548b053a866a49bbe464082adc40bd35ce31edc5d628511edce04c37801c9b24.bin - resmon.exe - Resource Monitor - Win.Trojan.Agent-1717277

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	548b053a866a49bbe464082adc40bd35ce31edc5d628511edce04c37801c9b24.bin
size	262412 (0x4010c)
md5	6d934dee9ef917d58d3021f5fda66e91

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Agent-1717277 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x40

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xe
TimeDateStamp	0x57e9e8ee
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x11f
Magic	0x10b
LinkerVersion	9.56
SizeOfCode	0xc000
SizeOfInitializedData	0
SizeOfUninitializedData	0
AddressOfEntryPoint	0xbef0
BaseOfCode	0
BaseOfData	0xd000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	3.1
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x4e000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0x40
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.texT	0x1000	0xb0c4	0xc000	R-X CODE
.rdata	0xd000	0x12f2	0x2000	R-- IDATA
.data	0xf000	0x1063c	0x4000	RW- IDATA
]5D?];uS	0x20000	0x704	0x1000	RW- IDATA
CONST	0x21000	0x70d	0x1000	RW- IDATA
=ey	0x22000	0x3584	0x4000	RW- IDATA
_:)PC-	0x26000	0x707	0x1000	RW- IDATA
E[%,{	0x27000	0xd82	0x1000	RW- IDATA
s4h	0x28000	0x8a0	0x1000	RW- IDATA
.erloc	0x29000	0x1222	0x2000	RW- IDATA
_(v%;x m	0x2b000	0xd7e	0x1000	RW- IDATA
a1Q9	0x2c000	0x85be	0x9000	RW- IDATA
.rsrc	0x35000	0x17a94	0x18000	R-- IDATA
.reloc	0x4d000	0x1000	0x10c	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x5c65b589	0
IMPORT	0xe034	0x79
RESOURCE	0x35000	0x17a94
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x4d000	0x10c
DEBUG	0xd060	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xd000	0x60
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	1640	0
ICON	#2	744	0
ICON	#3	488	0
ICON	#4	296	0
ICON	#5	3752	0
ICON	#6	2216	0
ICON	#7	1736	0
ICON	#8	1384	0
ICON	#9	64576	0
ICON	#10	9640	0
ICON	#11	4264	0
ICON	#12	2440	0
ICON	#13	1128	0
GROUP_ICON	#1	188	0
VERSION	#1	904	0
MANIFEST	#1	640	0

module_name	hint	ord	function_name
msvcrt.dll	1170		fclose
msvcrt.dll	1220		isprint
msvcrt.dll	1369		wcsncat
msvcrt.dll	1218		isleadbyte
urlmon.dll	21		CompareSecurityIds
KERNEL32.dll	332		GetDriveTypeW
KERNEL32.dll	762		SetDefaultCommConfigW
KERNEL32.dll	407		GetProcAddress
KERNEL32.dll	577		LoadLibraryA
KERNEL32.dll	215		FindFirstVolumeW
KERNEL32.dll	882		VirtualQuery
KERNEL32.dll	269		GetComputerNameA
KERNEL32.dll	368		GetLongPathNameA
KERNEL32.dll	525		HeapSetInformation
KERNEL32.dll	914		WritePrivateProfileStructA
KERNEL32.dll	880		VirtualProtect
KERNEL32.dll	63		CopyFileA
CLUSAPI.dll	1		AddClusterResourceNode
SHLWAPI.dll	310		wnsprintfA

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Resource Monitor
FileVersion	6.1.7600.16385 (win7_rtm.090713-1255)
InternalName	resmon.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	resmon.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion	6.1.7600.16385
ProductVersion	6.1.7600.16385
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	262412	EXE	09/27/2016 03:35:10	#
15c1	15	HTM		#
2b2e0	64576	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x5c65b589