A53hfd44M129Y42.exe - Trojan.Xorist-9

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	A53hfd44M129Y42.exe
size	177664 (0x2b600)
md5	837b7c04ecae8bd4ed857fff7a3812f4

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Trojan.Xorist-9 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4d6cee94
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	5.12
SizeOfCode	0x1400
SizeOfInitializedData	0x29e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1eb7
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x30000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x13ee	0x1400	R-X CODE
.rdata	0x3000	0x74e	0x800	R-- IDATA
.data	0x4000	0x2dcc	0x600	RW- IDATA
.rsrc	0x7000	0x28ef4	0x29000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3118	0xa0
RESOURCE	0x7000	0x28ef4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x3000	0x118
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
IMAGE	#2000	66	1252
BITMAP	#13	633	1252
ICON	#0	744	1252
ICON	#1	296	1252
ICON	#2	11432	1252
ICON	#3	7112	1252
ICON	#4	5672	1252
ICON	#5	5144	1252
ICON	#6	3752	1252
ICON	#7	2984	1252
ICON	#8	2216	1252
ICON	#9	1736	1252
ICON	#10	1544	1252
ICON	#11	1384	1252
ICON	#12	3721	1252
ICON	#13	38056	1252
ICON	#14	21640	1252
ICON	#15	16936	1252
ICON	#16	14920	1252
ICON	#17	9640	1252
ICON	#18	6760	1252
ICON	#19	4264	1252
ICON	#20	2440	1252
ICON	#21	1720	1252
ICON	#22	1128	1252
GROUP_ICON	MAINICON	328	1252

module_name	hint	function_name
user32.dll	481	RegisterClassExA
user32.dll	433	MessageBoxA
user32.dll	509	SendMessageA
user32.dll	323	GetSystemMetrics
user32.dll	290	GetMessageA
user32.dll	252	GetDlgItemTextA
user32.dll	182	EndPaint
user32.dll	606	TranslateMessage
user32.dll	618	UpdateWindow
user32.dll	404	LoadCursorA
user32.dll	147	DispatchMessageA
user32.dll	131	DefWindowProcA
user32.dll	86	CreateWindowExA
user32.dll	11	BeginPaint
kernel32.dll	35	CloseHandle
kernel32.dll	46	CopyFileA
kernel32.dll	61	CreateFileA
kernel32.dll	155	ExitProcess
kernel32.dll	173	FindClose
kernel32.dll	177	FindFirstFileA
kernel32.dll	186	FindNextFileA
kernel32.dll	192	FindResourceA
kernel32.dll	211	FreeResource
kernel32.dll	230	GetCommandLineA
kernel32.dll	275	GetEnvironmentVariableA
kernel32.dll	284	GetFileSize
kernel32.dll	302	GetLogicalDrives
kernel32.dll	306	GetModuleFileNameA
kernel32.dll	308	GetModuleHandleA
kernel32.dll	342	GetProcessHeap
kernel32.dll	388	GetTempPathA
kernel32.dll	428	GlobalFree
kernel32.dll	445	HeapAlloc
kernel32.dll	495	LoadResource
kernel32.dll	509	LockResource
kernel32.dll	518	MoveFileA
kernel32.dll	577	ReadFile
kernel32.dll	602	RtlMoveMemory
kernel32.dll	643	SetErrorMode
kernel32.dll	649	SetFilePointer
kernel32.dll	698	SizeofResource
kernel32.dll	763	WriteFile
kernel32.dll	787	lstrcatA
kernel32.dll	789	lstrcmpA
kernel32.dll	793	lstrcpyA
kernel32.dll	797	lstrlenA
shell32.dll	217	ShellExecuteA
shell32.dll	158	SHGetSpecialFolderPathA
advapi32.dll	443	RegCreateKeyExA
advapi32.dll	128	CryptCreateHash
advapi32.dll	131	CryptDestroyHash
advapi32.dll	145	CryptGetHashParam
advapi32.dll	487	RegSetValueExA
advapi32.dll	446	RegDeleteKeyA
advapi32.dll	125	CryptAcquireContextA
advapi32.dll	439	RegCloseKey
advapi32.dll	152	CryptReleaseContext
advapi32.dll	149	CryptHashData
shlwapi.dll	94	PathMatchSpecA
shlwapi.dll	46	PathFindFileNameA
shlwapi.dll	44	PathFindExtensionA
gdi32.dll	47	CreateFontIndirectA
comctl32.dll	84	InitCommonControls

show previews

offset	size	type	comment
0	177664	EXE	03/01/2011 13:03:16	#
15c1	15	HTM		#
da20	3721	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

A53hfd44M129Y42.exe-

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

A53hfd44M129Y42.exe
-