filenamemalware.exe
size29184 (0x7200)
md58ce34f42e0b441c75a350bd55bfc2cd7
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Spy.SCKeylog-5 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
9320672
9321796
2592102
1472992
10816811
481683
10120
11816810

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3e38327b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x4a00
SizeOfInitializedData0x2800
SizeOfUninitializedData0
AddressOfEntryPoint0x859e
BaseOfCode0x4000
BaseOfData0xc000
ImageBase0x400000
SectionAlignment0x4000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x40000x49420x4a00R-X CODE
.rdata0xc0000x12680x1400R-- IDATA
.data0x100000x134c0x1000RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xc9900x8c
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xc0000x1ec
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
MSVCRT.dll625isalpha
MSVCRT.dll357_mbsnbcmp
MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll143_acmdln
MSVCRT.dll573atoi
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll183_controlfp
MSVCRT.dll653localtime
MSVCRT.dll701strftime
MSVCRT.dll345_mbscmp
MSVCRT.dll308_itoa
MSVCRT.dll351_mbsicmp
MSVCRT.dll585exit
MSVCRT.dll694strcat
MSVCRT.dll376_mbsrev
MSVCRT.dll678rand
MSVCRT.dll344_mbschr
MSVCRT.dll360_mbsnbcpy
MSVCRT.dll241_ftol
MSVCRT.dll720time
MSVCRT.dll583difftime
MSVCRT.dll380_mbsstr
MSVCRT.dll612ftell
MSVCRT.dll610fseek
MSVCRT.dll602fputs
MSVCRT.dll690sprintf
MSVCRT.dll664memmove
MSVCRT.dll372_mbsninc
MSVCRT.dll353_mbsinc
MSVCRT.dll7public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

MSVCRT.dll13public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

MSVCRT.dll65_CxxThrowException
MSVCRT.dll8public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

MSVCRT.dll599fopen
MSVCRT.dll588fclose
MSVCRT.dll605fread
MSVCRT.dll614fwrite
MSVCRT.dll66_EH_prolog
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll698strcpy
MSVCRT.dll375_mbsrchr
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll388_msize
MSVCRT.dll679realloc
MSVCRT.dll702strlen
MSVCRT.dll663memcpy
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll665memset
MSVCRT.dll88__getmainargs
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

SHELL32.dll194SHGetSpecialFolderLocation
SHELL32.dll187SHGetPathFromIDListA
SHELL32.dll182SHGetMalloc
ADVAPI32.dll559SetSecurityDescriptorDacl
ADVAPI32.dll505RegSetValueExA
ADVAPI32.dll457RegCloseKey
ADVAPI32.dll461RegCreateKeyExA
ADVAPI32.dll482RegOpenKeyExA
ADVAPI32.dll466RegDeleteValueA
ADVAPI32.dll291GetUserNameA
ADVAPI32.dll306InitializeSecurityDescriptor
WS2_32.dll19
WS2_32.dll3
WS2_32.dll9
WS2_32.dll11
WS2_32.dll23
WS2_32.dll16
WS2_32.dll111
WS2_32.dll115
WS2_32.dll57
WS2_32.dll52
WS2_32.dll116
WS2_32.dll4
KERNEL32.dll347GetFileSize
KERNEL32.dll916WriteFile
KERNEL32.dll46CloseHandle
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll73CreateEventA
KERNEL32.dll625OpenEventA
KERNEL32.dll441GetSystemDirectoryA
KERNEL32.dll479GetVersionExA
KERNEL32.dll839Sleep
KERNEL32.dll899WaitForSingleObject
KERNEL32.dll457GetTempFileNameA
KERNEL32.dll459GetTempPathA
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll408GetProcAddress
KERNEL32.dll584LoadLibraryA
KERNEL32.dll105CreateThread
KERNEL32.dll268GetComputerNameA
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll361GetLastError
KERNEL32.dll77CreateFileA
KERNEL32.dll197FindClose
KERNEL32.dll211FindNextFileA
KERNEL32.dll201FindFirstFileA
KERNEL32.dll69CreateDirectoryA
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll239FreeLibrary
KERNEL32.dll780SetFileAttributesA
KERNEL32.dll782SetFilePointer
KERNEL32.dll404GetPrivateProfileStringA
KERNEL32.dll124DeleteFileA
KERNEL32.dll96CreateProcessA
KERNEL32.dll681ReadFile
USER32.dll478MessageBoxA
offsetsizetypecomment
029184EXE01/29/2003 19:58:51#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK