filenamelsass.exe.1e498c8.0x00080000-0x000f9fff.dmp
size499712 (0x7a000)
md57cbdefe442a13e7fa7931e165e82e6f1
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavWin.Worm.Stuxnet FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
109507272
1322102211
1492102221
131210226
1323072934
149307292
1313072992
1235072733
10309
13830729222
146307291
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x4b8b56a3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2d02
Magic0x10b
LinkerVersion9.0
SizeOfCode0x79000
SizeOfInitializedData0x1000
SizeOfUninitializedData0xbd000
AddressOfEntryPoint0x136000
BaseOfCode0xbe000
BaseOfData0x137000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x138000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX v2.00-V2.90 (Markus Oberhumer & Laszlo Molnar & John Reiser)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
UPX00x10000xbd0000RWX UDATA
UPX10xbe0000x790000x78e00RWX IDATA
.rsrc0x1370000x10000x800RW- IDATA

Data Directory

typevasize
EXPORT0x1376440xac
IMPORT0x1372980x3ac
RESOURCE0x1370000x298
EXCEPTION00
SECURITY00
BASERELOC0x1376f00x10
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x136be00x40
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA#201266161252
RCDATA#202148481252
RCDATA#20352371252
RCDATA#2054331252
RCDATA#2082980001252
RCDATA#209251252
RCDATA#21097281252
RCDATA#2211459201252
RCDATA#2221024001252
RCDATA#24041711252
RCDATA#241257201252
RCDATA#242174001252
RCDATA#250409601252
module_namehintordfunction_name
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLVirtualProtect
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLVirtualFree
ADVAPI32.dllFreeSid
DNSAPI.dllDnsQuery_W
IPHLPAPI.DLLGetTcpTable
NETAPI32.dllNetUseDel
ole32.dllCoCreateGuid
OLEAUT32.dll6
PSAPI.DLLEnumProcesses
RPCRT4.dllNdrClientCall2
SHELL32.dllSHGetFolderPathW
SHLWAPI.dllStrStrIW
USER32.dllwsprintfW
USERENV.dllCreateEnvironmentBlock
VERSION.dllVerQueryValueW
WININET.dllInternetOpenW
WSOCK32.dll115
ordentry_vafunction_name
10x19d5
20x1ac6
40x4a3d
50x265f
60x1b7e
70x1c10
90x27c8
100x2af6
140x2166
150x2735
160x2ca9
170x2dfb
180x4ada
190x2353
220x1c15
240x3579
270x1ca2
280x3602
290x368b
310x2926
320x1a4e
module_name.
flags0
timestamp2010-03-01 05:54:37
version0.0
ordinal_base1
nFunctions32
nNames0
Names(0)0x1376ec
Functions(32)0x13766c
NameOrdinals(0)0x1376ec
offsetsizetypecomment
0498176DLL03/01/2010 05:54:43#
15c115HTM#
79a001536BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 499712 bytes (488 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x7e298
[?] can't find file_offset of VA 0x84a90
[?] can't find file_offset of VA 0x88490
[?] can't find file_offset of VA 0x89908
[?] can't find file_offset of VA 0x89abc