Imprimir_DebitosVivo7894000014000.exe - Legacy.Trojan.Agent-1388588

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	Imprimir_DebitosVivo7894000014000.exe
size	776704 (0xbda00)
md5	a5d6941cfae6990ffd9112f5efa4a76b

type	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
mimetype	application/x-dosexec

clamav	Legacy.Trojan.Agent-1388588 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x577b8434
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x222a00
SizeOfInitializedData	0x5e600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x224000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x298000
SizeOfHeaders	0x400
CheckSum	0xc1e95
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

PeCompact 2.xx (BitSum Technologies / v2.0)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x28c000	0xb2e00	RWX CODE
.rsrc	0x28d000	0xb000	0xa800	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x296594	0x3d5
RESOURCE	0x28d000	0x92ce
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x297624	0x60
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x23d000	0x326
CLR_Header	0	0

TLS

raw start	raw end	index	callbks
0x697644	0x697684	0x69763c	0x697640
0	0	0	0
0	0	0	0
0	0	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	CDROM	192
BITMAP	CLOSEDFOLDER	224
BITMAP	CURRENTFOLDER	224
BITMAP	EXECUTABLE	224
BITMAP	FLOPPY	192
BITMAP	HARD	192
BITMAP	KNOWNFILE	224
BITMAP	NETWORK	192
BITMAP	OPENFOLDER	224
BITMAP	PREVIEWGLYPH	232
BITMAP	RAM	192
BITMAP	TBUTTONCOLOR	1640
BITMAP	TBUTTONGRADIENT	1640
BITMAP	TBUTTONPEN	1640
BITMAP	TCOMBOFLAT	1640
BITMAP	TEEARROWDOWN	272
BITMAP	TEEARROWUP	272
BITMAP	TTEEINSPECTOR	1640
BITMAP	TTEEPREVIEWPANEL	1640
BITMAP	UNKNOWNFILE	224
ICON	#1	1128
ICON	#2	4264
ICON	#3	9640
ICON	#4	16936
DIALOG	DLGTEMPLATE	82
DIALOG	TEXTFILEDLG	82
STRING	#4066	416
STRING	#4067	1264
STRING	#4068	1120
STRING	#4069	1064
STRING	#4070	1040
STRING	#4071	740
STRING	#4072	836
STRING	#4073	1036
STRING	#4074	992
STRING	#4075	904
STRING	#4076	868
STRING	#4077	932
STRING	#4078	772
STRING	#4079	1072
STRING	#4080	212
STRING	#4081	204
STRING	#4082	296
STRING	#4083	848
STRING	#4084	1036
STRING	#4085	932
STRING	#4086	1384
STRING	#4087	1076
STRING	#4088	916
STRING	#4089	1024
STRING	#4090	660
STRING	#4091	192
STRING	#4092	156
STRING	#4093	868
STRING	#4094	1244
STRING	#4095	784
STRING	#4096	724
RCDATA	CHARTABLE	33512
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	2700
RCDATA	TMISTICO	703
RCDATA	TPENDIALOG	1860
RCDATA	TTEEGRADIENTEDITOR	4473
GROUP_CURSOR	TEE_CURSOR_HAND	20
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	62

module_name	hint	ord	function_name
kernel32.dll			LoadLibraryA
kernel32.dll			GetProcAddress
kernel32.dll			VirtualAlloc
kernel32.dll			VirtualFree
oleaut32.dll			SysFreeString
advapi32.dll			RegQueryValueExW
user32.dll			LoadStringW
msimg32.dll			AlphaBlend
gdi32.dll			WidenPath
version.dll			VerQueryValueW
ole32.dll			OleUninitialize
comctl32.dll			InitializeFlatSB
wininet.dll			InternetOpenUrlW
comdlg32.dll			PrintDlgW
winspool.drv			OpenPrinterW
SHFolder.dll			SHGetFolderPathW
wsock32.dll			WSACleanup
shell32.dll			ShellExecuteW

show previews

offset	size	type	comment
0	776704	EXE	07/05/2016 09:56:04	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x26e000

[?] can't find file_offset of VA 0x26e138

[?] can't find file_offset of VA 0x26e270

[?] can't find file_offset of VA 0x26e3a8

[?] can't find file_offset of VA 0x26e4e0

[?] can't find file_offset of VA 0x26e618

[?] can't find file_offset of VA 0x26e750

[?] can't find file_offset of VA 0x26e888

[?] can't find file_offset of VA 0x26e9c0

[?] can't find file_offset of VA 0x26eb90

[?] can't find file_offset of VA 0x26ed78

[?] can't find file_offset of VA 0x26ef48

[?] can't find file_offset of VA 0x26f118

[?] can't find file_offset of VA 0x26f2e8

[?] can't find file_offset of VA 0x26f4b8

[?] can't find file_offset of VA 0x26f688

[?] can't find file_offset of VA 0x26f858

[?] can't find file_offset of VA 0x26fa28

[?] can't find file_offset of VA 0x26fbf8

[?] can't find file_offset of VA 0x26fcb8

[?] can't find file_offset of VA 0x26fd98

[?] can't find file_offset of VA 0x26fe78

[?] can't find file_offset of VA 0x26ff58

[?] can't find file_offset of VA 0x270018

[?] can't find file_offset of VA 0x2700d8

[?] can't find file_offset of VA 0x2701b8

[?] can't find file_offset of VA 0x270278

[?] can't find file_offset of VA 0x270358

[?] can't find file_offset of VA 0x270440

[?] can't find file_offset of VA 0x270500

[?] can't find file_offset of VA 0x270b68

[?] can't find file_offset of VA 0x2711d0

[?] can't find file_offset of VA 0x271838

[?] can't find file_offset of VA 0x271ea0

[?] can't find file_offset of VA 0x271fb0

[?] can't find file_offset of VA 0x2720c0

[?] can't find file_offset of VA 0x272728

[?] can't find file_offset of VA 0x272d90

[?] can't find file_offset of VA 0x272e70

[?] can't find file_offset of VA 0x272ec8

[?] can't find file_offset of VA 0x272f20

[?] can't find file_offset of VA 0x2730c0

[?] can't find file_offset of VA 0x2735b0

[?] can't find file_offset of VA 0x273a10

[?] can't find file_offset of VA 0x273e38

[?] can't find file_offset of VA 0x274248

[?] can't find file_offset of VA 0x274530

[?] can't find file_offset of VA 0x274878

[?] can't find file_offset of VA 0x274c88

[?] can't find file_offset of VA 0x275068

[?] can't find file_offset of VA 0x2753f0

[?] can't find file_offset of VA 0x275758

[?] can't find file_offset of VA 0x275b00

[?] can't find file_offset of VA 0x275e08

[?] can't find file_offset of VA 0x276238

[?] can't find file_offset of VA 0x276310

[?] can't find file_offset of VA 0x2763e0

[?] can't find file_offset of VA 0x276508

[?] can't find file_offset of VA 0x276858

[?] can't find file_offset of VA 0x276c68

[?] can't find file_offset of VA 0x277010

[?] can't find file_offset of VA 0x277578

[?] can't find file_offset of VA 0x2779b0

[?] can't find file_offset of VA 0x277d48

[?] can't find file_offset of VA 0x278148

[?] can't find file_offset of VA 0x2783e0

[?] can't find file_offset of VA 0x2784a0

[?] can't find file_offset of VA 0x278540

[?] can't find file_offset of VA 0x2788a8

[?] can't find file_offset of VA 0x278d88

[?] can't find file_offset of VA 0x279098

[?] can't find file_offset of VA 0x279370

[?] can't find file_offset of VA 0x281658

[?] can't find file_offset of VA 0x281668

[?] can't find file_offset of VA 0x2820f8

[?] can't find file_offset of VA 0x2823b8

[?] can't find file_offset of VA 0x282b00

[?] can't find file_offset of VA 0x283c80

[?] can't find file_offset of VA 0x283c98

[?] can't find file_offset of VA 0x283cb0

[?] can't find file_offset of VA 0x283cc8

[?] can't find file_offset of VA 0x283ce0

[?] can't find file_offset of VA 0x283cf8

[?] can't find file_offset of VA 0x283d10

[?] can't find file_offset of VA 0x283d28

[?] can't find file_offset of VA 0x23d000

Imprimir_DebitosVivo7894000014000.exe- Legacy.Trojan.Agent-1388588