system32_exe - Trojan.Packed-18

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	system32_exe
size	395966 (0x60abe)
md5	a793923d1eb9f2e5479adb9497e57fc2

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Trojan.Packed-18 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x472722aa
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.0
SizeOfCode	0
SizeOfInitializedData	0x61000
SizeOfUninitializedData	0xc9000
AddressOfEntryPoint	0xcbb23
BaseOfCode	0x1000
BaseOfData	0xca000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x12d000
SizeOfHeaders	0x400
CheckSum	0x6d592
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

NsPack v3.7 (North Star)

Sections

name	va	vsize	raw size	flags
.nsp0	0x1000	0xc9000	0	RW- IDATA SHARED
.nsp1	0xca000	0x61000	0x608be	RWX CODE IDATA
.nsp2	0x12b000	0x127e	0	RWX CODE IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xcba58	0x3c
RESOURCE	0xca000	0x1988
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xc6f54	8
DEBUG	0	0
ARCHITECTURE	0xad018	0xb
GLOBALPTR	0	0
TLS	0xcc429	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

TLS

raw start	raw end	index	callbks	zero fill	flags
0x4ac000	0x4ac014	0x4a30c4	0	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	PREVIEWGLYPH	232
ICON	#1	3240
DIALOG	DLGTEMPLATE	82
STRING	#4073	228
STRING	#4074	1004
STRING	#4075	888
STRING	#4076	952
STRING	#4077	676
STRING	#4078	876
STRING	#4079	516
STRING	#4080	456
STRING	#4081	232
STRING	#4082	992
STRING	#4083	468
STRING	#4084	220
STRING	#4085	304
STRING	#4086	616
STRING	#4087	1036
STRING	#4088	900
STRING	#4089	944
STRING	#4090	1048
STRING	#4091	312
STRING	#4092	236
STRING	#4093	552
STRING	#4094	952
STRING	#4095	908
STRING	#4096	708
RCDATA	DESCRIPTI0N	24
RCDATA	DVDLAL	16
RCDATA	PACKAGEINF0	1588
RCDATA	TMAINF0RMVER2	1238
RCDATA	WUWUWU	576
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	20

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			ExitProcess
SHELL32.DLL			ShellExecuteA

show previews

offset	size	type	comment
0	512	EXE	10/30/2007 12:25:14	#
15c1	15	HTM		#
15d0	390382	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xb9cbc

[?] can't find file_offset of VA 0xb9df0

[?] can't find file_offset of VA 0xb9f24

[?] can't find file_offset of VA 0xba058

[?] can't find file_offset of VA 0xba18c

[?] can't find file_offset of VA 0xba2c0

[?] can't find file_offset of VA 0xba3f4

[?] can't find file_offset of VA 0xba528

[?] can't find file_offset of VA 0xba6f8

[?] can't find file_offset of VA 0xba8dc

[?] can't find file_offset of VA 0xbaaac

[?] can't find file_offset of VA 0xbac7c

[?] can't find file_offset of VA 0xbae4c

[?] can't find file_offset of VA 0xbb01c

[?] can't find file_offset of VA 0xbb1ec

[?] can't find file_offset of VA 0xbb3bc

[?] can't find file_offset of VA 0xbb58c

[?] can't find file_offset of VA 0xbb75c

[?] can't find file_offset of VA 0xbc4ec

[?] can't find file_offset of VA 0xbc540

[?] can't find file_offset of VA 0xbc624

[?] can't find file_offset of VA 0xbca10

[?] can't find file_offset of VA 0xbcd88

[?] can't find file_offset of VA 0xbd140

[?] can't find file_offset of VA 0xbd3e4

[?] can't find file_offset of VA 0xbd750

[?] can't find file_offset of VA 0xbd954

[?] can't find file_offset of VA 0xbdb1c

[?] can't find file_offset of VA 0xbdc04

[?] can't find file_offset of VA 0xbdfe4

[?] can't find file_offset of VA 0xbe1b8

[?] can't find file_offset of VA 0xbe294

[?] can't find file_offset of VA 0xbe3c4

[?] can't find file_offset of VA 0xbe62c

[?] can't find file_offset of VA 0xbea38

[?] can't find file_offset of VA 0xbedbc

[?] can't find file_offset of VA 0xbf16c

[?] can't find file_offset of VA 0xbf584

[?] can't find file_offset of VA 0xbf6bc

[?] can't find file_offset of VA 0xbf7a8

[?] can't find file_offset of VA 0xbf9d0

[?] can't find file_offset of VA 0xbfd88

[?] can't find file_offset of VA 0xc0114

[?] can't find file_offset of VA 0xc03d8

[?] can't find file_offset of VA 0xc03f0

[?] can't find file_offset of VA 0xc0400

[?] can't find file_offset of VA 0xc0a34

[?] can't find file_offset of VA 0xc0f0c

[?] can't find file_offset of VA 0xc114c

[?] can't find file_offset of VA 0xc1160

[?] can't find file_offset of VA 0xc1174

[?] can't find file_offset of VA 0xc1188

[?] can't find file_offset of VA 0xc119c

[?] can't find file_offset of VA 0xc11b0

[?] can't find file_offset of VA 0xc11c4

[?] can't find file_offset of VA 0xa30c4

[?] can't find file_offset of VA 0xc6f54

[?] can't find file_offset of VA 0xad018

[?] can't find file_offset of VA 0x0

system32_exe- Trojan.Packed-18