filenameshadowbot2.exe
size59904 (0xea00)
md57730ffeb85238a1d57f9b1ecd13cc270
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
221210052
223210051
2242100519
225210057
9340352
2036550111
10113
225311014
219210051
222311011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x55aecdce
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion12.0
SizeOfCode0xa000
SizeOfInitializedData0x4c00
SizeOfUninitializedData0
AddressOfEntryPoint0x11230
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x22000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000x9e090xa000R-X CODE
.rdata0x1b0000x23ca0x2400R-- IDATA
.data0x1e0000x7750x200RW- IDATA
.idata0x1f0000xf630x1000R-- IDATA
.rsrc0x200000x43c0x600R-- IDATA
.reloc0x210000x81d0xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1f3480xa0
RESOURCE0x200000x43c
EXCEPTION00
SECURITY00
BASERELOC0x210000x62c
DEBUG0x1b8200x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1c8300x40
Bound_IAT00
IAT0x1f0000x348
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll1537lstrcmpiA
KERNEL32.dll1543lstrcpynA
KERNEL32.dll1540lstrcpyA
KERNEL32.dll1546lstrlenA
KERNEL32.dll933LoadLibraryA
KERNEL32.dll186CreateFileA
KERNEL32.dll1534lstrcmpA
KERNEL32.dll232CreateThread
KERNEL32.dll215CreateProcessA
KERNEL32.dll754GetTickCount
KERNEL32.dll594GetLocaleInfoA
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll414FreeLibrary
KERNEL32.dll669GetProcAddress
KERNEL32.dll1006OpenProcess
KERNEL32.dll1362Sleep
KERNEL32.dll592GetLastError
KERNEL32.dll206CreateMutexA
KERNEL32.dll127CloseHandle
KERNEL32.dll1443VirtualQuery
KERNEL32.dll674GetProcessHeap
KERNEL32.dll819HeapFree
KERNEL32.dll815HeapAlloc
KERNEL32.dll254DecodePointer
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll1088RaiseException
KERNEL32.dll289EncodePointer
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll615GetModuleHandleW
USER32.dll890wsprintfA
ADVAPI32.dll272EnumServicesStatusA
ADVAPI32.dll101CloseServiceHandle
ADVAPI32.dll393ImpersonateLoggedOnUser
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll531OpenSCManagerA
WININET.dll194InternetOpenA
WININET.dll202InternetReadFile
WININET.dll195InternetOpenUrlA
PSAPI.DLL5EnumProcesses
PSAPI.DLL4EnumProcessModules
PSAPI.DLL12GetModuleBaseNameA
MSVCR120D.dll1688fclose
MSVCR120D.dll1722fopen
MSVCR120D.dll1743fwrite
MSVCR120D.dll1854printf
MSVCR120D.dll1864rand
MSVCR120D.dll1899srand
MSVCR120D.dll1907strcpy
MSVCR120D.dll1902strcat
MSVCR120D.dll1927strtok
MSVCR120D.dll1315_time64
MSVCR120D.dll1584atoi
MSVCR120D.dll343_CRT_RTC_INITW
MSVCR120D.dll642_crt_debugger_hook
MSVCR120D.dll462__crtUnhandledException
MSVCR120D.dll461__crtTerminateProcess
MSVCR120D.dll397_XcptFilter
MSVCR120D.dll580_amsg_exit
MSVCR120D.dll1820malloc
MSVCR120D.dll535__set_app_type
MSVCR120D.dll349_CrtDbgReportW
MSVCR120D.dll366_CrtSetCheckCount
MSVCR120D.dll1679exit
MSVCR120D.dll694_exit
MSVCR120D.dll604_cexit
MSVCR120D.dll623_configthreadlocale
MSVCR120D.dll537__setusermatherr
MSVCR120D.dll838_initterm_e
MSVCR120D.dll837_initterm
MSVCR120D.dll473__initenv
MSVCR120D.dll726_fmode
MSVCR120D.dll622_commode
MSVCR120D.dll311void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR120D.dll459__crtSetUnhandledExceptionFilter
MSVCR120D.dll971_lock
MSVCR120D.dll1343_unlock
MSVCR120D.dll603_calloc_dbg
MSVCR120D.dll464__dllonexit
MSVCR120D.dll1139_onexit
MSVCR120D.dll843_invoke_watson
MSVCR120D.dll626_controlfp_s
MSVCR120D.dll685_except_handler4_common
MSVCR120D.dll1990wcscpy_s
MSVCR120D.dll1501_wmakepath_s
MSVCR120D.dll1535_wsplitpath_s
MSVCR120D.dll1831memcpy
MSVCR120D.dll1896sprintf
MSVCR120D.dll1835memset
MSVCR120D.dll1905strcmp
MSVCR120D.dll1913strlen
MSVCR120D.dll1917strncpy
MSVCR120D.dll1923strstr
MSVCR120D.dll406__CxxFrameHandler3
MSVCR120D.dll472__getmainargs
WS2_32.dll16
WS2_32.dll19
WS2_32.dll4
WS2_32.dll10
WS2_32.dll116
WS2_32.dll9
WS2_32.dll11
WS2_32.dll23
WS2_32.dll12
WS2_32.dll115
WS2_32.dll3
WS2_32.dll52
offsetsizetypecomment
059904EXE07/21/2015 22:55:10#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK