filenameRECENT WIRE TRANSFER 1057.scr
size228598 (0x37cf6)
md54a9790625d918e6600374ee103a02ada
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
125507271
109507275
123507272
110507273
93403523
10106
001
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x552e5e21
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion8.0
SizeOfCode0xf000
SizeOfInitializedData0x2c000
SizeOfUninitializedData0
AddressOfEntryPoint0x1078
BaseOfCode0x1000
BaseOfData0x10000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x3c000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xe7330xf000R-X
.data0x100000x193b80x15000RW- IDATA
.idata0x2a0000x13260x2000RW- IDATA
.didat0x2c0000x2c00x1000RW- IDATA
.rsrc0x2d0000xe0f00xf000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x2a0000x105
RESOURCE0x2d0000xe0f0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x2a4fc0x3f8
Delay_IAT0x2c0000x40
CLR_Header00
typenamesizecp
ICON#50216400
ICON#51169360
ICON#5296400
ICON#5342640
ICON#5424400
ICON#5511280
GROUP_ICONICO900
VERSION#19640
module_namehintordfunction_name
ESENT.dll110JetRestore2
OLEAUT32.dll72
urlmon.dll46HlinkGoBack
urlmon.dll73URLDownloadToFileA
urlmon.dll39FindMediaTypeClass
USER32.dll355GetThreadDesktop
USER32.dll180DrawEdge
USER32.dll405InvalidateRect
USER32.dll453LoadMenuA
USER32.dll198EnableWindow
USER32.dll727WindowFromPoint
USER32.dll621SetPropW
CLUSAPI.dll24ClusterNetworkEnum
ntdll.dll1271sin
ntdll.dll1302wcscpy
ntdll.dll1304wcslen
ntdll.dll1260isxdigit
ntdll.dll1245isalpha
pdh.dll122PdhRemoveCounter
SHELL32.dll43ExtractIconA
SHELL32.dll162SHFreeNameMappings
KERNEL32.dll838TerminateProcess
KERNEL32.dll577LoadLibraryA
KERNEL32.dll360GetLastError
KERNEL32.dll538InterlockedExchange
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll407GetProcAddress
KERNEL32.dll587LocalFree
KERNEL32.dll583LocalAlloc
KERNEL32.dll849TransmitCommChar
KERNEL32.dll238FreeEnvironmentStringsA
KERNEL32.dll416GetProcessTimes
KERNEL32.dll855UnhandledExceptionFilter
KERNEL32.dll240FreeLibrary
KERNEL32.dll313GetCurrentDirectoryA
KERNEL32.dll170EnumSystemLanguageGroupsA
KERNEL32.dll897WriteConsoleInputA
KERNEL32.dll206FindFirstChangeNotificationA
KERNEL32.dll405GetPrivateProfileStructA
KERNEL32.dll151EnumCalendarInfoA
KERNEL32.dll494GlobalFindAtomW
KERNEL32.dll221FindNextVolumeMountPointW
KERNEL32.dll826SetupComm
KERNEL32.dll735SetConsoleCursorPosition
KERNEL32.dll611MulDiv
KERNEL32.dll536ExitThread
KERNEL32.dll133DeleteTimerQueueTimer
KERNEL32.dll352GetFirmwareEnvironmentVariableW
KERNEL32.dll757SetConsoleWindowInfo
KERNEL32.dll793SetMailslotInfo
KERNEL32.dll175EnumTimeFormatsW
KERNEL32.dll124DefineDosDeviceW
KERNEL32.dll502GlobalMemoryStatus
KERNEL32.dll551IsBadWritePtr
KERNEL32.dll61ConvertFiberToThread
KERNEL32.dll724SetComputerNameA
KERNEL32.dll355GetGeoInfoA
KERNEL32.dll728SetConsoleActiveScreenBuffer
KERNEL32.dll32BuildCommDCBA
KERNEL32.dll464GetThreadTimes
KERNEL32.dll913WritePrivateProfileStringW
KERNEL32.dll896WriteConsoleA
KERNEL32.dll246GetACP
KERNEL32.dll350GetFileType
KERNEL32.dll242FreeResource
KERNEL32.dll668ReadConsoleOutputA
KERNEL32.dll772SetFileAttributesA
KERNEL32.dll539InterlockedExchangeAdd
KERNEL32.dll97CreatePipe
KERNEL32.dll770SetFileApisToANSI
KERNEL32.dll163EnumResourceNamesA
KERNEL32.dll322GetDefaultCommConfigW
KERNEL32.dll594LockFile
KERNEL32.dll862UpdateResourceA
KERNEL32.dll114CreateWaitableTimerW
KERNEL32.dll300GetConsoleMode
KERNEL32.dll250GetBinaryTypeA
KERNEL32.dll433GetStringTypeExW
KERNEL32.dll768SetErrorMode
KERNEL32.dll667ReadConsoleInputW
KERNEL32.dll49CloseHandle
KERNEL32.dll620OpenEventW
KERNEL32.dll944lstrcpynA
KERNEL32.dll172EnumSystemLocalesA
KERNEL32.dll463GetThreadSelectorEntry
KERNEL32.dll34BuildCommDCBAndTimeoutsW
KERNEL32.dll418GetProcessWorkingSetSize
KERNEL32.dll600MapViewOfFileEx
KERNEL32.dll904WriteConsoleOutputCharacterW
KERNEL32.dll662RaiseException
KERNEL32.dll902WriteConsoleOutputAttribute
KERNEL32.dll818SetUnhandledExceptionFilter
SETUPAPI.dll416SetupGetLineTextW
MPRAPI.dll77MprConfigInterfaceTransportAdd
MPRAPI.dll55MprAdminTransportGetInfo
MPRAPI.dll39MprAdminMIBEntrySet
msvcrt.dll345_except_handler3
msvcrt.dll578_lock
msvcrt.dll141__dllonexit
msvcrt.dll747_onexit
msvcrt.dll934_unlock
msvcrt.dll1394wscanf
msvcrt.dll1333tmpfile
msvcrt.dll1381wcstod
msvcrt.dll1294srand

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionBackground Intelligent Transfer Service 2.5 Proxy
FileVersion6.7.2600.5512 (xpsp.080413-2108)
InternalNamebitsprx4.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamebitsprx4.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.7.2600.5512

VS_FIXEDFILEINFO

FileVersion6.7.2600.5512
ProductVersion6.7.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0225280EXE04/15/2015 12:48:33#
15c115HTM#
370003318BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 228598 bytes (224 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK