filename3cbf18fee357d5a33aab56795238b097
size700416 (0xab000)
md53cbf18fee357d5a33aab56795238b097
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Zbot-58359 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
9540356
93403523
10482
1255072725
10950727136
11050727114
114507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5385c533
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x4e000
SizeOfInitializedData0x63000
SizeOfUninitializedData0
AddressOfEntryPoint0xb1cb
BaseOfCode0x1000
BaseOfData0x4f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xb2000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x4d1da0x4e000R-X CODE
.rdata0x4f0000x3e1f80x3f000R-- IDATA
.data0x8e0000x228d40x1c000RW- IDATA
.rsrc0xb10000x5680x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x8bdb00x8c
RESOURCE0xb10000x568
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x89b100x40
Bound_IAT00
IAT0x4f0000x3d0
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#17760
MANIFEST#14480
module_namehintordfunction_name
KERNEL32.dll90CreateFileA
KERNEL32.dll550HeapReAlloc
KERNEL32.dll573HeapAlloc
KERNEL32.dll566HeapFree
KERNEL32.dll983VirtualAlloc
KERNEL32.dll361GetCommandLineA
KERNEL32.dll512GetProcessHeap
KERNEL32.dll529GetStartupInfoA
KERNEL32.dll773RaiseException
KERNEL32.dll802RtlUnwind
KERNEL32.dll609HeapSize
KERNEL32.dll258ExitProcess
KERNEL32.dll590HeapDestroy
KERNEL32.dll622HeapCreate
KERNEL32.dll941VirtualFree
KERNEL32.dll889TerminateProcess
KERNEL32.dll920UnhandledExceptionFilter
KERNEL32.dll937SetUnhandledExceptionFilter
KERNEL32.dll497GetStdHandle
KERNEL32.dll287FreeEnvironmentStringsA
KERNEL32.dll410GetEnvironmentStrings
KERNEL32.dll268FreeEnvironmentStringsW
KERNEL32.dll390GetEnvironmentStringsW
KERNEL32.dll817SetHandleCount
KERNEL32.dll425GetFileType
KERNEL32.dll722QueryPerformanceCounter
KERNEL32.dll511GetTickCount
KERNEL32.dll554GetSystemTimeAsFileTime
KERNEL32.dll865Sleep
KERNEL32.dll348GetACP
KERNEL32.dll630IsValidCodePage
KERNEL32.dll368GetConsoleCP
KERNEL32.dll350GetConsoleMode
KERNEL32.dll661LCMapStringA
KERNEL32.dll590LCMapStringW
KERNEL32.dll456GetStringTypeA
KERNEL32.dll477GetStringTypeW
KERNEL32.dll859SetStdHandle
KERNEL32.dll947WriteConsoleA
KERNEL32.dll390GetConsoleOutputCP
KERNEL32.dll1014WriteConsoleW
KERNEL32.dll324GetCurrentProcess
KERNEL32.dll292FlushFileBuffers
KERNEL32.dll854SetFilePointer
KERNEL32.dll970WriteFile
KERNEL32.dll446GetOEMCP
KERNEL32.dll354GetCPInfo
KERNEL32.dll398GetLocaleInfoA
KERNEL32.dll577GlobalAddAtomA
KERNEL32.dll556GlobalFindAtomA
KERNEL32.dll545GlobalDeleteAtom
KERNEL32.dll647LoadLibraryA
KERNEL32.dll1027lstrcmpW
KERNEL32.dll578GetVersionExA
KERNEL32.dll558GetThreadLocale
KERNEL32.dll606GlobalGetAtomNameA
KERNEL32.dll593GlobalFlags
KERNEL32.dll1057lstrcmpA
KERNEL32.dll361GetCurrentThreadId
KERNEL32.dll119CloseHandle
KERNEL32.dll573InterlockedIncrement
KERNEL32.dll274FreeLibrary
KERNEL32.dll554InterlockedDecrement
KERNEL32.dll478GetModuleHandleA
KERNEL32.dll876TlsFree
KERNEL32.dll200DeleteCriticalSection
KERNEL32.dll695LocalReAlloc
KERNEL32.dll899TlsSetValue
KERNEL32.dll910TlsAlloc
KERNEL32.dll645InitializeCriticalSection
KERNEL32.dll595GlobalHandle
KERNEL32.dll535GlobalReAlloc
KERNEL32.dll167EnterCriticalSection
KERNEL32.dll934TlsGetValue
KERNEL32.dll633LeaveCriticalSection
KERNEL32.dll629LocalAlloc
KERNEL32.dll335GetCurrentProcessId
KERNEL32.dll459GetModuleFileNameA
KERNEL32.dll601GlobalFree
KERNEL32.dll509GlobalAlloc
KERNEL32.dll537GlobalLock
KERNEL32.dll603GlobalUnlock
KERNEL32.dll266FormatMessageA
KERNEL32.dll657LocalFree
KERNEL32.dll250FindResourceA
KERNEL32.dll604LoadResource
KERNEL32.dll619LockResource
KERNEL32.dll893SizeofResource
KERNEL32.dll856SetLastError
KERNEL32.dll632InterlockedExchange
KERNEL32.dll640MultiByteToWideChar
KERNEL32.dll936WideCharToMultiByte
KERNEL32.dll534GetSystemDefaultLangID
KERNEL32.dll1013lstrlenA
KERNEL32.dll247FileTimeToSystemTime
KERNEL32.dll93CompareStringA
KERNEL32.dll621LoadLibraryExA
KERNEL32.dll695PrepareTape
KERNEL32.dll119CreateEventA
KERNEL32.dll449GetProcAddress
KERNEL32.dll442GetLastError
KERNEL32.dll610IsDebuggerPresent
KERNEL32.dll571GetVersion
USER32.dll643SetForegroundWindow
USER32.dll336GetClientRect
USER32.dll319GetMenu
USER32.dll594PostMessageA
USER32.dll293GetClassInfoExA
USER32.dll259GetClassInfoA
USER32.dll560RegisterClassA
USER32.dll68AdjustWindowRectEx
USER32.dll156CopyRect
USER32.dll206DefWindowProcA
USER32.dll102CallWindowProcA
USER32.dll724SetWindowLongA
USER32.dll703SystemParametersInfoA
USER32.dll446GetWindowPlacement
USER32.dll695SetMenuItemBitmaps
USER32.dll387GetMenuCheckMarkDimensions
USER32.dll546ModifyMenuA
USER32.dll252EnableMenuItem
USER32.dll84CheckMenuItem
USER32.dll361GetFocus
USER32.dll70ClientToScreen
USER32.dll449GetWindow
USER32.dll346GetDlgCtrlID
USER32.dll402GetWindowRect
USER32.dll551PtInRect
USER32.dll726UnregisterClassA
USER32.dll736SetWindowsHookExA
USER32.dll85CallNextHookEx
USER32.dll223DispatchMessageA
USER32.dll329GetKeyState
USER32.dll545PeekMessageA
USER32.dll757ValidateRect
USER32.dll476LoadCursorA
USER32.dll432GetSystemMetrics
USER32.dll421GetSysColor
USER32.dll755UnhookWindowsHookEx
USER32.dll432GetWindowThreadProcessId
USER32.dll610SendMessageA
USER32.dll345GetParent
USER32.dll417GetWindowLongA
USER32.dll393GetLastActivePopup
USER32.dll528IsWindowEnabled
USER32.dll262EnableWindow
USER32.dll518MessageBoxA
USER32.dll394GetMenuState
USER32.dll329GetMenuItemID
USER32.dll358GetMenuItemCount
USER32.dll429GetSubMenu
USER32.dll683SetDlgItemInt
USER32.dll225EndDialog
USER32.dll669SetWindowPos
USER32.dll433IsDialogMessageA
USER32.dll371GetMessageA
USER32.dll747UpdateWindow
USER32.dll631SendMessageTimeoutA
USER32.dll319GetClassNameA
USER32.dll302GetDlgItemInt
USER32.dll529LoadBitmapA
USER32.dll140CheckDlgButton
USER32.dll636ReleaseCapture
USER32.dll428InsertMenuItemA
USER32.dll271GetAsyncKeyState
USER32.dll769WinHelpA
USER32.dll154CloseClipboard
USER32.dll432GetScrollRange
USER32.dll419GetWindowTextA
USER32.dll478GrayStringA
USER32.dll230DrawTextExA
USER32.dll258DrawTextA
USER32.dll552OffsetRect
USER32.dll378GetIconInfo
USER32.dll719ShowWindow
USER32.dll340GetMessagePos
USER32.dll680SetWindowTextA
USER32.dll311GetDC
USER32.dll272FindWindowA
USER32.dll486LoadIconA
USER32.dll622SetCursor
USER32.dll124CreateWindowExA
USER32.dll259EnumChildWindows
USER32.dll611PostQuitMessage
USER32.dll430GetSysColorBrush
USER32.dll685TabbedTextOutA
USER32.dll165DestroyMenu
USER32.dll635RegisterWindowMessageA
USER32.dll306GetCapture
USER32.dll279GetClassLongA
USER32.dll691SetPropA
USER32.dll353GetPropA
USER32.dll615RemovePropA
USER32.dll474IsWindow
USER32.dll369GetForegroundWindow
USER32.dll301GetDlgItem
USER32.dll444GetTopWindow
USER32.dll214DestroyWindow
USER32.dll414GetMessageTime
USER32.dll512MapWindowPoints
USER32.dll554ReleaseDC
USER32.dll423IsIconic
GDI32.dll292ExtTextOutA
GDI32.dll616SaveDC
GDI32.dll592RestoreDC
GDI32.dll528GetTextExtentPoint32A
GDI32.dll562SetMapMode
GDI32.dll556PtVisible
GDI32.dll503RectVisible
GDI32.dll640TextOutA
GDI32.dll528SelectObject
GDI32.dll616SetViewportOrgEx
GDI32.dll509OffsetViewportOrgEx
GDI32.dll614SetViewportExtEx
GDI32.dll564ScaleViewportExtEx
GDI32.dll650SetWindowExtEx
GDI32.dll591ScaleWindowExtEx
GDI32.dll235DeleteDC
GDI32.dll445GetStockObject
GDI32.dll607SetBkColor
GDI32.dll668SetTextColor
GDI32.dll380GetClipBox
GDI32.dll90CreateBitmap
GDI32.dll168DeleteObject
GDI32.dll241Escape
GDI32.dll600SetPixel
GDI32.dll684StretchBlt
GDI32.dll503PatBlt
GDI32.dll80CreateCompatibleBitmap
GDI32.dll413GetDeviceCaps
WINSPOOL.DRV93ClosePrinter
WINSPOOL.DRV110DocumentPropertiesA
WINSPOOL.DRV126OpenPrinterA
OLEAUT32.dll12
OLEAUT32.dll9
OLEAUT32.dll8
OLEACC.dll75LresultFromObject
OLEACC.dll80CreateStdAccessibleObject

StringTable 040904E4

CompanyNameOmatic Software
FileDescriptionSpeedoil
FileVersion14.6.248.551
InternalNameweboat.exe
LegalTrademarksCopyright (C) 2014 Omatic Software Inc. All rights reserved.
OriginalFilenameweboat.exe
ProductNameSpeedoil Omatic Software se

VS_FIXEDFILEINFO

FileVersion14.6.248.551
ProductVersion14.6.248.551
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0700416EXE05/28/2014 11:14:59#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK