filenameHTLauncher.exe
size16567244 (0xfccbcc)
md59a91b414d891bcb6fa8c69d76b397d51
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Agent-269277 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x4e2ca093
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.56
SizeOfCode0x5400
SizeOfInitializedData0x2c00
SizeOfUninitializedData0xa22800
AddressOfEntryPoint0x1280
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xa30000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MingWin32 - Dev C++ v4.x

Sections

namevavsizeraw sizeflags
.text0x10000x52080x5400R-X CODE IDATA
.data0x70000xb00x200RW- IDATA
.idata0x80000x10940x1200RW- IDATA
.rdata0xa0000x2600x400R-- IDATA
.bss0xb0000xa227160RW- UDATA
.rsrc0xa2e0000x12810x1400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x80000x1094
RESOURCE0xa2e0000x1281
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#27440
ICON#322160
GROUP_ICON#121340
VERSION#17640
MANIFEST#110
module_namehintordfunction_name
ADVAPI32.DLL386RegCloseKey
ADVAPI32.DLL391RegCreateKeyExW
ADVAPI32.DLL396RegDeleteKeyW
ADVAPI32.DLL413RegOpenKeyExA
ADVAPI32.DLL415RegOpenKeyW
ADVAPI32.DLL425RegQueryValueW
ADVAPI32.DLL433RegSetValueA
ADVAPI32.DLL436RegSetValueW
KERNEL32.dll38CloseHandle
KERNEL32.dll71CreateFileW
KERNEL32.dll156ExitProcess
KERNEL32.dll313GetFileSize
KERNEL32.dll492InitializeCriticalSection
KERNEL32.dll703SetFilePointer
KERNEL32.dll739SetUnhandledExceptionFilter
KERNEL32.dll827WriteFile
msvcrt.dll55__getmainargs
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll147_cexit
msvcrt.dll266_iob
msvcrt.dll383_onexit
msvcrt.dll426_setmode
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll625free
msvcrt.dll676malloc
msvcrt.dll682memcpy
msvcrt.dll684memset
msvcrt.dll698realloc
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll712sscanf
msvcrt.dll717strcpy
msvcrt.dll758wcscpy
USER32.dll2AdjustWindowRectEx
USER32.dll7AppendMenuW
USER32.dll11BeginPaint
USER32.dll13BringWindowToTop
USER32.dll23CallNextHookEx
USER32.dll25CallWindowProcW
USER32.dll54CheckMenuItem
USER32.dll55CheckMenuRadioItem
USER32.dll57ChildWindowFromPoint
USER32.dll59ClientToScreen
USER32.dll61CloseClipboard
USER32.dll72CreateAcceleratorTableW
USER32.dll78CreateDialogIndirectParamW
USER32.dll80CreateDialogParamW
USER32.dll87CreateMenu
USER32.dll88CreatePopupMenu
USER32.dll90CreateWindowExW
USER32.dll129DefFrameProcW
USER32.dll134DefWindowProcW
USER32.dll138DestroyAcceleratorTable
USER32.dll140DestroyCursor
USER32.dll142DestroyMenu
USER32.dll143DestroyWindow
USER32.dll149DispatchMessageW
USER32.dll162DrawEdge
USER32.dll163DrawFocusRect
USER32.dll165DrawFrameControl
USER32.dll167DrawIconEx
USER32.dll168DrawMenuBar
USER32.dll170DrawStateW
USER32.dll177EnableMenuItem
USER32.dll179EnableWindow
USER32.dll183EndPaint
USER32.dll204EnumWindows
USER32.dll207ExitWindowsEx
USER32.dll208FillRect
USER32.dll213FlashWindow
USER32.dll217GetActiveWindow
USER32.dll233GetClassNameW
USER32.dll235GetClientRect
USER32.dll246GetCursorPos
USER32.dll247GetDC
USER32.dll252GetDlgItem
USER32.dll291GetMenuStringW
USER32.dll294GetMessagePos
USER32.dll295GetMessageTime
USER32.dll296GetMessageW
USER32.dll303GetParent
USER32.dll322GetSysColor
USER32.dll324GetSystemMenu
USER32.dll325GetSystemMetrics
USER32.dll331GetUpdateRect
USER32.dll336GetWindow
USER32.dll338GetWindowDC
USER32.dll346GetWindowRect
USER32.dll350GetWindowTextLengthW
USER32.dll351GetWindowTextW
USER32.dll352GetWindowThreadProcessId
USER32.dll356HideCaret
USER32.dll361InflateRect
USER32.dll364InsertMenuItemW
USER32.dll368InvalidateRect
USER32.dll380IsClipboardFormatAvailable
USER32.dll383IsDialogMessageW
USER32.dll392IsWindowEnabled
USER32.dll394IsWindowVisible
USER32.dll397KillTimer
USER32.dll399LoadAcceleratorsW
USER32.dll401LoadBitmapW
USER32.dll404LoadCursorFromFileW
USER32.dll405LoadCursorW
USER32.dll407LoadIconW
USER32.dll409LoadImageW
USER32.dll428MapWindowPoints
USER32.dll430MessageBeep
USER32.dll436MessageBoxW
USER32.dll442MoveWindow
USER32.dll443MsgWaitForMultipleObjects
USER32.dll452OpenClipboard
USER32.dll462PeekMessageW
USER32.dll464PostMessageW
USER32.dll465PostQuitMessage
USER32.dll475RedrawWindow
USER32.dll479RegisterClassW
USER32.dll481RegisterClipboardFormatW
USER32.dll490ReleaseDC
USER32.dll496ScreenToClient
USER32.dll509SendMessageW
USER32.dll519SetClipboardData
USER32.dll543SetParent
USER32.dll559SetTimer
USER32.dll571SetWindowTextW
USER32.dll575SetWindowsHookExW
USER32.dll577ShowCaret
USER32.dll578ShowCursor
USER32.dll581ShowWindow
USER32.dll588SystemParametersInfoW
USER32.dll598TrackPopupMenu
USER32.dll603TranslateMDISysAccel
USER32.dll604TranslateMessage
USER32.dll607UnhookWindowsHookEx
USER32.dll608UnionRect
USER32.dll612UnregisterClassW
USER32.dll617UpdateWindow
USER32.dll625WaitForInputIdle
USER32.dll630WindowFromPoint

StringTable 041204b0

CompanyNameHanbitsoft corp.
FileDescriptionTantra Client
FileVersion3, 7, 0, 9
InternalNameHTLaunch
LegalCopyrightCopyright (c) - 2003 Hanbitsoft corp.
OriginalFilenameHTLaunch.exe
ProductNameTantra Client
ProductVersion1, 0, 0, 1

VS_FIXEDFILEINFO

FileVersion3.7.0.9
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
033792EXE07/24/2011 22:45:39#
15c115HTM#
840016533452BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 16567244 bytes (16 MiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK