filenameirc-shadowbot.dll
size18432 (0x4800)
md56639b0b93f4b42db435947a2bbad6f5b
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.IRCBot-974 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
221210052
223210053
2242100512
225210052
225208061
2036550117
10105
229311013
219210051
222311011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x55b7c6ad
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x2400
SizeOfInitializedData0x2400
SizeOfUninitializedData0
AddressOfEntryPoint0x2b3d
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x221c0x2400R-X CODE
.rdata0x40000x16520x1800R-- IDATA
.data0x60000x4f40x200RW- IDATA
.rsrc0x70000x1e00x200R-- IDATA
.reloc0x80000x3a80x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x4dbc0xc8
RESOURCE0x70000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x80000x3a8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x4c500x40
Bound_IAT00
IAT0x40000x1c0
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
KERNEL32.dll809GlobalUnlock
KERNEL32.dll1534lstrcmpA
KERNEL32.dll1546lstrlenA
KERNEL32.dll1543lstrcpynA
KERNEL32.dll1006OpenProcess
KERNEL32.dll592GetLastError
KERNEL32.dll1537lstrcmpiA
KERNEL32.dll669GetProcAddress
KERNEL32.dll933LoadLibraryA
KERNEL32.dll127CloseHandle
KERNEL32.dll1540lstrcpyA
KERNEL32.dll337ExitProcess
KERNEL32.dll215CreateProcessA
KERNEL32.dll1362Sleep
KERNEL32.dll206CreateMutexA
KERNEL32.dll232CreateThread
KERNEL32.dll791GlobalAlloc
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll254DecodePointer
KERNEL32.dll289EncodePointer
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll783GetWindowsDirectoryA
KERNEL32.dll754GetTickCount
KERNEL32.dll802GlobalLock
KERNEL32.dll275DisableThreadLibraryCalls
KERNEL32.dll594GetLocaleInfoA
USER32.dll800ShowWindow
USER32.dll869VkKeyScanA
USER32.dll710SetClipboardData
USER32.dll15BlockInput
USER32.dll223EmptyClipboard
USER32.dll724SetFocus
USER32.dll725SetForegroundWindow
USER32.dll75CloseClipboard
USER32.dll888keybd_event
USER32.dll890wsprintfA
USER32.dll606OpenClipboard
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll101CloseServiceHandle
ADVAPI32.dll393ImpersonateLoggedOnUser
ADVAPI32.dll531OpenSCManagerA
ADVAPI32.dll272EnumServicesStatusA
ole32.dll26CoCreateInstance
ole32.dll127CoUninitialize
ole32.dll79CoInitialize
OLEAUT32.dll9
OLEAUT32.dll8
OLEAUT32.dll6
OLEAUT32.dll2
PSAPI.DLL4EnumProcessModules
PSAPI.DLL13GetModuleBaseNameA
PSAPI.DLL6EnumProcesses
MSVCR120.dll1765memcmp
MSVCR120.dll396__clean_type_info_names_internal
MSVCR120.dll634_except_handler4_common
MSVCR120.dll1082_onexit
MSVCR120.dll430__dllonexit
MSVCR120.dll558_calloc_crt
MSVCR120.dll1284_unlock
MSVCR120.dll916_lock
MSVCR120.dll781_initterm_e
MSVCR120.dll780_initterm
MSVCR120.dll933_malloc_crt
MSVCR120.dll535_amsg_exit
MSVCR120.dll367__CppXcptFilter
MSVCR120.dll427__crtTerminateProcess
MSVCR120.dll1831sprintf
MSVCR120.dll1858strstr
MSVCR120.dll1799rand
MSVCR120.dll1834srand
MSVCR120.dll114void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR120.dll112void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR120.dll1852strncpy
MSVCR120.dll1755malloc
MSVCR120.dll1862strtok
MSVCR120.dll1657fopen
MSVCR120.dll1678fwrite
MSVCR120.dll1623fclose
MSVCR120.dll1256_time64
MSVCR120.dll1667free
MSVCR120.dll372__CxxFrameHandler3
MSVCR120.dll592_crt_debugger_hook
MSVCR120.dll428__crtUnhandledException
MSVCR120.dll1770memset
WS2_32.dll11
WS2_32.dll12
WS2_32.dll115
WS2_32.dll9
WS2_32.dll116
WS2_32.dll16
WS2_32.dll23
WS2_32.dll3
WS2_32.dll52
WS2_32.dll19
WS2_32.dll4
WININET.dll194InternetOpenA
WININET.dll195InternetOpenUrlA
WININET.dll202InternetReadFile
offsetsizetypecomment
018432DLL07/28/2015 18:15:09#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK