filenamesample01.xex
size67584 (0x10800)
md54a29d41dfda9cfcbcde4d42b4bbb00aa
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-443927 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1081686
1272911
1472992
10804711
480472
19803413
10154
11816813
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x48326559
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.0
SizeOfCode0x9c00
SizeOfInitializedData0x6800
SizeOfUninitializedData0
AddressOfEntryPoint0x13000
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x9ab50x9c00R-X CODE
.rdata0xb0000x4aee0x4c00R-- IDATA
.data0x100000x14480x1400RW- IDATA
.rsrc0x120000x4980x600R-- IDATA
saber0x130000x2000x200RWX CODE

Data Directory

typevasize
EXPORT00
IMPORT0xee780xa0
RESOURCE0x120000x498
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xb0000x280
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#110800
module_namehintordfunction_name
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll180FreeLibrary
KERNEL32.dll318GetProcAddress
KERNEL32.dll450LoadLibraryA
KERNEL32.dll510Process32Next
KERNEL32.dll473Module32First
KERNEL32.dll508Process32First
KERNEL32.dll76CreateToolhelp32Snapshot
KERNEL32.dll670TerminateProcess
KERNEL32.dll495OpenProcess
KERNEL32.dll125ExitProcess
KERNEL32.dll40CopyFileA
KERNEL32.dll87DeleteFileA
KERNEL32.dll74CreateThread
KERNEL32.dll767lstrcmpiA
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll477MoveFileA
KERNEL32.dll274GetFileSize
KERNEL32.dll52CreateFileA
KERNEL32.dll735WriteFile
KERNEL32.dll286GetLogicalDriveStringsA
KERNEL32.dll334GetShortPathNameA
KERNEL32.dll373GetVersionExA
KERNEL32.dll206GetComputerNameA
KERNEL32.dll365GetTickCount
KERNEL32.dll409HeapAlloc
KERNEL32.dll320GetProcessHeap
KERNEL32.dll248GetCurrentProcessId
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll699VirtualAlloc
KERNEL32.dll711VirtualQueryEx
KERNEL32.dll540ReadProcessMemory
KERNEL32.dll359GetThreadContext
KERNEL32.dll643SetThreadContext
KERNEL32.dll745WriteProcessMemory
KERNEL32.dll708VirtualProtectEx
KERNEL32.dll703VirtualFree
KERNEL32.dll250GetCurrentThreadId
KERNEL32.dll265GetEnvironmentVariableA
KERNEL32.dll385GlobalAlloc
KERNEL32.dll451LoadLibraryExA
KERNEL32.dll392GlobalFree
KERNEL32.dll92DeviceIoControl
KERNEL32.dll770lstrcpyA
KERNEL32.dll761lstrcatA
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll631SetPriorityClass
KERNEL32.dll249GetCurrentThread
KERNEL32.dll647SetThreadPriority
KERNEL32.dll556ResumeThread
KERNEL32.dll616SetFileAttributesA
KERNEL32.dll148FindFirstFileA
KERNEL32.dll137FileTimeToLocalFileTime
KERNEL32.dll138FileTimeToSystemTime
KERNEL32.dll282GetLastError
KERNEL32.dll536ReadFile
KERNEL32.dll157FindNextFileA
KERNEL32.dll144FindClose
KERNEL32.dll260GetDriveTypeA
KERNEL32.dll67CreatePipe
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll345GetSystemDirectoryA
KERNEL32.dll68CreateProcessA
KERNEL32.dll27CloseHandle
KERNEL32.dll662Sleep
KERNEL32.dll397GlobalMemoryStatus
USER32.dll684wsprintfA
USER32.dll446MessageBoxA
USER32.dll326GetSystemMetrics
USER32.dll593SetThreadDesktop
USER32.dll468OpenDesktopA
USER32.dll576SetProcessWindowStation
USER32.dll472OpenWindowStationA
USER32.dll330GetThreadDesktop
USER32.dll63CloseWindowStation
USER32.dll61CloseDesktop
USER32.dll312GetProcessWindowStation
USER32.dll255GetDesktopWindow
USER32.dll552SetCursorPos
USER32.dll682keybd_event
USER32.dll211ExitWindowsEx
USER32.dll683mouse_event
GDI32.dll292GetDIBits
GDI32.dll17BitBlt
GDI32.dll455SelectObject
GDI32.dll41CreateCompatibleBitmap
GDI32.dll42CreateCompatibleDC
GDI32.dll43CreateDCA
GDI32.dll80DeleteDC
GDI32.dll83DeleteObject
ADVAPI32.dll23AdjustTokenPrivileges
ADVAPI32.dll120DeleteService
ADVAPI32.dll325OpenSCManagerA
ADVAPI32.dll76CreateServiceA
ADVAPI32.dll327OpenServiceA
ADVAPI32.dll52CloseServiceHandle
ADVAPI32.dll434StartServiceA
ADVAPI32.dll398RegisterServiceCtrlHandlerA
ADVAPI32.dll430SetServiceStatus
ADVAPI32.dll245LookupPrivilegeValueA
ADVAPI32.dll322OpenProcessToken
ADVAPI32.dll435StartServiceCtrlDispatcherA
ADVAPI32.dll53ControlService
SHELL32.dll114ShellExecuteA
SHELL32.dll72SHGetFileInfoA
MSVCRT.dll143_acmdln
MSVCRT.dll673puts
MSVCRT.dll670printf
MSVCRT.dll451_strlwr
MSVCRT.dll183_controlfp
MSVCRT.dll202_except_handler3
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll606free
MSVCRT.dll690sprintf
MSVCRT.dll705strncpy
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll573atoi
MSVCRT.dll699strcspn
MSVCRT.dll709strstr
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll241_ftol
MSVCRT.dll588fclose
MSVCRT.dll600fprintf
MSVCRT.dll599fopen
MSVCRT.dll678rand
MSVCRT.dll664memmove
MSVCRT.dll657malloc
MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
WS2_32.dll115
WS2_32.dll21
WS2_32.dll20
WS2_32.dll8
WS2_32.dll61WSASocketA
WS2_32.dll9
WS2_32.dll23
WS2_32.dll3
WS2_32.dll16
WS2_32.dll22
WS2_32.dll11
WS2_32.dll52
WS2_32.dll19
WS2_32.dll4

StringTable 080404b0

Comments
CompanyNameMicrosoft Corporation
FileDescriptionGeneric Host Process for Win32 Services
FileVersion5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalNamesvchost.exe
LegalCopyright? Microsoft Corporation. All rights reserved.
LegalTrademarks
OriginalFilenamesvchost.exe
PrivateBuild
ProductNameMicrosoft? Windows? Operating System
ProductVersion5.1.2600.2180
SpecialBuild

VS_FIXEDFILEINFO

FileVersion5.1.2600.2180
ProductVersion5.1.2600.2180
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
067584EXE05/20/2008 05:44:57#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK