filenameLab_01-1.malware
size8192 (0x2000)
md54280aac55c1d3c327a6c00f0f0085677
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Small-913 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1272911
10816811
1472991
481682
93217911
1070
1181683
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a0c5109
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x1000
SizeOfInitializedData0xc00
SizeOfUninitializedData0
AddressOfEntryPoint0x1cda
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x5000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000xea60x1000R-X CODE
.rdata0x20000x67e0x800R-- IDATA
.data0x30000x6280x200RW- IDATA
.rsrc0x40000x7c0x200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x215c0x78
RESOURCE0x40000x7c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x20000x10c
Delay_IAT00
CLR_Header00
typenamesizecp
STRING#1361252
idlangstring
1103360.248.52.95:443
module_namehintordfunction_name
KERNEL32.dll46CloseHandle
KERNEL32.dll901WaitForSingleObject
KERNEL32.dll73CreateEventA
KERNEL32.dll176ExitThread
KERNEL32.dll841Sleep
KERNEL32.dll268GetComputerNameA
KERNEL32.dll95CreatePipe
KERNEL32.dll133DisconnectNamedPipe
KERNEL32.dll849TerminateProcess
KERNEL32.dll899WaitForMultipleObjects
KERNEL32.dll850TerminateThread
KERNEL32.dll105CreateThread
KERNEL32.dll96CreateProcessA
KERNEL32.dll140DuplicateHandle
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll683ReadFile
KERNEL32.dll647PeekNamedPipe
KERNEL32.dll779SetEvent
KERNEL32.dll919WriteFile
KERNEL32.dll808SetProcessPriorityBoost
KERNEL32.dll824SetThreadPriority
KERNEL32.dll317GetCurrentThread
KERNEL32.dll806SetPriorityClass
KERNEL32.dll944lstrcatA
KERNEL32.dll953lstrcpyA
KERNEL32.dll336GetEnvironmentVariableA
KERNEL32.dll429GetShortPathNameA
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll375GetModuleHandleA
USER32.dll458LoadStringA
SHELL32.dll265ShellExecuteExA
SHELL32.dll126SHChangeNotify
MSVCRT.dll183_controlfp
MSVCRT.dll165_beginthread
MSVCRT.dll453_strnicmp
MSVCRT.dll690sprintf
MSVCRT.dll574atol
MSVCRT.dll695strchr
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll308_itoa
WS2_32.dll9
WS2_32.dll4
WS2_32.dll23
WS2_32.dll115
WS2_32.dll19
WS2_32.dll11
WS2_32.dll16
WS2_32.dll3
offsetsizetypecomment
08192EXE05/14/2009 17:12:41#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK