parent10tenmedia.com_svchost.mal
filename10tenmedia.com_svchost.unpacked.mal
size83968 (0x14800)
md544e92c4b5f440b756f8fb0c9eeb460b2
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Spy.Zbot-440 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x47b17cbc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.4
SizeOfCode0x9000
SizeOfInitializedData0xb400
SizeOfUninitializedData0
AddressOfEntryPoint0x1cfe
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion8.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x2a000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.code0x10000x90000x9000R-X CODE
.data0xa0000xa0000x9400R-- IDATA
.rdata0x140000x20000x1a00R-- IDATA
.rsrc0x160000x140000x600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x143c00x50
RESOURCE0x160000x4e0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#17280
MANIFEST#13600
module_namehintordfunction_name
KERNEL32.DLLLocalFree
KERNEL32.DLLExitProcess
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLInterlockedIncrement
KERNEL32.DLLSetLastError
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLVirtualFree
KERNEL32.DLLWriteFile
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLHeapFree
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLReadFile
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLCreateThread
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLCloseHandle
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLGetCommandLineW
KERNEL32.DLLSetEvent
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLCreateFileW
KERNEL32.DLLCreateFileA
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLLoadLibraryW
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLHeapDestroy
KERNEL32.DLLSetFilePointer
KERNEL32.DLLGetACP
KERNEL32.DLLFormatMessageW
KERNEL32.DLLInterlockedDecrement
KERNEL32.DLLGetTickCount
KERNEL32.DLLTerminateProcess
KERNEL32.DLLlstrcpyW
KERNEL32.DLLHeapAlloc
KERNEL32.DLLSleep
SHELL32.DLLSHGetSpecialFolderPathW
SHELL32.DLLDragAcceptFiles
SHELL32.DLLDragQueryFileW
SHELL32.DLLCommandLineToArgvW
SHELL32.DLLExtractIconExW
SHELL32.DLLSHChangeNotify
SHELL32.DLLSHGetDesktopFolder
SHELL32.DLLExtractIconW
SHELL32.DLLSHGetPathFromIDListW
SHELL32.DLLSHGetFileInfoW
SHELL32.DLLSHGetMalloc
SHELL32.DLLSHGetFolderPathW
SHELL32.DLLShellExecuteExW
SHELL32.DLLShellAboutW
SHELL32.DLLShell_NotifyIconW
SHELL32.DLLSHGetSpecialFolderLocation
SHELL32.DLLDragFinish
USER32.DLLGetDesktopWindow
USER32.DLLLoadMenuW
USER32.DLLMessageBoxA
USER32.DLLSendMessageA
USER32.DLLSetCursor
USER32.DLLGetDlgItem
USER32.DLLMessageBoxW
USER32.DLLwsprintfW
USER32.DLLGetSystemMetrics
USER32.DLLIsDialogMessageW
USER32.DLLDrawTextW
USER32.DLLWinHelpW
USER32.DLLSetForegroundWindow
USER32.DLLDispatchMessageA
USER32.DLLCharNextW
USER32.DLLFindWindowW
USER32.DLLEndPaint
USER32.DLLCallWindowProcW
USER32.DLLRegisterClassExW
USER32.DLLFillRect
USER32.DLLMessageBeep
USER32.DLLEndDialog
USER32.DLLSetTimer
USER32.DLLReleaseCapture
USER32.DLLCloseClipboard
USER32.DLLGetCursorPos
USER32.DLLGetClientRect
USER32.DLLLoadStringA
USER32.DLLSetFocus
USER32.DLLTranslateMessage
USER32.DLLSendDlgItemMessageW
USER32.DLLGetWindowRect
USER32.DLLUpdateWindow
USER32.DLLSetCapture
USER32.DLLGetWindow
USER32.DLLGetParent
USER32.DLLDispatchMessageW
USER32.DLLIsWindowVisible
USER32.DLLDefWindowProcW
USER32.DLLRegisterClassW
USER32.DLLDestroyMenu
USER32.DLLSetWindowLongW
USER32.DLLPeekMessageW
USER32.DLLShowWindow
USER32.DLLGetKeyState
USER32.DLLEnableWindow
USER32.DLLCreateDialogParamW
USER32.DLLPostQuitMessage
USER32.DLLKillTimer
USER32.DLLMapWindowPoints
USER32.DLLGetSysColor
USER32.DLLGetFocus
USER32.DLLLoadIconW

StringTable 040904B0

CompanyNameSOFTWIN S
.hFileDescriptionBitDefender Man
ent Console< FileVersion106.42.73.614 In�
alNameфжзрюкшэщ8LegalCopyright2528-6142<�
inalFilenamenedwp.exe0ProductNameлюзанх@Prod
ersion106.42.73.61DVarFileInfo$Transl�

VS_FIXEDFILEINFO

FileVersion106.42.73.61
ProductVersion106.42.73.61
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
083968EXE02/12/2008 11:02:20#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] invalid VS_VERSIONINFO child type "n\x00\x00\x00\x00\x00"