Malware Investigations Assignment 1.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	Malware Investigations Assignment 1.exe
size	14336 (0x3800)
md5	611cbb3333e171a99e8237dbe03742b6

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
147	30729	16
257	33030	2
261	33030	19
260	33030	12
259	33030	2
257	30795	7
1	0	72
265	33135	1
255	33135	1
258	33135	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x670278bd
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.38
SizeOfCode	0x1800
SizeOfInitializedData	0x1e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1d82
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x16bb	0x1800	R-X CODE
.rdata	0x3000	0x13d8	0x1400	R-- IDATA
.data	0x5000	0x3d0	0x200	RW- IDATA
.rsrc	0x6000	0x1e0	0x200	R-- IDATA
.reloc	0x7000	0x250	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3c4c	0x104
RESOURCE	0x6000	0x1e0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x7000	0x250
DEBUG	0x3808	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x3748	0x40
Bound_IAT	0	0
IAT	0x3000	0x120
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	ord	function_name
KERNEL32.dll	1444		Sleep
KERNEL32.dll	651		GetModuleFileNameW
KERNEL32.dll	925		IsDebuggerPresent
KERNEL32.dll	897		InitializeSListHead
KERNEL32.dll	771		GetSystemTimeAsFileTime
KERNEL32.dll	561		GetCurrentThreadId
KERNEL32.dll	557		GetCurrentProcessId
KERNEL32.dll	1133		QueryPerformanceCounter
KERNEL32.dll	933		IsProcessorFeaturePresent
KERNEL32.dll	1460		TerminateProcess
KERNEL32.dll	556		GetCurrentProcess
KERNEL32.dll	1428		SetUnhandledExceptionFilter
KERNEL32.dll	1493		UnhandledExceptionFilter
KERNEL32.dll	655		GetModuleHandleW
IPHLPAPI.DLL	68		GetAdaptersInfo
WS2_32.dll		12
WS2_32.dll		116
WS2_32.dll		11
WS2_32.dll		115
VCRUNTIME140.dll	29		__current_exception_context
VCRUNTIME140.dll	72		memset
VCRUNTIME140.dll	53		_except_handler4_common
VCRUNTIME140.dll	28		__current_exception
api-ms-win-crt-string-l1-1-0.dll	143		strncpy
api-ms-win-crt-string-l1-1-0.dll	148		strtok
api-ms-win-crt-stdio-l1-1-0.dll	17		__stdio_common_vswprintf
api-ms-win-crt-stdio-l1-1-0.dll	1		__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	84		_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	140		getchar
api-ms-win-crt-stdio-l1-1-0.dll	13		__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll	125		fopen
api-ms-win-crt-stdio-l1-1-0.dll			__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	3		__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll	116		fclose
api-ms-win-crt-runtime-l1-1-0.dll	37		_exit
api-ms-win-crt-runtime-l1-1-0.dll	5		__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	6		__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	23		_cexit
api-ms-win-crt-runtime-l1-1-0.dll	22		_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	63		_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	88		exit
api-ms-win-crt-runtime-l1-1-0.dll	42		_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	53		_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	54		_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	62		_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	31		_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	29		_controlfp_s
api-ms-win-crt-runtime-l1-1-0.dll	106		terminate
api-ms-win-crt-runtime-l1-1-0.dll	25		_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	68		_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	66		_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	105		system
api-ms-win-crt-runtime-l1-1-0.dll	86		_wsystem
api-ms-win-crt-runtime-l1-1-0.dll	57		_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	56		_initterm
api-ms-win-crt-convert-l1-1-0.dll	23		_itoa
api-ms-win-crt-environment-l1-1-0.dll	16		getenv
api-ms-win-crt-math-l1-1-0.dll	46		__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	8		_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	22		_set_new_mode

show previews

offset	size	type	comment
0	14336	EXE	10/06/2024 11:47:09	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK