tmp_0 - taskmgr.exe - Windows Task Manager - Multios.Trojan.CryptocoinMiner-6448864-1

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	tmp_0
size	496128 (0x79200)
md5	3bedb4bafb26d625766efb3edef0663e

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	Multios.Trojan.CryptocoinMiner-6448864-1 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x120

Rich Header

lib id	version	times used
241	40116	10
243	40116	149
242	40116	21
199	41118	6
259	23013	8
261	23013	103
260	23013	27
259	23026	1
203	65501	15
1	0	254
265	23026	71
255	23026	1
151	0	1
258	23026	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x5ab39dee
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x58000
SizeOfInitializedData	0x22600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1e2a4
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x7f000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x57f6a	0x58000	R-X CODE
.rdata	0x59000	0x19440	0x19600	R-- IDATA
.data	0x73000	0x3ae8	0x1800	RW- IDATA
.pdata	0x77000	0x41c4	0x4200	R-- IDATA
.tls	0x7c000	9	0x200	RW- IDATA
.rsrc	0x7d000	0x5ad	0x600	R-- IDATA
.reloc	0x7e000	0x984	0xa00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x710ec	0x64
RESOURCE	0x7d000	0x40a8
EXCEPTION	0x77000	0x41c4
SECURITY	0	0
BASERELOC	0x82000	0x984
DEBUG	0x6aaa0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x6ab58	0x28
LOAD_CONFIG	0x6aac0	0x94
Bound_IAT	0	0
IAT	0x59000	0x5d0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x14007c000	0x14007c008	0x1400752b8	0x140059698	0	0x300000

show previews

type	name	size	cp
VERSION	#1	912	0
MANIFEST	#1	381	0

module_name	hint	ord	function_name
WS2_32.dll		112
WS2_32.dll		115
WS2_32.dll		18
WS2_32.dll	74		WSARecvFrom
WS2_32.dll		2
WS2_32.dll	58		WSAIoctl
WS2_32.dll	77		WSASend
WS2_32.dll		22
WS2_32.dll	87		WSASocketW
WS2_32.dll		23
WS2_32.dll	72		WSARecv
WS2_32.dll		10
WS2_32.dll	2		FreeAddrInfoW
WS2_32.dll	7		GetAddrInfoW
WS2_32.dll		3
WS2_32.dll		7
WS2_32.dll		21
WS2_32.dll		111
WS2_32.dll		9
KERNEL32.dll	833		HeapSize
KERNEL32.dll	716		GetStringTypeW
KERNEL32.dll	768		GetTimeZoneInformation
KERNEL32.dll	147		CompareStringW
KERNEL32.dll	831		HeapReAlloc
KERNEL32.dll	681		GetProcessHeap
KERNEL32.dll	426		GetACP
KERNEL32.dll	616		GetModuleFileNameA
KERNEL32.dll	711		GetStdHandle
KERNEL32.dll	1250		SetConsoleMode
KERNEL32.dll	500		GetConsoleMode
KERNEL32.dll	127		CloseHandle
KERNEL32.dll	417		FreeConsole
KERNEL32.dll	511		GetConsoleWindow
KERNEL32.dll	1337		SetThreadAffinityMask
KERNEL32.dll	527		GetCurrentProcess
KERNEL32.dll	1316		SetProcessAffinityMask
KERNEL32.dll	531		GetCurrentThread
KERNEL32.dll	1454		VirtualFree
KERNEL32.dll	1451		VirtualAlloc
KERNEL32.dll	945		LocalAlloc
KERNEL32.dll	598		GetLastError
KERNEL32.dll	949		LocalFree
KERNEL32.dll	1315		SetPriorityClass
KERNEL32.dll	1347		SetThreadPriority
KERNEL32.dll	676		GetProcAddress
KERNEL32.dll	621		GetModuleHandleW
KERNEL32.dll	1413		TlsSetValue
KERNEL32.dll	297		EnterCriticalSection
KERNEL32.dll	1172		ReleaseSemaphore
KERNEL32.dll	1465		WaitForMultipleObjects
KERNEL32.dll	933		LeaveCriticalSection
KERNEL32.dll	848		InitializeCriticalSection
KERNEL32.dll	1467		WaitForSingleObject
KERNEL32.dll	1196		ResumeThread
KERNEL32.dll	1279		SetEvent
KERNEL32.dll	1410		TlsAlloc
KERNEL32.dll	1190		ResetEvent
KERNEL32.dll	262		DeleteCriticalSection
KERNEL32.dll	225		CreateSemaphoreW
KERNEL32.dll	1412		TlsGetValue
KERNEL32.dll	1411		TlsFree
KERNEL32.dll	222		CreateSemaphoreA
KERNEL32.dll	179		CreateEventA
KERNEL32.dll	617		GetModuleFileNameW
KERNEL32.dll	980		MultiByteToWideChar
KERNEL32.dll	1073		QueryPerformanceFrequency
KERNEL32.dll	727		GetSystemInfo
KERNEL32.dll	885		IsValidCodePage
KERNEL32.dll	1501		WideCharToMultiByte
KERNEL32.dll	1072		QueryPerformanceCounter
KERNEL32.dll	1234		SetConsoleCtrlHandler
KERNEL32.dll	1031		PostQueuedCompletionStatus
KERNEL32.dll	1377		Sleep
KERNEL32.dll	1278		SetErrorMode
KERNEL32.dll	703		GetQueuedCompletionStatus
KERNEL32.dll	199		CreateIoCompletionPort
KERNEL32.dll	506		GetConsoleScreenBufferInfo
KERNEL32.dll	1259		SetConsoleTextAttribute
KERNEL32.dll	1161		RegisterWaitForSingleObject
KERNEL32.dll	1435		UnregisterWait
KERNEL32.dll	488		GetConsoleCursorInfo
KERNEL32.dll	291		DuplicateHandle
KERNEL32.dll	1083		QueueUserWorkItem
KERNEL32.dll	1236		SetConsoleCursorInfo
KERNEL32.dll	358		FillConsoleOutputCharacterW
KERNEL32.dll	1100		ReadConsoleInputW
KERNEL32.dll	186		CreateFileA
KERNEL32.dll	1106		ReadConsoleW
KERNEL32.dll	1514		WriteConsoleInputW
KERNEL32.dll	356		FillConsoleOutputAttribute
KERNEL32.dll	1520		WriteConsoleW
KERNEL32.dll	651		GetNumberOfConsoleInputEvents
KERNEL32.dll	1238		SetConsoleCursorPosition
KERNEL32.dll	581		GetFileType
KERNEL32.dll	178		CreateDirectoryW
KERNEL32.dll	1108		ReadFile
KERNEL32.dll	1305		SetLastError
KERNEL32.dll	1521		WriteFile
KERNEL32.dll	278		DeviceIoControl
KERNEL32.dll	1177		RemoveDirectoryW
KERNEL32.dll	1295		SetFileTime
KERNEL32.dll	198		CreateHardLinkW
KERNEL32.dll	194		CreateFileW
KERNEL32.dll	572		GetFileAttributesW
KERNEL32.dll	574		GetFileInformationByHandle
KERNEL32.dll	1292		SetFilePointerEx
KERNEL32.dll	973		MoveFileExW
KERNEL32.dll	106		CancelIo
KERNEL32.dll	1302		SetHandleInformation
KERNEL32.dll	618		GetModuleHandleA
KERNEL32.dll	936		LoadLibraryA
KERNEL32.dll	415		FormatMessageA
KERNEL32.dll	1314		SetNamedPipeHandleState
KERNEL32.dll	211		CreateNamedPipeW
KERNEL32.dll	1030		PeekNamedPipe
KERNEL32.dll	629		GetNamedPipeHandleStateA
KERNEL32.dll	1387		SwitchToThread
KERNEL32.dll	148		ConnectNamedPipe
KERNEL32.dll	611		GetLongPathNameW
KERNEL32.dll	1107		ReadDirectoryChangesW
KERNEL32.dll	1392		TerminateProcess
KERNEL32.dll	1436		UnregisterWaitEx
KERNEL32.dll	921		LCMapStringW
KERNEL32.dll	563		GetExitCodeProcess
KERNEL32.dll	709		GetStartupInfoW
KERNEL32.dll	343		ExitProcess
KERNEL32.dll	828		HeapFree
KERNEL32.dll	824		HeapAlloc
KERNEL32.dll	653		GetOEMCP
KERNEL32.dll	441		GetCPInfo
KERNEL32.dll	558		GetEnvironmentStringsW
KERNEL32.dll	419		FreeEnvironmentStringsW
KERNEL32.dll	1276		SetEnvironmentVariableA
KERNEL32.dll	366		FindClose
KERNEL32.dll	371		FindFirstFileExA
KERNEL32.dll	387		FindNextFileA
KERNEL32.dll	255		DecodePointer
KERNEL32.dll	528		GetCurrentProcessId
KERNEL32.dll	408		FlushFileBuffers
KERNEL32.dll	1468		WaitForSingleObjectEx
KERNEL32.dll	532		GetCurrentThreadId
KERNEL32.dll	849		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	182		CreateEventW
KERNEL32.dll	733		GetSystemTimeAsFileTime
KERNEL32.dll	1198		RtlCaptureContext
KERNEL32.dll	1205		RtlLookupFunctionEntry
KERNEL32.dll	1212		RtlVirtualUnwind
KERNEL32.dll	1426		UnhandledExceptionFilter
KERNEL32.dll	1362		SetUnhandledExceptionFilter
KERNEL32.dll	880		IsProcessorFeaturePresent
KERNEL32.dll	874		IsDebuggerPresent
KERNEL32.dll	852		InitializeSListHead
KERNEL32.dll	231		CreateThread
KERNEL32.dll	293		EncodePointer
KERNEL32.dll	759		GetThreadTimes
KERNEL32.dll	420		FreeLibrary
KERNEL32.dll	421		FreeLibraryAndExitThread
KERNEL32.dll	938		LoadLibraryExW
KERNEL32.dll	1207		RtlPcToFileHeader
KERNEL32.dll	1092		RaiseException
KERNEL32.dll	1211		RtlUnwindEx
KERNEL32.dll	462		GetCommandLineA
KERNEL32.dll	463		GetCommandLineW
KERNEL32.dll	344		ExitThread
KERNEL32.dll	620		GetModuleHandleExW
KERNEL32.dll	1328		SetStdHandle
KERNEL32.dll	482		GetConsoleCP
KERNEL32.dll	569		GetFileAttributesExW
KERNEL32.dll	1286		SetFileAttributesW
USER32.dll	808		ShowWindow
USER32.dll	580		MapVirtualKeyW
ADVAPI32.dll	209		CryptGenRandom
ADVAPI32.dll	219		CryptReleaseContext
ADVAPI32.dll	794		SystemFunction036
ADVAPI32.dll	429		LookupPrivilegeValueW
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	530		OpenProcessToken
ADVAPI32.dll	469		LsaOpenPolicy
ADVAPI32.dll	432		LsaAddAccountRights
ADVAPI32.dll	435		LsaClose
ADVAPI32.dll	367		GetTokenInformation
ADVAPI32.dll	192		CryptAcquireContextA

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Task Manager
FileVersion	6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName	taskmgr
LegalCopyright	? Microsoft Corporation. All rights reserved.
OriginalFilename	taskmgr.exe
ProductName	Microsoft? Windows? Operating System
ProductVersion	6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion	6.1.7601.17514
ProductVersion	6.1.7601.17514
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
78608	3064	EXE	04/09/2018 02:20:47	#

Scanning the drive for archives:
1 file, 496128 bytes (485 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x752b8

[?] can't find file_offset of VA 0x82000

tmp_0- -

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

TLS

StringTable 040904B0

VS_FIXEDFILEINFO

tmp_0
-
-