parentlsass.exe.1e498c8.0x00080000-0x000f9fff.dmp
filenamelsass.exe.1e498c8.0x00080000-0x000f9fff.unpacked.dmp
size1235456 (0x12da00)
md5a1c9ca3063b041ca598c6290a802fe4b
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Stuxnet-2 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
109507272
1322102211
1492102221
131210226
1323072934
149307292
1313072992
1235072733
10309
13830729222
146307291
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x4b8b56a3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2d02
Magic0x10b
LinkerVersion9.0
SizeOfCode0x53a00
SizeOfInitializedData0xd9600
SizeOfUninitializedData0
AddressOfEntryPoint0x42aa6
BaseOfCode0x1000
BaseOfData0x55000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x131000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x5391d0x53a00R-X CODE
.rdata0x550000x11a3c0x11c00RWX IDATA
.data0x670000x3da00x3400RW- IDATA
.xdata0x6b0000x113e40x11400R-- IDATA
.cdata0x7d0000x7440x800RW- IDATA
.rsrc0x7e0000xa8fa40xa9000R-- IDATA
.reloc0x1270000x99480x9a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x554f00xaa
IMPORT0x651980x154
RESOURCE0x7e0000xa8fa4
EXCEPTION00
SECURITY00
BASERELOC0x1270000x62d4
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x642800x40
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
RCDATA#201266161252
RCDATA#202148481252
RCDATA#20352371252
RCDATA#2054331252
RCDATA#2082980001252
RCDATA#209251252
RCDATA#21097281252
RCDATA#2211459201252
RCDATA#2221024001252
RCDATA#24041711252
RCDATA#241257201252
RCDATA#242174001252
RCDATA#250409601252
module_namehintordfunction_name
KERNEL32.DLLTerminateProcess
KERNEL32.DLLlstrcmpA
KERNEL32.DLLReadProcessMemory
KERNEL32.DLLlstrcpyA
KERNEL32.DLLExpandEnvironmentStringsW
KERNEL32.DLLCreateToolhelp32Snapshot
KERNEL32.DLLProcess32FirstW
KERNEL32.DLLProcess32NextW
KERNEL32.DLLFindFirstFileW
KERNEL32.DLLFindNextFileW
KERNEL32.DLLlstrcpyW
KERNEL32.DLLOpenProcess
KERNEL32.DLLlstrlenW
KERNEL32.DLLGetProcAddress
KERNEL32.DLLWriteProcessMemory
KERNEL32.DLLCreateMutexW
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLVirtualFree
KERNEL32.DLLCreateFileW
KERNEL32.DLLGetFileSize
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLReadFile
KERNEL32.DLLVirtualQuery
KERNEL32.DLLVirtualProtect
KERNEL32.DLLResumeThread
KERNEL32.DLLGetFileAttributesW
KERNEL32.DLLGetSystemDirectoryW
KERNEL32.DLLlstrcatW
KERNEL32.DLLSetEvent
KERNEL32.DLLCloseHandle
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLlstrcmpiW
KERNEL32.DLLFreeLibraryAndExitThread
KERNEL32.DLLCreateProcessW
KERNEL32.DLLReleaseMutex
KERNEL32.DLLSetFilePointer
KERNEL32.DLLSleep
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLInterlockedDecrement
KERNEL32.DLLInterlockedIncrement
KERNEL32.DLLIsBadReadPtr
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLGetStringTypeW
KERNEL32.DLLGetStringTypeA
KERNEL32.DLLGetCPInfo
KERNEL32.DLLInitializeCriticalSectionAndSpinCount
KERNEL32.DLLInterlockedExchange
KERNEL32.DLLRtlUnwind
KERNEL32.DLLGetLocaleInfoA
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLCreateEventW
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLSetFileAttributesW
KERNEL32.DLLSetFileTime
KERNEL32.DLLGetFileTime
KERNEL32.DLLGetLastError
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLGetVersionExW
KERNEL32.DLLGetTickCount
KERNEL32.DLLFreeLibrary
KERNEL32.DLLGetACP
KERNEL32.DLLGetDriveTypeW
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLGetLogicalDrives
KERNEL32.DLLGetCurrentThread
KERNEL32.DLLSetThreadPriority
KERNEL32.DLLlstrcpynW
KERNEL32.DLLWaitForMultipleObjects
KERNEL32.DLLTerminateThread
KERNEL32.DLLSetErrorMode
KERNEL32.DLLDeleteFileW
KERNEL32.DLLFindClose
KERNEL32.DLLSetEndOfFile
KERNEL32.DLLSetFilePointerEx
KERNEL32.DLLWriteFile
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLGetFileSizeEx
KERNEL32.DLLGetFileAttributesExW
KERNEL32.DLLGetTempFileNameW
KERNEL32.DLLOpenMutexW
KERNEL32.DLLSetLastError
KERNEL32.DLLCreateMutexA
KERNEL32.DLLDuplicateHandle
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLResetEvent
KERNEL32.DLLSuspendThread
KERNEL32.DLLGetTempPathW
KERNEL32.DLLGetWindowsDirectoryW
KERNEL32.DLLMoveFileExW
KERNEL32.DLLCopyFileW
KERNEL32.DLLMoveFileW
KERNEL32.DLLDosDateTimeToFileTime
KERNEL32.DLLFileTimeToLocalFileTime
KERNEL32.DLLGetComputerNameW
KERNEL32.DLLReplaceFileW
KERNEL32.DLLLoadLibraryExW
KERNEL32.DLLGetDiskFreeSpaceExW
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLCreateFileMappingW
KERNEL32.DLLOpenFileMappingW
KERNEL32.DLLGetExitCodeProcess
KERNEL32.DLLFindResourceExW
KERNEL32.DLLLoadResource
KERNEL32.DLLSizeofResource
KERNEL32.DLLLockResource
KERNEL32.DLLCreateFileA
KERNEL32.DLLlstrcmpiA
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLRaiseException
KERNEL32.DLLExitThread
KERNEL32.DLLCreateThread
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLTlsGetValue
KERNEL32.DLLTlsAlloc
KERNEL32.DLLTlsSetValue
KERNEL32.DLLTlsFree
KERNEL32.DLLHeapSize
KERNEL32.DLLExitProcess
KERNEL32.DLLSetHandleCount
KERNEL32.DLLGetStdHandle
KERNEL32.DLLGetFileType
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLFreeEnvironmentStringsA
KERNEL32.DLLGetEnvironmentStrings
KERNEL32.DLLFreeEnvironmentStringsW
KERNEL32.DLLGetEnvironmentStringsW
KERNEL32.DLLHeapCreate
KERNEL32.DLLHeapDestroy
KERNEL32.DLLLCMapStringA
KERNEL32.DLLLCMapStringW
KERNEL32.DLLLeaveCriticalSection
ADVAPI32.dllRevertToSelf
ADVAPI32.dllQueryServiceStatusEx
ADVAPI32.dllLookupAccountSidW
ADVAPI32.dllFreeSid
ADVAPI32.dllGetTokenInformation
ADVAPI32.dllOpenThreadToken
ADVAPI32.dllLookupPrivilegeValueW
ADVAPI32.dllImpersonateLoggedOnUser
ADVAPI32.dllAdjustTokenPrivileges
ADVAPI32.dllEqualSid
ADVAPI32.dllInitializeSecurityDescriptor
ADVAPI32.dllSetSecurityDescriptorDacl
ADVAPI32.dllAllocateAndInitializeSid
ADVAPI32.dllConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dllGetSecurityDescriptorSacl
ADVAPI32.dllSetSecurityDescriptorSacl
ADVAPI32.dllRegEnumValueW
ADVAPI32.dllRegEnumKeyExW
ADVAPI32.dllRegCreateKeyExW
ADVAPI32.dllRegQueryInfoKeyW
ADVAPI32.dllRegDeleteValueW
ADVAPI32.dllRegSetValueExW
ADVAPI32.dllGetUserNameW
ADVAPI32.dllCloseServiceHandle
ADVAPI32.dllDeleteService
ADVAPI32.dllOpenSCManagerW
ADVAPI32.dllOpenServiceW
ADVAPI32.dllDuplicateTokenEx
ADVAPI32.dllCreateProcessAsUserW
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllRegQueryValueExW
ADVAPI32.dllRegCloseKey
ADVAPI32.dllControlService
ADVAPI32.dllOpenProcessToken
ADVAPI32.dllImpersonateAnonymousToken
DNSAPI.dllDnsRecordListFree
DNSAPI.dllDnsQuery_W
IPHLPAPI.DLLNotifyAddrChange
IPHLPAPI.DLLGetTcpTable
NETAPI32.dllNetScheduleJobGetInfo
NETAPI32.dllNetGetJoinInformation
NETAPI32.dllNetUseDel
NETAPI32.dllNetUseAdd
NETAPI32.dllNetShareGetInfo
NETAPI32.dllNetScheduleJobDel
NETAPI32.dllNetScheduleJobEnum
NETAPI32.dllNetScheduleJobAdd
NETAPI32.dllNetRemoteTOD
NETAPI32.dllNetUserEnum
NETAPI32.dllNetGetDCName
NETAPI32.dllNetApiBufferFree
NETAPI32.dllNetServerEnum
ole32.dllCoSetProxyBlanket
ole32.dllCoInitializeSecurity
ole32.dllCoUninitialize
ole32.dllCoInitializeEx
ole32.dllStgOpenStorage
ole32.dllCoCreateGuid
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll4
OLEAUT32.dll2
OLEAUT32.dll6
PSAPI.DLLGetModuleFileNameExW
PSAPI.DLLGetModuleBaseNameW
PSAPI.DLLEnumProcesses
PSAPI.DLLEnumProcessModules
PSAPI.DLLGetMappedFileNameW
RPCRT4.dllRpcBindingFromStringBindingW
RPCRT4.dllNdrClientCall2
RPCRT4.dllNdrServerCall2
RPCRT4.dllRpcEpUnregister
RPCRT4.dllRpcServerUseProtseqEpW
RPCRT4.dllRpcBindingFree
RPCRT4.dllRpcMgmtEpEltInqDone
RPCRT4.dllRpcStringFreeW
RPCRT4.dllRpcMgmtEpEltInqNextW
RPCRT4.dllRpcMgmtEpEltInqBegin
RPCRT4.dllRpcServerRegisterIf
RPCRT4.dllRpcServerInqBindings
RPCRT4.dllRpcServerListen
RPCRT4.dllRpcEpRegisterW
RPCRT4.dllRpcMgmtStopServerListening
RPCRT4.dllRpcServerRegisterIf2
RPCRT4.dllRpcStringBindingParseW
RPCRT4.dllRpcServerUnregisterIf
RPCRT4.dllRpcBindingToStringBindingW
SHELL32.dllSHGetFolderPathW
SHLWAPI.dllStrStrIW
SHLWAPI.dllSHDeleteKeyW
SHLWAPI.dllPathIsUNCW
USER32.dllSetWindowsHookExW
USER32.dllUnhookWindowsHookEx
USER32.dllCallNextHookEx
USER32.dllwsprintfW
USER32.dllDestroyWindow
USER32.dllDispatchMessageW
USER32.dllSetWindowLongW
USER32.dllUnregisterClassW
USER32.dllDefWindowProcW
USER32.dllTranslateMessage
USER32.dllPostMessageW
USER32.dllGetMessageW
USER32.dllwvsprintfA
USER32.dllwvsprintfW
USER32.dllRegisterClassW
USER32.dllCreateWindowExW
USERENV.dllCreateEnvironmentBlock
USERENV.dllDestroyEnvironmentBlock
VERSION.dllGetFileVersionInfoW
VERSION.dllVerQueryValueW
WININET.dllInternetReadFile
WININET.dllInternetOpenUrlW
WININET.dllInternetOpenW
WININET.dllHttpQueryInfoW
WININET.dllInternetCloseHandle
WSOCK32.dll15
WSOCK32.dll52
WSOCK32.dll115
ordentry_vafunction_name
10x19d5
20x1ac6
40x4a3d
50x265f
60x1b7e
70x1c10
90x27c8
100x2af6
140x2166
150x2735
160x2ca9
170x2dfb
180x4ada
190x2353
220x1c15
240x3579
270x1ca2
280x3602
290x368b
310x2926
320x1a4e
module_name.
flags0
timestamp2010-03-01 05:54:37
version0.0
ordinal_base1
nFunctions32
nNames0
Names(0)0x55598
Functions(32)0x55518
NameOrdinals(0)0x55598
offsetsizetypecomment
01233920DLL03/01/2010 05:54:43#
15c115HTM#
12d4001536BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 1235456 bytes (1207 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK