n - Trojan.Zeroaccess-458

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	n
size	27136 (0x6a00)
md5	46d5bcfc944bd4bbc79ad6576d41c349

type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	Trojan.Zeroaccess-458 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
123	40310	11
1	0	97
149	21022	1
138	21022	12
146	21022	1
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x4fef54da
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x4400
SizeOfInitializedData	0x3e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1cfc
BaseOfCode	0x1000
ImageBase	0x33345670000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0xc000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x423a	0x4400	R-X CODE
.rdata	0x6000	0x18bf	0x1a00	R-- IDATA
.data	0x8000	0x1c71	0x200	RW- IDATA
.pdata	0xa000	0x30c	0x400	R-- IDATA
.reloc	0xb000	0xc4	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x7870	0x4f
IMPORT	0x6e28	0x78
RESOURCE	0	0
EXCEPTION	0xa000	0x30c
SECURITY	0	0
BASERELOC	0xb000	0x68
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x6000	0x328
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
ntdll.dll	1329		memset
ntdll.dll	1201		ZwSetLowEventPair
ntdll.dll	1242		ZwWaitHighEventPair
ntdll.dll	1189		ZwSetHighWaitLowEventPair
ntdll.dll	991		ZwCreateEventPair
ntdll.dll	1363		wcscpy
ntdll.dll	83		LdrFindEntryForAddress
ntdll.dll	990		ZwCreateEvent
ntdll.dll	1119		ZwQueryInformationToken
ntdll.dll	1085		ZwOpenProcessToken
ntdll.dll	596		RtlExpandEnvironmentStrings_U
ntdll.dll	627		RtlFreeUnicodeString
ntdll.dll	1142		ZwQueryValueKey
ntdll.dll	1080		ZwOpenKey
ntdll.dll	617		RtlFormatCurrentUserKeyPath
ntdll.dll	669		RtlImageNtHeader
ntdll.dll	1144		ZwQueryVolumeInformationFile
ntdll.dll	1075		ZwOpenEvent
ntdll.dll	1244		ZwWriteFile
ntdll.dll	980		ZwClose
ntdll.dll	1148		ZwReadFile
ntdll.dll	681		RtlInitUnicodeString
ntdll.dll	1077		ZwOpenFile
ntdll.dll	1360		wcscat
ntdll.dll	1370		wcsrchr
ntdll.dll	91		LdrGetProcedureAddress
ntdll.dll	1351		swprintf
ntdll.dll	1365		wcslen
ntdll.dll	595		RtlExitUserThread
ntdll.dll	100		LdrProcessRelocationBlock
ntdll.dll	668		RtlImageDirectoryEntryToData
ntdll.dll	767		RtlNtStatusToDosError
ntdll.dll	1006		ZwCreateSection
ntdll.dll	1068		ZwMapViewOfSection
ntdll.dll	485		RtlComputeCrc32
ntdll.dll	446		RtlAddressInSectionTable
ntdll.dll	1191		ZwSetInformationFile
ntdll.dll	1185		ZwSetEaFile
ntdll.dll	992		ZwCreateFile
ntdll.dll	1019		ZwDeleteFile
ntdll.dll	1375		wcstoul
ntdll.dll	1107		ZwQueryDirectoryFile
ntdll.dll	1110		ZwQueryEaFile
ntdll.dll	1331		qsort
ntdll.dll	878		RtlTimeToSecondsSince1980
ntdll.dll	1327		memcpy
ntdll.dll	1235		ZwUnmapViewOfSection
ntdll.dll	1249		__C_specific_handler
ntdll.dll	1250		__chkstk
KERNEL32.dll	589		LeaveCriticalSection
KERNEL32.dll	460		GetSystemTimeAsFileTime
KERNEL32.dll	371		GetLastError
KERNEL32.dll	36		BindIoCompletionCallback
KERNEL32.dll	600		LocalFree
KERNEL32.dll	596		LocalAlloc
KERNEL32.dll	138		DeleteTimerQueueTimer
KERNEL32.dll	115		CreateTimerQueueTimer
KERNEL32.dll	113		CreateThread
KERNEL32.dll	142		DisableThreadLibraryCalls
KERNEL32.dll	418		GetProcAddress
KERNEL32.dll	132		DeleteCriticalSection
KERNEL32.dll	549		InitializeCriticalSection
KERNEL32.dll	861		SleepEx
KERNEL32.dll	860		Sleep
KERNEL32.dll	251		FreeLibrary
KERNEL32.dll	593		LoadLibraryW
KERNEL32.dll	905		VirtualFree
KERNEL32.dll	155		EnterCriticalSection
KERNEL32.dll	590		LoadLibraryA
KERNEL32.dll	903		VirtualAlloc
ADVAPI32.dll	140		CryptDestroyKey
ADVAPI32.dll	139		CryptDestroyHash
ADVAPI32.dll	171		CryptVerifySignatureW
ADVAPI32.dll	161		CryptSetHashParam
ADVAPI32.dll	136		CryptCreateHash
ADVAPI32.dll	160		CryptReleaseContext
ADVAPI32.dll	404		MD5Init
ADVAPI32.dll	150		CryptGenRandom
ADVAPI32.dll	159		CryptImportKey
ADVAPI32.dll	134		CryptAcquireContextW
ADVAPI32.dll	403		MD5Final
ADVAPI32.dll	405		MD5Update
MSWSOCK.dll			AcceptEx
WS2_32.dll		21
WS2_32.dll	57		WSASend
WS2_32.dll	52		WSARecv
WS2_32.dll	40		WSAIoctl
WS2_32.dll		13
WS2_32.dll	59		WSASendTo
WS2_32.dll		3
WS2_32.dll		111
WS2_32.dll	66		WSASocketW
WS2_32.dll		116
WS2_32.dll		115
WS2_32.dll		2
WS2_32.dll	54		WSARecvFrom

ord	entry_va	function_name
1	0x1730	DllGetClassObject

module_name	p2p.64.dll
flags	0
timestamp	2012-06-30 19:34:50
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x789c
Functions(1)	0x7898
NameOrdinals(1)	0x78a0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	21552	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

n-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

n
-