filenametestfile.out
size155648 (0x26000)
md54ee4461f5be9de0e44d03c8216d0c3ce
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Ransomware.Jaff-6316620-0 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5913632b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x1a000
SizeOfInitializedData0x1b000
SizeOfUninitializedData0
AddressOfEntryPoint0x1abc4
BaseOfCode0x1000
BaseOfData0x1b000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x36000
SizeOfHeaders0x1000
CheckSum0x2aafa
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x19e460x1a000R-X CODE
.rdata0x1b0000xf180x1000R-- IDATA
.data0x1c0000x176bc0x8000RW- IDATA
.rsrc0x340000x16500x2000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1b57c0xf0
RESOURCE0x340000x1650
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x1b0000x1bc
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#116800
ICON#22640
MENU#96780
MENU#2002280
MENU#8302700
DIALOG#3892940
DIALOG#6081480
DIALOG#8403040
DIALOG#8752580
ACCELERATORS#86480
ACCELERATORS#2201040
GROUP_ICON#324200
GROUP_ICON#845200
VERSION#17000
MANIFEST#13460
module_namehintordfunction_name
GDI32.dll74CreatePatternBrush
GDI32.dll667SetPixel
GDI32.dll607Rectangle
GDI32.dll520GetRandomRgn
GDI32.dll664SetMiterLimit
GDI32.dll632SelectPalette
GDI32.dll618RoundRect
RASAPI32.dll90RasSetCredentialsW
RASAPI32.dll33RasGetAutodialAddressW
NTDLL.dll1886bsearch
NTDLL.dll1223RtlUnicodeToMultiByteN
ODBC32.dll138SQLSetConnectAttrW
ODBC32.dll52SQLDescribeColA
ODBC32.dll54SQLDescribeParam
ODBC32.dll26SQLBrowseConnectA
ODBC32.dll169SQLTransact
ODBC32.dll101SQLGetDiagRecW
ODBC32.dll95SQLGetDescRecW
ODBC32.dll61SQLDriversW
ODBC32.dll114SQLMoreResults
ODBC32.dll124SQLPrepareW
ODBC32.dll62SQLEndTran
ODBC32.dll126SQLPrimaryKeysA
ODBC32.dll159SQLSpecialColumnsW
ODBC32.dll75SQLForeignKeysW
ODBC32.dll36SQLColAttributesA
ODBC32.dll112SQLGetTypeInfoA
ODBC32.dll39SQLColumnPrivilegesA
ODBC32.dll27SQLBrowseConnectW
ODBC32.dll132SQLProceduresA
ODBC32.dll84SQLGetConnectOptionA
ODBC32.dll6DllBidEntryPoint
ODBC32.dll46SQLConnectW
ODBC32.dll162SQLStatisticsW
ODBC32.dll15PostODBCComponentError
ODBC32.dll55SQLDisconnect
ADVAPI32.dll633SetFileSecurityA
ADVAPI32.dll667StartTraceW
MSVCRT.dll1047_wenviron
MSVCRT.dll390_onexit
MSVCRT.dll85__dllonexit
MSVCRT.dll183_controlfp
MSVCRT.dll202_except_handler3
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll143_acmdln
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll342_errno
MSVCRT.dll1320strtok
MSVCRT.dll928_umask
MSVCRT.dll1120_wstrtime
MSVCRT.dll684_mbsncpy
MSVCRT.dll104_HUGE
MSVCRT.dll447_getpid
MSVCRT.dll1263mktime
MSVCRT.dll1118_wstrdate
MSVCRT.dll217__unDName
MSVCRT.dll1015_wcsncoll
MSVCRT.dll937_utime64
MSVCRT.dll211_exit
MSVCRT.dll1050_wexeclp
MSVCRT.dll1145asctime
MSVCRT.dll269_beep
MSVCRT.dll369_findfirst
MSVCRT.dll1100_wsearchenv
MSVCRT.dll370_findfirst64
MSVCRT.dll142__doserrno
MSVCRT.dll99_CxxThrowException
MSVCRT.dll338_endthread
MSVCRT.dll1072_wgetenv
MSVCRT.dll409_futime
OLEAUT32.dll62SafeArrayAllocDescriptorEx
XOLEHLP.dll1DtcGetTransactionManagerC
XOLEHLP.dllDtcGetTransactionManager
XOLEHLP.dll6GetDtcLocaleResourceHandle
OLE32.dll54CoGetObjectContext
USER32.dll700SetUserObjectInformationA
USER32.dll413GetWindowRgn
KERNEL32.dll781LoadLibraryA
KERNEL32.dll1001SetCommTimeouts
KERNEL32.dll1132SizeofResource
KERNEL32.dll1263lstrcmpA
KERNEL32.dll1057SetFileAttributesW
KERNEL32.dll75ClearCommError
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll1273lstrcpynW
KERNEL32.dll551GetProcAddress
KERNEL32.dll1085SetPriorityClass
KERNEL32.dll77CloseHandle
KERNEL32.dll1181VirtualAlloc
KERNEL32.dll1062SetFilePointer
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll1051SetEvent

StringTable 00050006

OriginalFilenameRcfcngzxx
ProductVersion8.955
ProductNameQllvve r
CompanyNameIhtqf s
FileVersion8.955
FileDescriptionFfv opg me liysj sfssezhz
LegalCopyrightCopyright © gla qerjoi
InternalNameRcfcngzxx

VS_FIXEDFILEINFO

FileVersion8.955.0.0
ProductVersion8.955.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0155648EXE05/10/2017 18:59:55#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK