filename2014-05-27-Fiesta-EK-malware-payload.exe
size271360 (0x42400)
md562e1eccb403a08c55d619c7ea5e44c5d
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
170402194
9540351
9340354
1473072913
1073
171303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x53839ffc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x2ae00
SizeOfInitializedData0x17800
SizeOfUninitializedData0
AddressOfEntryPoint0x179a0
BaseOfCode0x1000
BaseOfData0x2c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x46000
SizeOfHeaders0x400
CheckSum0x4dc52
Subsystem2
DllCharacteristics0x8540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2aceb0x2ae00R-X CODE
.rdata0x2c0000x86c0xa00R-- IDATA
.udata0x2d0000x24870x2600RW- IDATA
.data0x300000xe1f80xdc00RW- IDATA
.reloc0x3f0000x641c0x6600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2c14c0xb4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x3f0000x62b8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x2c0000x144
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll828LoadLibraryA
KERNEL32.dll620GetSystemDefaultLangID
KERNEL32.dll352FreeEnvironmentStringsA
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll840LocalFree
KERNEL32.dll155CreateMutexA
KERNEL32.dll281ExitProcess
KERNEL32.dll354FreeLibrary
KERNEL32.dll674GetVersion
KERNEL32.dll1043ResumeThread
KERNEL32.dll905OutputDebugStringA
KERNEL32.dll16AllocConsole
KERNEL32.dll1210SuspendThread
KERNEL32.dll514GetLastError
KERNEL32.dll668GetUserDefaultLangID
KERNEL32.dll1317WriteFile
KERNEL32.dll171CreateSemaphoreA
KERNEL32.dll181CreateThread
KERNEL32.dll290FatalExit
KERNEL32.dll1039ResetEvent
KERNEL32.dll396GetComputerNameA
KERNEL32.dll659GetTickCount
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll612GetStdHandle
KERNEL32.dll675GetVersionExA
KERNEL32.dll357FreeResource
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
USER32.dll597SetDoubleClickTime
USER32.dll227FindWindowA
USER32.dll277GetDoubleClickTime
USER32.dll571SendMessageA
USER32.dll96CreateWindowExA
USER32.dll161DispatchMessageA
USER32.dll268GetDC
USER32.dll72CopyIcon
USER32.dll278GetFocus
USER32.dll271GetDialogBaseUnits
USER32.dll13BeginPaint
USER32.dll66CloseClipboard
USER32.dll727wsprintfA
USER32.dll153DestroyWindow
USER32.dll580SetCapture
USER32.dll514PostMessageA
USER32.dll85CreateDialogParamA
USER32.dll235GetActiveWindow
USER32.dll682TranslateMessage
USER32.dll502OpenClipboard
USER32.dll410IsCharLowerA
USER32.dll719WaitMessage
USER32.dll317GetMessageTime
USER32.dll264GetCursor
USER32.dll255GetClientRect
USER32.dll325GetParent
USER32.dll658ShowWindow
USER32.dll314GetMessageA
USER32.dll149DestroyCursor
USER32.dll346GetSysColor
USER32.dll349GetSystemMetrics
ntdll.dll1200_chkstk
ntdll.dll1268memset
ntdll.dll1266memcpy
ole32.dll62CoInitialize
GDI32.dll227DeleteDC
GDI32.dll373GdiFlush
GDI32.dll566LineTo
SHLWAPI.dll246SHReleaseThreadRef
VERSION.dllGetFileVersionInfoA
VERSION.dll3GetFileVersionInfoSizeA
WINSPOOL.DRV29ClosePrinter
offsetsizetypecomment
0271360EXE05/26/2014 20:11:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK