filename1.exe
size214016 (0x34400)
md5bad5f5df38584696cc55fc0fd460e5cf
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWIN.Trojan.Agent-8792 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 23 4f 7a f3 67 30 1c a6  67 30 1c a6 67 30 1c a6  |#Oz.g0..g0..g0..|
00000050: 67 30 1b a6 63 30 1c a6  70 58 8d a6 66 30 1c a6  |g0..c0..pX..f0..|
00000060: 82 b3 b9 a6 6e 30 1c a6  82 b3 86 a6 68 30 1c a6  |....n0......h0..|
00000070: 82 b3 87 a6 68 30 1c a6  55 6c 66 6b 67 30 1c a6  |....h0..Ulfkg0..|
00000080: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x4d2fd181
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x29000
SizeOfInitializedData0
SizeOfUninitializedData0
AddressOfEntryPoint0x8354
BaseOfCode0x1000
BaseOfData0x42000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x4e000
SizeOfHeaders0x400
CheckSum0x386eb
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x40bf10x29000RWX CODE DISCARDABLE
.idata0x420000x190c0x1a00R-- IDATA
.rdata0x440000x94660x9600RW- IDATA

Data Directory

typevasize
EXPORT0x438ac0x60
IMPORT0x4240c0x64
RESOURCE0x109d20x11867
EXCEPTION00
SECURITY00
BASERELOC0x257f90x73c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x420000x40c
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
GDI32.dll359GetObjectA
GDI32.dll524TextOutW
GDI32.dll179DeleteDC
GDI32.dll192EndPath
GDI32.dll199EnumFontsW
GDI32.dll320GetDIBits
GDI32.dll462SelectObject
GDI32.dll136CreateBitmapIndirect
GDI32.dll190EndDoc
GDI32.dll129CombineRgn
GDI32.dll158CreateFontW
GDI32.dll212ExtTextOutA
GDI32.dll213ExtTextOutW
GDI32.dll488SetMapMode
GDI32.dll377GetSystemPaletteEntries
GDI32.dll171CreateRectRgn
GDI32.dll162CreateICW
GDI32.dll147CreateDIBitmap
GDI32.dll314GetCurrentObject
GDI32.dll154CreateFontIndirectA
GDI32.dll513SetWindowOrgEx
GDI32.dll468SetBkColor
GDI32.dll146CreateDIBSection
GDI32.dll532WidenPath
GDI32.dll476SetDIBColorTable
GDI32.dll382GetTextCharsetInfo
GDI32.dll420PatBlt
GDI32.dll438PtInRegion
GDI32.dll523TextOutA
GDI32.dll449RemoveFontResourceW
GDI32.dll176CreateSolidBrush
GDI32.dll486SetLayout
GDI32.dll471SetBrushOrgEx
GDI32.dll428PolyBezier
GDI32.dll289GetBitmapBits
GDI32.dll441RectInRegion
GDI32.dll117BeginPath
GDI32.dll148CreateDiscardableBitmap
GDI32.dll417OffsetViewportOrgEx
GDI32.dll358GetNearestPaletteIndex
GDI32.dll7AddFontResourceW
GDI32.dll188Ellipse
GDI32.dll517StartPage
GDI32.dll160CreateHatchBrush
GDI32.dll166CreatePatternBrush
GDI32.dll467SetBitmapDimensionEx
GDI32.dll310GetClipBox
GDI32.dll460SelectClipRgn
USER32.dll553SendMessageTimeoutA
USER32.dll89CreateDialogParamW
USER32.dll689VkKeyScanW
USER32.dll272GetDlgItemInt
USER32.dll143DefWindowProcW
USER32.dll183DrawStateA
USER32.dll431LoadIconA
USER32.dll74CopyAcceleratorTableW
USER32.dll531RegisterWindowMessageW
USER32.dll273GetDlgItemTextA
USER32.dll414IsRectEmpty
USER32.dll309GetMenuItemInfoW
USER32.dll484OffsetRect
USER32.dll147DestroyAcceleratorTable
USER32.dll494PeekMessageA
USER32.dll345GetSysColor
USER32.dll530RegisterWindowMessageA
USER32.dll635ShowCursor
USER32.dll185DrawTextA
USER32.dll175DrawEdge
USER32.dll11AttachThreadInput
USER32.dll224FillRect
USER32.dll426LoadBitmapW
USER32.dll645SystemParametersInfoA
USER32.dll55CharUpperBuffA
USER32.dll543ScrollWindow
USER32.dll570SetCursorPos
USER32.dll145DeleteMenu
USER32.dll226FindWindowExA
USER32.dll99CreateWindowExW
USER32.dll195EndDialog
USER32.dll488OpenIcon
USER32.dll667UnloadKeyboardLayout
USER32.dll136DefDlgProcW
USER32.dll357GetUserObjectInformationA
USER32.dll53CharToOemW
USER32.dll10ArrangeIconicWindows
USER32.dll456MapVirtualKeyW
USER32.dll51CharToOemBuffA
USER32.dll555SendMessageW
USER32.dll45CharNextW
USER32.dll549SendInput
USER32.dll418IsWindowUnicode
USER32.dll578SetForegroundWindow
USER32.dll404IsChild
USER32.dll399IsCharAlphaW
USER32.dll444LoadStringW
USER32.dll554SendMessageTimeoutW
USER32.dll564SetClassLongW
USER32.dll54CharUpperA
USER32.dll513RedrawWindow
USER32.dll627SetWindowTextA
USER32.dll365GetWindowLongW
USER32.dll545SendDlgItemMessageA
USER32.dll248GetClassLongA
USER32.dll600SetRect
USER32.dll181DrawMenuBar
USER32.dll178DrawFrameControl
USER32.dll385InSendMessageEx
USER32.dll151DestroyMenu
USER32.dll68ClipCursor
USER32.dll360GetWindow
USER32.dll636ShowOwnedPopups
USER32.dll500PostThreadMessageA
USER32.dll312GetMenuStringA
USER32.dll179DrawIcon
USER32.dll184DrawStateW
USER32.dll408IsDialogMessageW
USER32.dll27CallWindowProcW
USER32.dll198EndTask
USER32.dll60CheckMenuRadioItem
USER32.dll240GetAsyncKeyState
USER32.dll160DispatchMessageW
USER32.dll704wsprintfW
USER32.dll228FindWindowW
USER32.dll362GetWindowDC
USER32.dll82CreateCursor
USER32.dll197EndPaint
USER32.dll702mouse_event
USER32.dll402IsCharUpperA
USER32.dll384InSendMessage
USER32.dll323GetNextDlgTabItem
USER32.dll231FrameRect
USER32.dll497PostMessageA
USER32.dll395InvertRect
USER32.dll307GetMenuItemID
USER32.dll138DefFrameProcW
USER32.dll473MonitorFromRect
USER32.dll244GetClassInfoA
USER32.dll391InternalGetWindowText
USER32.dll277GetForegroundWindow
USER32.dll637ShowScrollBar
USER32.dll628SetWindowTextW
USER32.dll469MessageBoxW
USER32.dll700WindowFromPoint
USER32.dll246GetClassInfoExW
USER32.dll8AppendMenuA
USER32.dll199EnumChildWindows
USER32.dll392IntersectRect
USER32.dll557SendNotifyMessageW
USER32.dll413IsMenu
USER32.dll356GetUpdateRgn
USER32.dll701keybd_event
USER32.dll243GetCaretPos
USER32.dll522RegisterHotKey
USER32.dll249GetClassLongW
USER32.dll501PostThreadMessageW
USER32.dll233GetActiveWindow
USER32.dll346GetSysColorBrush
USER32.dll188DrawTextW
USER32.dll650TileWindows
MSVCRT.dll1036towupper
MSVCRT.dll1023swprintf
MSVCRT.dll873fclose
MSVCRT.dll963perror
MSVCRT.dll923isprint
MSVCRT.dll922islower
MSVCRT.dll857atoi
MSVCRT.dll1073wcsstr
MSVCRT.dll993sscanf
MSVCRT.dll245_controlfp
MSVCRT.dll1014strrchr
MSVCRT.dll1046vsprintf
MSVCRT.dll877fgetc
MSVCRT.dll1061wcslen
MSVCRT.dll893free
MSVCRT.dll1034toupper
MSVCRT.dll985setvbuf
MSVCRT.dll864clock
MSVCRT.dll935iswprint
MSVCRT.dll179__set_app_type
MSVCRT.dll160__p__fmode
MSVCRT.dll882floor
MSVCRT.dll1069wcsrchr
MSVCRT.dll155__p__commode
MSVCRT.dll909getenv
MSVCRT.dll984setlocale
MSVCRT.dll1010strncpy
MSVCRT.dll1057wcscpy
MSVCRT.dll1018strtok
MSVCRT.dll997strchr
MSVCRT.dll219_amsg_exit
MSVCRT.dll1056wcscoll
MSVCRT.dll390_initterm
MSVCRT.dll999strcoll
MSVCRT.dll414_ismbblead
MSVCRT.dll82_XcptFilter
MSVCRT.dll291_exit
MSVCRT.dll1037ungetc
MSVCRT.dll968putchar
MSVCRT.dll232_cexit
MSVCRT.dll181__setusermatherr
MSVCRT.dll859bsearch
MSVCRT.dll1021strtoul
MSVCRT.dll114__getmainargs
KERNEL32.dll793LockResource
KERNEL32.dll1057SetLastError
KERNEL32.dll1117TlsFree
KERNEL32.dll254DefineDosDeviceW
KERNEL32.dll988SearchPathW
KERNEL32.dll1218lstrcmpA
KERNEL32.dll944ReleaseSemaphore
KERNEL32.dll1100SizeofResource
KERNEL32.dll731IsValidLocale
KERNEL32.dll349FindFirstFileA
KERNEL32.dll600GetSystemWindowsDirectoryA
KERNEL32.dll379FoldStringW
KERNEL32.dll856MapViewOfFileEx
KERNEL32.dll593GetSystemInfo
KERNEL32.dll600GetProfileIntA
KERNEL32.dll1230lstrlenA
KERNEL32.dll947RemoveDirectoryA
KERNEL32.dll857PulseEvent
KERNEL32.dll656GlobalFree
KERNEL32.dll663GlobalReAlloc
KERNEL32.dll348FindFirstChangeNotificationW
KERNEL32.dll1215lstrcatA
KERNEL32.dll234CreateSemaphoreW
KERNEL32.dll386FreeLibrary
KERNEL32.dll963RtlUnwind
KERNEL32.dll162CallNamedPipeW
KERNEL32.dll1088SetTimerQueueTimer
KERNEL32.dll657GlobalGetAtomNameA
KERNEL32.dll202CreateEventA
KERNEL32.dll1045SetFileApisToOEM
KERNEL32.dll625GetTimeZoneInformation
KERNEL32.dll231CreateSemaphoreA
KERNEL32.dll836OpenSemaphoreW
KERNEL32.dll683HeapReAlloc
KERNEL32.dll870QueryPerformanceCounter
KERNEL32.dll490GetFileAttributesExA
KERNEL32.dll525GetModuleHandleW
KERNEL32.dll1219lstrcmpW
KERNEL32.dll621GetTickCount
KERNEL32.dll628GetUserDefaultLangID
KERNEL32.dll810MoveFileA
KERNEL32.dll230CreateRemoteThread
KERNEL32.dll607GetTempFileNameA
KERNEL32.dll181ConnectNamedPipe
KERNEL32.dll499GetFullPathNameW
KERNEL32.dll1101Sleep
KERNEL32.dll647GlobalAddAtomA
KERNEL32.dll778LoadResource
KERNEL32.dll492GetFileAttributesW
KERNEL32.dll209CreateFileMappingA
KERNEL32.dll275EnterCriticalSection
KERNEL32.dll581GetStartupInfoW
ordentry_vafunction_name
10x2c2b?SendPointerW@@YGIPAKGPAHF<V
module_nameglSUplHpvrzY.yut
flags0
timestamp2011-01-14 04:30:57
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x438d8
Functions(1)0x438d4
NameOrdinals(1)0x438dc
offsetsizetypecomment
0214016EXE01/14/2011 04:30:57#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find resource section for va=0x109d2