filenamem4koRAT.exe
size396800 (0x60e00)
md5ad42fd76b7d2fe16a9a1ddaf2afe7894
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1473072916
257284272
199411181
2612842718
2602842710
259284273
257267159
10130
2602861054
258286101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5f368438
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.25
SizeOfCode0x3aa00
SizeOfInitializedData0x26000
SizeOfUninitializedData0
AddressOfEntryPoint0x1e82c
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x67000
SizeOfHeaders0x400
CheckSum0x6756a
Subsystem2
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x3a8880x3aa00R-X CODE
.rdata0x3c0000x22eea0x23000R-- IDATA
.data0x5f0000x2cd80x200RW- IDATA
.pdata0x620000x22a40x2400R-- IDATA
.rsrc0x650000x1b40x200R-- IDATA
.reloc0x660000x6600x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x5e4040xf0
RESOURCE0x650000x1b4
EXCEPTION0x620000x22a4
SECURITY00
BASERELOC0x660000x660
DEBUG0x5c6b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x5c6d00x130
Bound_IAT00
IAT0x3c0000x320
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13461252
module_namehintordfunction_name
WS2_32.dll164freeaddrinfo
WS2_32.dll165getaddrinfo
WS2_32.dll111
WS2_32.dll23
WS2_32.dll22
WS2_32.dll19
WS2_32.dll16
WS2_32.dll115
WS2_32.dll116
WS2_32.dll3
WS2_32.dll4
KERNEL32.dll1403SetUnhandledExceptionFilter
KERNEL32.dll1468UnhandledExceptionFilter
KERNEL32.dll1434TerminateProcess
KERNEL32.dll1242RtlLookupFunctionEntry
KERNEL32.dll1235RtlCaptureContext
KERNEL32.dll905IsProcessorFeaturePresent
KERNEL32.dll542GetCurrentProcessId
KERNEL32.dll546GetCurrentThreadId
KERNEL32.dll752GetSystemTimeAsFileTime
KERNEL32.dll876InitializeSListHead
KERNEL32.dll898IsDebuggerPresent
KERNEL32.dll727GetStartupInfoW
KERNEL32.dll638GetModuleHandleW
KERNEL32.dll1249RtlVirtualUnwind
KERNEL32.dll1143ReadFile
KERNEL32.dll1569WriteFile
KERNEL32.dll134CloseHandle
KERNEL32.dll1339SetHandleInformation
KERNEL32.dll615GetLastError
KERNEL32.dll221CreatePipe
KERNEL32.dll215CreateMutexA
KERNEL32.dll1419Sleep
KERNEL32.dll541GetCurrentProcess
KERNEL32.dll242CreateThread
KERNEL32.dll1435TerminateThread
KERNEL32.dll224CreateProcessA
KERNEL32.dll1499VirtualProtect
KERNEL32.dll633GetModuleFileNameA
KERNEL32.dll635GetModuleHandleA
KERNEL32.dll482GetComputerNameA
KERNEL32.dll1104QueryPerformanceCounter
ADVAPI32.dll210CryptGenRandom
ADVAPI32.dll220CryptReleaseContext
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll610RegCreateKeyA
ADVAPI32.dll616RegDeleteKeyA
ADVAPI32.dll651RegOpenKeyExA
ADVAPI32.dll680RegSetValueExA
ADVAPI32.dll193CryptAcquireContextA
VCRUNTIME140.dll60memcpy
VCRUNTIME140.dll59memcmp
VCRUNTIME140.dll61memmove
VCRUNTIME140.dll66strstr
VCRUNTIME140.dll8__C_specific_handler
VCRUNTIME140.dll27__current_exception
VCRUNTIME140.dll28__current_exception_context
VCRUNTIME140.dll29__intrinsic_setjmp
VCRUNTIME140.dll62memset
api-ms-win-crt-string-l1-1-0.dll137strcpy_s
api-ms-win-crt-string-l1-1-0.dll139strlen
api-ms-win-crt-string-l1-1-0.dll134strcmp
api-ms-win-crt-string-l1-1-0.dll133strcat_s
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll13__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-heap-l1-1-0.dll23calloc
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-time-l1-1-0.dll48_time64
api-ms-win-crt-time-l1-1-0.dll32_gmtime64_s
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll66_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll85exit
api-ms-win-crt-runtime-l1-1-0.dll35_exit
api-ms-win-crt-runtime-l1-1-0.dll43_get_narrow_winmain_command_line
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll64_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll60_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll30_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll103terminate
api-ms-win-crt-math-l1-1-0.dll9__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
offsetsizetypecomment
15c115HTM#
15d0391216BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK