filenameminerd-wolf-07-09-14.exe
size514560 (0x7da00)
md5806779989c6ea355a1abf4f6c7cb646c
typePE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Bitcoinminer-73 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections9
TimeDateStamp0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22f
Magic0x20b
LinkerVersion2.24
SizeOfCode0x61000
SizeOfInitializedData0x1c600
SizeOfUninitializedData0x2400
AddressOfEntryPoint0x1500
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x86000
SizeOfHeaders0x400
CheckSum0x7e945
Subsystem3
DllCharacteristics0
SizeOfStackReserve0xa00000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x60f900x61000R-X CODE
.data0x620000x4500x600RW- IDATA
.rdata0x630000x132080x13400R-- IDATA
.pdata0x770000x33840x3400R-- IDATA
.xdata0x7b0000x333c0x3400R-- IDATA
.bss0x7f0000x23e00RW- UDATA
.idata0x820000x1e500x2000RW- IDATA
.CRT0x840000x700x200RW- IDATA
.tls0x850000x680x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x820000x1e50
RESOURCE00
EXCEPTION0x770000x3384
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x850200x28
LOAD_CONFIG00
Bound_IAT00
IAT0x827840x6f8
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4850000x4850600x48078c0x48404000
module_namehintordfunction_name
ADVAPI32.dll176CryptAcquireContextA
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll196CryptGetHashParam
ADVAPI32.dll200CryptHashData
ADVAPI32.dll203CryptReleaseContext
KERNEL32.dll85CloseHandle
KERNEL32.dll134CreateEventA
KERNEL32.dll177CreateSemaphoreA
KERNEL32.dll216DeleteCriticalSection
KERNEL32.dll242DuplicateHandle
KERNEL32.dll248EnterCriticalSection
KERNEL32.dll296ExpandEnvironmentStringsA
KERNEL32.dll361FormatMessageA
KERNEL32.dll366FreeLibrary
KERNEL32.dll461GetCurrentProcess
KERNEL32.dll462GetCurrentProcessId
KERNEL32.dll465GetCurrentThread
KERNEL32.dll466GetCurrentThreadId
KERNEL32.dll514GetFileType
KERNEL32.dll525GetHandleInformation
KERNEL32.dll528GetLastError
KERNEL32.dll547GetModuleFileNameW
KERNEL32.dll598GetProcAddress
KERNEL32.dll599GetProcessAffinityMask
KERNEL32.dll627GetStartupInfoA
KERNEL32.dll629GetStdHandle
KERNEL32.dll644GetSystemInfo
KERNEL32.dll650GetSystemTimeAsFileTime
KERNEL32.dll664GetThreadContext
KERNEL32.dll672GetThreadPriority
KERNEL32.dll677GetTickCount
KERNEL32.dll682GetTimeZoneInformation
KERNEL32.dll694GetVersionExA
KERNEL32.dll761InitializeCriticalSection
KERNEL32.dll843LeaveCriticalSection
KERNEL32.dll846LoadLibraryA
KERNEL32.dll929PeekNamedPipe
KERNEL32.dll955QueryPerformanceCounter
KERNEL32.dll981ReadFile
KERNEL32.dll1003ReleaseSemaphore
KERNEL32.dll1020ResetEvent
KERNEL32.dll1024ResumeThread
KERNEL32.dll1025RtlAddFunctionTable
KERNEL32.dll1026RtlCaptureContext
KERNEL32.dll1033RtlLookupFunctionEntry
KERNEL32.dll1040RtlVirtualUnwind
KERNEL32.dll1092SetCriticalSectionSpinCount
KERNEL32.dll1107SetEvent
KERNEL32.dll1132SetLastError
KERNEL32.dll1143SetProcessAffinityMask
KERNEL32.dll1162SetThreadContext
KERNEL32.dll1170SetThreadPriority
KERNEL32.dll1183SetUnhandledExceptionFilter
KERNEL32.dll1196Sleep
KERNEL32.dll1199SleepEx
KERNEL32.dll1204SuspendThread
KERNEL32.dll1210TerminateProcess
KERNEL32.dll1215TlsAlloc
KERNEL32.dll1217TlsGetValue
KERNEL32.dll1218TlsSetValue
KERNEL32.dll1224TryEnterCriticalSection
KERNEL32.dll1230UnhandledExceptionFilter
KERNEL32.dll1254VirtualAlloc
KERNEL32.dll1260VirtualProtect
KERNEL32.dll1262VirtualQuery
KERNEL32.dll1268WaitForMultipleObjects
KERNEL32.dll1270WaitForSingleObject
msvcrt.dll55__C_specific_handler
msvcrt.dll70__argv
msvcrt.dll78__dllonexit
msvcrt.dll81__getmainargs
msvcrt.dll82__initenv
msvcrt.dll83__iob_func
msvcrt.dll90__lconv_init
msvcrt.dll96__set_app_type
msvcrt.dll98__setusermatherr
msvcrt.dll113_acmdln
msvcrt.dll120_amsg_exit
msvcrt.dll134_beginthreadex
msvcrt.dll138_cexit
msvcrt.dll185_endthreadex
msvcrt.dll188_errno
msvcrt.dll197_exit
msvcrt.dll220_fmode
msvcrt.dll234_fstat64
msvcrt.dll236_ftime
msvcrt.dll238_ftime64
msvcrt.dll271_gmtime64
msvcrt.dll284_initterm
msvcrt.dll385_localtime64
msvcrt.dll386_lock
msvcrt.dll395_lseeki64
msvcrt.dll551_onexit
msvcrt.dll596_setjmp
msvcrt.dll613_snwprintf
msvcrt.dll639_stat64
msvcrt.dll648_stricmp
msvcrt.dll658_strnicmp
msvcrt.dll688_sys_nerr
msvcrt.dll692_time64
msvcrt.dll713_unlock
msvcrt.dll742_vsnprintf
msvcrt.dll901abort
msvcrt.dll910atoi
msvcrt.dll914calloc
msvcrt.dll925exit
msvcrt.dll928fclose
msvcrt.dll929feof
msvcrt.dll931fflush
msvcrt.dll932fgetc
msvcrt.dll934fgets
msvcrt.dll940fopen
msvcrt.dll942fprintf
msvcrt.dll944fputc
msvcrt.dll948fread
msvcrt.dll949free
msvcrt.dll955fseek
msvcrt.dll958fwprintf
msvcrt.dll960fwrite
msvcrt.dll965getenv
msvcrt.dll972isalnum
msvcrt.dll973isalpha
msvcrt.dll976isgraph
msvcrt.dll978islower
msvcrt.dll979isprint
msvcrt.dll981isspace
msvcrt.dll982isupper
msvcrt.dll996isxdigit
msvcrt.dll1000localeconv
msvcrt.dll1006malloc
msvcrt.dll1009mbstowcs
msvcrt.dll1012memchr
msvcrt.dll1013memcmp
msvcrt.dll1014memcpy
msvcrt.dll1015memmove
msvcrt.dll1017memset
msvcrt.dll1021printf
msvcrt.dll1025puts
msvcrt.dll1028qsort
msvcrt.dll1030raise
msvcrt.dll1031rand
msvcrt.dll1032realloc
msvcrt.dll1040setlocale
msvcrt.dll1042signal
msvcrt.dll1045sprintf
msvcrt.dll1048srand
msvcrt.dll1049sscanf
msvcrt.dll1051strcat
msvcrt.dll1053strchr
msvcrt.dll1054strcmp
msvcrt.dll1056strcpy
msvcrt.dll1059strerror
msvcrt.dll1061strlen
msvcrt.dll1064strncmp
msvcrt.dll1065strncpy
msvcrt.dll1068strrchr
msvcrt.dll1070strstr
msvcrt.dll1072strtok
msvcrt.dll1074strtol
msvcrt.dll1075strtoul
msvcrt.dll1089tolower
msvcrt.dll1095vfprintf
msvcrt.dll1111wcscpy
msvcrt.dll1131wcstombs
msvcrt.dll1160longjmp
msvcrt.dll1175_write
msvcrt.dll1202_strdup
msvcrt.dll1217_read
msvcrt.dll1223_open
msvcrt.dll1237_getpid
msvcrt.dll1264_close
USER32.dll496MessageBoxW
WLDAP32.dll10ber_free
WLDAP32.dll94ldap_err2string
WLDAP32.dll108ldap_first_attribute
WLDAP32.dll111ldap_first_entry
WLDAP32.dll116ldap_get_dn
WLDAP32.dll128ldap_get_values_len
WLDAP32.dll131ldap_init
WLDAP32.dll134ldap_memfree
WLDAP32.dll161ldap_msgfree
WLDAP32.dll162ldap_next_attribute
WLDAP32.dll165ldap_next_entry
WLDAP32.dll212ldap_search_s
WLDAP32.dll220ldap_set_option
WLDAP32.dll226ldap_simple_bind_s
WLDAP32.dll229ldap_sslinit
WLDAP32.dll240ldap_unbind_s
WLDAP32.dll244ldap_value_free_len
WS2_32.dll26WSACleanup
WS2_32.dll43WSAGetLastError
WS2_32.dll54WSAIoctl
WS2_32.dll79WSASetLastError
WS2_32.dll84WSAStartup
WS2_32.dll146__WSAFDIsSet
WS2_32.dll147accept
WS2_32.dll148bind
WS2_32.dll149closesocket
WS2_32.dll150connect
WS2_32.dll151freeaddrinfo
WS2_32.dll152getaddrinfo
WS2_32.dll155gethostname
WS2_32.dll157getpeername
WS2_32.dll162getsockname
WS2_32.dll163getsockopt
WS2_32.dll165htons
WS2_32.dll170ioctlsocket
WS2_32.dll171listen
WS2_32.dll173ntohs
WS2_32.dll174recv
WS2_32.dll175recvfrom
WS2_32.dll176select
WS2_32.dll177send
WS2_32.dll178sendto
WS2_32.dll179setsockopt
WS2_32.dll181socket
offsetsizetypecomment
15c115HTM#
15d0508976BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x8078c