filename_.exe
size211968 (0x33c00)
md553fe7639ed5444f71939568b30bb7ae4
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-376933 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
4288032
1884446
198078153
1583031916
155303191
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ecadf57
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion10.0
SizeOfCode0x9800
SizeOfInitializedData0x2a000
SizeOfUninitializedData0
AddressOfEntryPoint0x20c0
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x4b000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

dUP 2.x Patcher (www.diablo2oo2.cjb.net)

Sections

namevavsizeraw sizeflags
.text0x10000x963a0x9800RWX CODE
.rdata0xb0000x101b0x1200R-- IDATA
.data0xd0000x14fb80xa00RW- IDATA
.rsrc0x220000x283f80x28400R-- IDATA

Data Directory

typevasize
EXPORT0xbe900x18b
IMPORT0xb2500x8c
RESOURCE0x220000x283f8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#503081252
BITMAPABOUT217201252
BITMAPMAIN467521252
ICON#142641252
DIALOG#16321252
DIALOG#21841252
DIALOG#31601252
STRING#15601252
STRING#28321252
STRING#36841252
STRING#41201252
RCDATA#14001252
RCDATA#251611252
RCDATA#3121252
RCDATA#41281252
RCDATA#54641252
RCDATA#651611252
RCDATA#7121252
RCDATA#832961252
RCDATA#9366711252
RCDATA#10343131252
RCDATA#11481252
RCDATA#124641252
GROUP_CURSOR#2201252
GROUP_ICON#500201252
MANIFEST#19481252
idlangstring
00---START PATCHING---
10---PATCHING DONE---
20[OFFSET PATCH]
30[SEARCH & REPLACE PATCH]
40[REGISTRY PATCH]
50[EXPORT FILE]
60[TEXT PATCH]
70[GET REGISTRY VALUE]
80Inline Patch : Failed
90Inline Patch : OK
100Nothing patched!
110File patched!
120...done!
130Backup File:
140Copy to clipboard
150<-Back to releaseinfo
160Can not find the file. Search the file?
170File is in use -> using rename method
180Can not access the file. Maybe it's in use... Please close the file before patching! Try to access the file again now?
190Loading File:
200Can not open file!
210File Exist Check : OK
220No PE Signature found!
230Inline patch already applied
240unicode text detected
250MD5 Check : OK
260MD5 Check : Failed
270[FILE CHECK]
280ERROR
290OK
300CRC32 Check : OK
310[REGISTRY CHECK]
320Filesize Check : Failed
330Filesize Check : OK
340Filesize Check : skipped
350CRC32 Check : Failed
360CRC32 Check : skipped
370Byte not found! File is already patched!
380Can't find pattern! Trying next one...
410File already exist. Overwrite?
420overwriting existing file
430File Export : Failed
440setting file attributes
450executing file
460deleting file
470File Export : OK
480Signature Check : OK
490Signature Check : Failed
module_namehintordfunction_name
KERNEL32.DLLFindFirstFileA
KERNEL32.DLLGetStdHandle
KERNEL32.DLLWriteFile
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLCompareStringA
KERNEL32.DLLCreateDirectoryA
KERNEL32.DLLGlobalAlloc
KERNEL32.DLLGlobalLock
KERNEL32.DLLGlobalUnlock
KERNEL32.DLLFindClose
KERNEL32.DLLlstrlenW
KERNEL32.DLLlstrlenA
KERNEL32.DLLlstrcpyA
KERNEL32.DLLlstrcmpiA
KERNEL32.DLLlstrcmpA
KERNEL32.DLLlstrcatA
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLVirtualFree
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLCloseHandle
KERNEL32.DLLCopyFileA
KERNEL32.DLLCreateFileA
KERNEL32.DLLCreateFileMappingA
KERNEL32.DLLCreateProcessA
KERNEL32.DLLCreateThread
KERNEL32.DLLDeleteFileA
KERNEL32.DLLExitProcess
KERNEL32.DLLExpandEnvironmentStringsA
KERNEL32.DLLFindResourceA
KERNEL32.DLLFreeLibrary
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLGetCurrentDirectoryA
KERNEL32.DLLGetExitCodeProcess
KERNEL32.DLLGetFileAttributesA
KERNEL32.DLLGetFileSize
KERNEL32.DLLGetFileTime
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLGetTempPathA
KERNEL32.DLLGetVersionExA
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLLoadResource
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLMoveFileA
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLRtlMoveMemory
KERNEL32.DLLRtlZeroMemory
KERNEL32.DLLSetCurrentDirectoryA
KERNEL32.DLLSetEndOfFile
KERNEL32.DLLSetEnvironmentVariableA
KERNEL32.DLLSetFileAttributesA
KERNEL32.DLLSetFilePointer
KERNEL32.DLLSetFileTime
KERNEL32.DLLSizeofResource
KERNEL32.DLLSleep
advapi32.dllRegSetValueExA
advapi32.dllRegDeleteValueA
advapi32.dllRegCreateKeyExA
advapi32.dllRegOpenKeyExA
advapi32.dllRegQueryValueExA
advapi32.dllRegCloseKey
comdlg32.dllGetOpenFileNameA
comdlg32.dllGetSaveFileNameA
gdi32.dllBitBlt
gdi32.dllCreateCompatibleBitmap
gdi32.dllCreateCompatibleDC
gdi32.dllCreateDIBSection
gdi32.dllCreateFontIndirectA
gdi32.dllCreateSolidBrush
gdi32.dllExtCreateRegion
gdi32.dllGetStockObject
gdi32.dllGetTextExtentPointA
gdi32.dllAddFontResourceA
gdi32.dllTextOutA
gdi32.dllSetTextColor
gdi32.dllSetBkMode
gdi32.dllSetBkColor
gdi32.dllSelectObject
gdi32.dllRoundRect
gdi32.dllRemoveFontResourceA
shell32.dllShellExecuteA
shell32.dllShellExecuteExA
user32.dllShowWindow
user32.dllSetWindowTextA
user32.dllSetWindowRgn
user32.dllSetWindowPos
user32.dllTrackPopupMenu
user32.dllSetTimer
user32.dllSetFocus
user32.dllSetDlgItemTextA
user32.dllSetClassLongA
user32.dllUpdateWindow
user32.dllSetWindowLongA
user32.dllSetCapture
user32.dllSendMessageA
user32.dllReleaseCapture
user32.dllRegisterClassExA
user32.dllRedrawWindow
user32.dllPtInRect
user32.dllOffsetRect
user32.dllMessageBoxA
user32.dllLoadStringA
user32.dllLoadIconA
user32.dllLoadCursorA
user32.dllLoadBitmapA
user32.dllIsDlgButtonChecked
user32.dllInvalidateRect
user32.dllIntersectRect
user32.dllGetWindowRect
user32.dllGetWindowLongA
user32.dllGetSystemMetrics
user32.dllCloseClipboard
user32.dllEmptyClipboard
user32.dllOpenClipboard
user32.dllSetClipboardData
user32.dllGetClientRect
user32.dllMoveWindow
user32.dllGetSysColor
user32.dllGetParent
user32.dllGetKeyState
user32.dllGetDlgItemTextA
user32.dllGetDlgItem
user32.dllGetDlgCtrlID
user32.dllGetDC
user32.dllGetCursorPos
user32.dllGetCapture
user32.dllGetActiveWindow
user32.dllEndDialog
user32.dllEnableWindow
user32.dllDrawTextA
user32.dllDialogBoxParamA
user32.dllDefWindowProcA
user32.dllCreateWindowExA
user32.dllCreatePopupMenu
user32.dllCheckDlgButton
user32.dllCallWindowProcA
user32.dllAppendMenuA
ordentry_vafunction_name
10x2280AddMsg
20x289cCloseFileMapping
30x2986CloseFileMapping_readonly
40x20ccGetPatcherWindowHandle
50x20e0GetPluginDataMemory
60x6d90GetRegDword
70x6cf0GetRegString
80x2423LoadFileMapping
90xa4e0Reg_Delete_Value
100x6520SearchAndReplace
110xa530SetRegDword
120xa590SetRegString
130x6b3cwrite_disk_file
module_namedup2patcher.exe
flags0
timestamp2011-11-21 23:31:35
version0.0
ordinal_base1
nFunctions13
nNames13
Names(13)0xbeec
Functions(13)0xbeb8
NameOrdinals(13)0xbf20
offsetsizetypecomment
0211968EXE11/21/2011 23:31:35#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK