PC_Booster.exe - Win.Trojan.Agent-751739

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	PC_Booster.exe
size	1082880 (0x108600)
md5	9dfbb035592ea044a4b29977a3f272ff

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Agent-751739 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
207	61030	3
205	50929	26
132	30729	1
207	50929	73
206	50929	184
131	30729	5
147	30729	15
1	0	216
0	0	2
211	61030	9
201	61030	1
204	61030	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x539efb10
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	11.0
SizeOfCode	0x56400
SizeOfInitializedData	0xb1e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x36443
BaseOfCode	0x1000
BaseOfData	0x58000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x111000
SizeOfHeaders	0x400
CheckSum	0x114b0f
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x563fc	0x56400	R-X CODE
.rdata	0x58000	0x12266	0x12400	R-- IDATA
.data	0x6b000	0xa4bf8	0x9f400	RW- IDATA
.rsrc	0x110000	0x4f0	0x600	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6901c	0xa0
RESOURCE	0x110000	0x4f0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x639b8	0x40
Bound_IAT	0	0
IAT	0x58000	0x344
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	280	1252
MANIFEST	#1	823	1252

module_name	hint	ord	function_name
KERNEL32.dll	1201		SizeofResource
KERNEL32.dll	130		CreateEventA
KERNEL32.dll	1355		lstrcpynW
KERNEL32.dll	490		GetFileAttributesW
KERNEL32.dll	532		GetModuleFileNameW
KERNEL32.dll	871		MultiByteToWideChar
KERNEL32.dll	1358		lstrlenW
KERNEL32.dll	1323		WritePrivateProfileStringW
KERNEL32.dll	645		GetTempPathW
KERNEL32.dll	945		RaiseException
KERNEL32.dll	893		OpenMutexW
KERNEL32.dll	514		GetLastError
KERNEL32.dll	581		GetProcAddress
KERNEL32.dll	892		OpenMutexA
KERNEL32.dll	836		LocalAlloc
KERNEL32.dll	852		LockResource
KERNEL32.dll	704		GlobalMemoryStatusEx
KERNEL32.dll	133		CreateEventW
KERNEL32.dll	1349		lstrcmpiW
KERNEL32.dll	155		CreateMutexA
KERNEL32.dll	885		OpenEventW
KERNEL32.dll	209		DeleteCriticalSection
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	1018		ReleaseMutex
KERNEL32.dll	462		GetDiskFreeSpaceExW
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	674		GetVersion
KERNEL32.dll	214		DeleteFileW
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	644		GetTempPathA
KERNEL32.dll	181		CreateThread
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	452		GetCurrentThread
KERNEL32.dll	515		GetLocalTime
KERNEL32.dll	840		LocalFree
KERNEL32.dll	357		FreeResource
KERNEL32.dll	1317		WriteFile
KERNEL32.dll	343		FlushFileBuffers
KERNEL32.dll	1202		Sleep
KERNEL32.dll	496		GetFileSize
KERNEL32.dll	1126		SetFilePointer
KERNEL32.dll	855		MapViewOfFile
KERNEL32.dll	1238		UnmapViewOfFile
KERNEL32.dll	1107		SetEndOfFile
KERNEL32.dll	1189		SetUnhandledExceptionFilter
KERNEL32.dll	1213		SystemTimeToFileTime
KERNEL32.dll	535		GetModuleHandleExW
KERNEL32.dll	1130		SetFileTime
KERNEL32.dll	479		GetExitCodeProcess
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	960		ReadFile
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	608		GetShortPathNameA
KERNEL32.dll	1139		SetLastError
KERNEL32.dll	524		GetLongPathNameA
KERNEL32.dll	698		GlobalFree
KERNEL32.dll	302		FindClose
KERNEL32.dll	1027		RemoveDirectoryW
KERNEL32.dll	631		GetSystemTime
KERNEL32.dll	487		GetFileAttributesExW
KERNEL32.dll	507		GetFullPathNameW
KERNEL32.dll	447		GetCurrentDirectoryW
KERNEL32.dll	476		GetEnvironmentVariableW
KERNEL32.dll	1260		VirtualFree
KERNEL32.dll	533		GetModuleHandleA
KERNEL32.dll	828		LoadLibraryA
KERNEL32.dll	745		InterlockedCompareExchange
KERNEL32.dll	1316		WriteConsoleW
KERNEL32.dll	1159		SetStdHandle
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	739		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1217		TerminateThread
KERNEL32.dll	624		GetSystemDirectoryW
KERNEL32.dll	578		GetPrivateProfileStringW
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	586		GetProcessHeap
KERNEL32.dll	659		GetTickCount
KERNEL32.dll	536		GetModuleHandleW
KERNEL32.dll	281		ExitProcess
KERNEL32.dll	1113		SetEvent
KERNEL32.dll	1273		WaitForSingleObject
KERNEL32.dll	129		CreateDirectoryW
KERNEL32.dll	719		HeapFree
KERNEL32.dll	747		InterlockedDecrement
KERNEL32.dll	864		MoveFileExW
KERNEL32.dll	751		InterlockedIncrement
KERNEL32.dll	830		LoadLibraryExW
KERNEL32.dll	715		HeapAlloc
KERNEL32.dll	833		LoadResource
KERNEL32.dll	354		FreeLibrary
KERNEL32.dll	334		FindResourceW
KERNEL32.dll	1112		SetErrorMode
KERNEL32.dll	333		FindResourceExW
KERNEL32.dll	158		CreateMutexW
KERNEL32.dll	722		HeapReAlloc
KERNEL32.dll	643		GetTempFileNameW
KERNEL32.dll	391		GetCommandLineW
KERNEL32.dll	906		OutputDebugStringW
KERNEL32.dll	1127		SetFilePointerEx
KERNEL32.dll	428		GetConsoleMode
KERNEL32.dll	410		GetConsoleCP
KERNEL32.dll	353		FreeEnvironmentStringsW
KERNEL32.dll	474		GetEnvironmentStringsW
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	531		GetModuleFileNameA
KERNEL32.dll	499		GetFileType
KERNEL32.dll	612		GetStdHandle
KERNEL32.dll	567		GetOEMCP
KERNEL32.dll	360		GetACP
KERNEL32.dll	778		IsValidCodePage
KERNEL32.dll	271		EnumSystemLocalesW
KERNEL32.dll	667		GetUserDefaultLCID
KERNEL32.dll	780		IsValidLocale
KERNEL32.dll	518		GetLocaleInfoW
KERNEL32.dll	813		LCMapStringW
KERNEL32.dll	611		GetStartupInfoW
KERNEL32.dll	238		EnterCriticalSection
KERNEL32.dll	825		LeaveCriticalSection
KERNEL32.dll	1297		WideCharToMultiByte
KERNEL32.dll	617		GetStringTypeW
KERNEL32.dll	718		HeapDestroy
KERNEL32.dll	724		HeapSize
KERNEL32.dll	768		IsDebuggerPresent
KERNEL32.dll	772		IsProcessorFeaturePresent
KERNEL32.dll	627		GetSystemInfo
KERNEL32.dll	1257		VirtualAlloc
KERNEL32.dll	1263		VirtualProtect
KERNEL32.dll	1265		VirtualQuery
KERNEL32.dll	390		GetCommandLineA
KERNEL32.dll	1048		RtlUnwind
KERNEL32.dll	370		GetCPInfo
KERNEL32.dll	1235		UnhandledExceptionFilter
KERNEL32.dll	1221		TlsAlloc
KERNEL32.dll	1223		TlsGetValue
KERNEL32.dll	1224		TlsSetValue
KERNEL32.dll	1222		TlsFree
USER32.dll	533		MessageBoxW
USER32.dll	460		IsDialogMessageA
USER32.dll	569		PostThreadMessageW
USER32.dll	526		MessageBoxA
USER32.dll	171		DialogBoxParamA
USER32.dll	175		DispatchMessageW
USER32.dll	566		PostMessageW
USER32.dll	356		GetParent
USER32.dll	242		EnumWindows
USER32.dll	291		GetDesktopWindow
USER32.dll	420		GetWindowThreadProcessId
USER32.dll	49		CharNextW
USER32.dll	540		MsgWaitForMultipleObjects
USER32.dll	172		DialogBoxParamW
USER32.dll	764		TranslateMessage
USER32.dll	654		SetDlgItemInt
USER32.dll	461		IsDialogMessageW
USER32.dll	563		PeekMessageW
ADVAPI32.dll	591		RegEnumKeyExW
ADVAPI32.dll	333		GetSecurityDescriptorSacl
ADVAPI32.dll	114		ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll	689		SetNamedSecurityInfoW
ADVAPI32.dll	310		GetLengthSid
ADVAPI32.dll	389		IsValidSecurityDescriptor
ADVAPI32.dll	288		FreeSid
ADVAPI32.dll	16		AddAccessAllowedAce
ADVAPI32.dll	696		SetSecurityDescriptorOwner
ADVAPI32.dll	374		InitializeAcl
ADVAPI32.dll	80		ChangeServiceConfigW
ADVAPI32.dll	223		DuplicateTokenEx
ADVAPI32.dll	346		GetTokenInformation
ADVAPI32.dll	507		OpenServiceW
ADVAPI32.dll	695		SetSecurityDescriptorGroup
ADVAPI32.dll	87		CloseServiceHandle
ADVAPI32.dll	638		RegSetValueExW
ADVAPI32.dll	560		RegCloseKey
ADVAPI32.dll	609		RegOpenKeyExW
ADVAPI32.dll	584		RegDeleteValueW
ADVAPI32.dll	694		SetSecurityDescriptorDacl
ADVAPI32.dll	580		RegDeleteKeyW
ADVAPI32.dll	375		InitializeSecurityDescriptor
ADVAPI32.dll	616		RegQueryInfoKeyW
ADVAPI32.dll	622		RegQueryValueExW
ADVAPI32.dll	569		RegCreateKeyExW
SHELL32.dll	6		CommandLineToArgvW
ole32.dll	104		CoTaskMemFree
ole32.dll	103		CoTaskMemAlloc
ole32.dll	63		CoInitializeEx
ole32.dll	105		CoTaskMemRealloc
ole32.dll	16		CoCreateInstance
OLEAUT32.dll		277
OLEAUT32.dll		6
OLEAUT32.dll		2
OLEAUT32.dll		9
OLEAUT32.dll		150
OLEAUT32.dll		4
OLEAUT32.dll		149
OLEAUT32.dll		12
OLEAUT32.dll		8
OLEAUT32.dll		7
SHLWAPI.dll	91		PathIsDirectoryW
SHLWAPI.dll	73		PathFindFileNameW
SHLWAPI.dll	139		PathRemoveFileSpecW
SHLWAPI.dll	69		PathFileExistsW
SHLWAPI.dll	58		PathCombineW
SHLWAPI.dll	50		PathAddExtensionW

VS_FIXEDFILEINFO

FileVersion	1.8.0.3445
ProductVersion	0.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	0
FileSubtype	0

show previews

offset	size	type	comment
0	1082880	EXE	06/16/2014 14:11:28	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VS_VERSIONINFO child type "V\x00e\x00r\x00"

PC_Booster.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

VS_FIXEDFILEINFO

PC_Booster.exe
-