1.exe - WIN.Trojan.Agent-358066

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	1.exe
size	17408 (0x4400)
md5	60bcb0e1b9ae5a9b50dcff7decd656ae

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	WIN.Trojan.Agent-358066 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
10	8047	11
14	7299	3
4	8047	2
1	0	115
93	2179	15
11	8168	4

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x5049adee
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x2800
SizeOfInitializedData	0x2a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x353e
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x7000
SizeOfHeaders	0x400
CheckSum	0x13f6b
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x26d2	0x2800	R-X CODE
.rdata	0x4000	0xafc	0xc00	R-- IDATA
.data	0x5000	0x1d44	0xc00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x41dc	0xb4
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x4000	0x1d0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.dll	175		ExitProcess
KERNEL32.dll	124		DeleteFileA
KERNEL32.dll	696		ReleaseMutex
KERNEL32.dll	634		OpenMutexA
KERNEL32.dll	105		CreateThread
KERNEL32.dll	361		GetLastError
KERNEL32.dll	90		CreateMutexA
KERNEL32.dll	806		SetPriorityClass
KERNEL32.dll	373		GetModuleFileNameA
KERNEL32.dll	431		GetStartupInfoA
KERNEL32.dll	711		ResumeThread
KERNEL32.dll	824		SetThreadPriority
KERNEL32.dll	317		GetCurrentThread
KERNEL32.dll	944		lstrcatA
KERNEL32.dll	336		GetEnvironmentVariableA
KERNEL32.dll	429		GetShortPathNameA
KERNEL32.dll	782		SetFileAttributesA
KERNEL32.dll	96		CreateProcessA
KERNEL32.dll	950		lstrcmpiA
KERNEL32.dll	375		GetModuleHandleA
KERNEL32.dll	778		SetErrorMode
KERNEL32.dll	885		VirtualAlloc
KERNEL32.dll	894		VirtualQueryEx
KERNEL32.dll	686		ReadProcessMemory
KERNEL32.dll	461		GetThreadContext
KERNEL32.dll	849		TerminateProcess
KERNEL32.dll	820		SetThreadContext
KERNEL32.dll	928		WriteProcessMemory
KERNEL32.dll	892		VirtualProtectEx
KERNEL32.dll	888		VirtualFree
KERNEL32.dll	683		ReadFile
KERNEL32.dll	347		GetFileSize
KERNEL32.dll	784		SetFilePointer
KERNEL32.dll	77		CreateFileA
KERNEL32.dll	314		GetCurrentProcess
KERNEL32.dll	46		CloseHandle
KERNEL32.dll	953		lstrcpyA
KERNEL32.dll	479		GetVersionExA
KERNEL32.dll	507		GlobalMemoryStatusEx
KERNEL32.dll	440		GetSystemDefaultUILanguage
KERNEL32.dll	584		LoadLibraryA
KERNEL32.dll	408		GetProcAddress
KERNEL32.dll	469		GetTickCount
KERNEL32.dll	239		FreeLibrary
KERNEL32.dll	489		GetWindowsDirectoryA
KERNEL32.dll	441		GetSystemDirectoryA
KERNEL32.dll	494		GlobalAlloc
KERNEL32.dll	501		GlobalFree
KERNEL32.dll	543		InterlockedExchange
KERNEL32.dll	643		OutputDebugStringA
KERNEL32.dll	841		Sleep
KERNEL32.dll	61		CopyFileA
USER32.dll	725		wsprintfA
ADVAPI32.dll	175		DeleteService
ADVAPI32.dll	574		StartServiceA
ADVAPI32.dll	481		RegOpenKeyA
ADVAPI32.dll	505		RegSetValueExA
ADVAPI32.dll	513		RegisterServiceCtrlHandlerA
ADVAPI32.dll	569		SetServiceStatus
ADVAPI32.dll	427		OpenSCManagerA
ADVAPI32.dll	429		OpenServiceA
ADVAPI32.dll	62		CloseServiceHandle
ADVAPI32.dll	482		RegOpenKeyExA
ADVAPI32.dll	492		RegQueryValueExA
ADVAPI32.dll	457		RegCloseKey
ADVAPI32.dll	575		StartServiceCtrlDispatcherA
ADVAPI32.dll	100		CreateServiceA
SHELL32.dll	263		ShellExecuteA
MSVCRT.dll	183		_controlfp
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	690		sprintf
MSVCRT.dll	15		void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
MSVCRT.dll	709		strstr
MSVCRT.dll	573		atoi
MSVCRT.dll	705		strncpy
MSVCRT.dll	699		strcspn
MSVCRT.dll	664		memmove
MSVCRT.dll	16		void __cdecl operator delete(void *) ??3@YAXPAX@Z
MSVCRT.dll	211		_exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	585		exit
MSVCRT.dll	143		_acmdln
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	271		_initterm
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
WS2_32.dll		21
WS2_32.dll		9
WS2_32.dll		115
WS2_32.dll		23
WS2_32.dll		16
WS2_32.dll		151
WS2_32.dll		18
WS2_32.dll		4
WS2_32.dll		19
WS2_32.dll		3
WS2_32.dll		11
WS2_32.dll		116
WS2_32.dll	40		WSAIoctl
WS2_32.dll		52
WININET.dll	146		InternetOpenA
WININET.dll	147		InternetOpenUrlA
WININET.dll	105		InternetCloseHandle
WININET.dll	154		InternetReadFile
SHLWAPI.dll	141		SHDeleteKeyA

show previews

offset	size	type	comment
0	17408	EXE	09/07/2012 08:18:54	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

1.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

1.exe
-