowMessageW
USER32.dll798SetWindowTextW
USER32.dll149ClientToScreen
USER32.dll216DestroyMenu
USER32.dll820TabbedTextOutW
USER32.dll307DrawTextW
USER32.dll219DrawTextExW
USER32.dll507GrayStringW
USER32.dll627PostQuitMessage
USER32.dll805UnregisterClassA
USER32.dll419GetSystemMetrics
USER32.dll650ReleaseDC
USER32.dll388GetSysColor
USER32.dll445GetSysColorBrush
USER32.dll476GetWindowRect
USER32.dll448GetWindow
USER32.dll722SetMenuItemBitmaps
USER32.dll731SetWindowsHookExW
USER32.dll576LoadImageW
USER32.dll512IsWindowEnabled
USER32.dll260DrawIcon
USER32.dll368GetMenuCheckMarkDimensions
USER32.dll533LoadBitmapW
USER32.dll319GetFocus
USER32.dll556ModifyMenuW
USER32.dll218EnableMenuItem
USER32.dll121CallNextHookEx
USER32.dll354GetKeyState
USER32.dll617PeekMessageW
USER32.dll315FindWindowW
USER32.dll408GetMenuState
USER32.dll375GetMenuItemID
USER32.dll359GetMenuItemCount
USER32.dll460GetSubMenu
USER32.dll851UnhookWindowsHookEx
USER32.dll431GetWindowThreadProcessId
USER32.dll704SendMessageW
USER32.dll371GetParent
USER32.dll439GetWindowLongW
USER32.dll328GetLastActivePopup
USER32.dll276EnableWindow
USER32.dll541MessageBoxW
USER32.dll296GetDC
USER32.dll313GetAsyncKeyState
USER32.dll103CheckMenuRadioItem
USER32.dll220DispatchMessageW
USER32.dll414GetMessagePos
USER32.dll123CheckMenuItem
USER32.dll817UpdateWindow
USER32.dll263EnumChildWindows
USER32.dll329GetClassNameW
USER32.dll698SetPropW
USER32.dll438GetWindowTextW
USER32.dll827ValidateRect
COMDLG32.dll67GetFileTitleW
COMDLG32.dll102GetSaveFileNameW
COMDLG32.dll32GetOpenFileNameW
COMDLG32.dll66ReplaceTextW
OLEAUT32.dll8
OLEAUT32.dll12
OLEAUT32.dll9
ADVAPI32.dll735RegSetValueExW
ADVAPI32.dll640RegCloseKey
ADVAPI32.dll648RegisterServiceCtrlHandlerW
ADVAPI32.dll692RegOpenKeyExW
ADVAPI32.dll386FreeSid
ADVAPI32.dll707SetEntriesInAclW
ADVAPI32.dll747SetServiceStatus
ADVAPI32.dll60AllocateAndInitializeSid
ADVAPI32.dll641QueryServiceStatus
ADVAPI32.dll433LookupPrivilegeValueW
ADVAPI32.dll699SetSecurityDescriptorDacl
ADVAPI32.dll462InitializeSecurityDescriptor
ADVAPI32.dll696RegQueryValueExW
ADVAPI32.dll600RegEnumKeyW
ADVAPI32.dll430GetTokenInformation
ADVAPI32.dll592OpenServiceW
ADVAPI32.dll765StartServiceCtrlDispatcherW
ADVAPI32.dll510OpenSCManagerW
ADVAPI32.dll545OpenThreadToken
ADVAPI32.dll551OpenProcessToken
ADVAPI32.dll147CreateServiceW
OLEACC.dll76CreateStdAccessibleObject
OLEACC.dll85LresultFromObject

StringTable 040904b0

CompanyNameGoldman Sachs Sea Corporation
FileDescriptionGoldman Sachs Sea Differ company
FileVersion6.6.89.51 built by: 3350
InternalNameWinte.exe
LegalCopyright© Goldman Sachs Sea Corporation. All rights reserved.
OriginalFilenameWinte.exe
ProductNameGoldman Sachs Sea ®Goldman Sachs Sea ® 2011
ProductVersion6.6.89.51

VS_FIXEDFILEINFO

FileVersion6.6.89.51
ProductVersion6.6.89.51
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0888832EXE03/04/2006 15:01:10#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK