filenameBatchWM_V4.1.0.50.exe
size4343296 (0x424600)
md5c5aec5c966f4dcd74c7012db07210817
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-373312 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0x4ad72e5e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x818f
Magic0x10b
LinkerVersion2.25
SizeOfCode0x3e00
SizeOfInitializedData0x420400
SizeOfUninitializedData0
AddressOfEntryPoint0x50ac
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x42e000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Borland Delphi v6.0 - v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x37680x3800R-X CODE
.itext0x50000x4880x600R-X CODE
.data0x60000x7940x800RW- IDATA
.bss0x70000x29fc0RW-
.idata0xa0000x67e0x800RW- IDATA
.tls0xb00080RW-
.rdata0xc0000x180x200R-- IDATA
.reloc0xd0000x3f00R-- IDATA DISCARDABLE
.rsrc0xe0000x41f1ec0x41f200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xa0000x67e
RESOURCE0xe0000x41f1ec
EXCEPTION00
SECURITY00
BASERELOC0xd0000
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xc0000x18
LOAD_CONFIG00
Bound_IAT00
IAT0xa1880xfc
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x40b0000x40b0080x4067740x40c01000
typenamesizecp
ICON#137521252
ICON#222161252
ICON#313841252
STRING#40964121252
RCDATADATA3881252
RCDATAMSI43130881252
GROUP_ICONMAINICON481252
idlangstring
655200MSI
655210DATA
655220This application created with UNREGISTERED VERSION of MSI to EXE Compiler. Please register your copy to remove this window. Visit http://www.msitoexe.com for more info.
655230Demo Version
module_namehintordfunction_name
advapi32.dllRegQueryValueExA
advapi32.dllRegOpenKeyExA
advapi32.dllRegCloseKey
user32.dllGetKeyboardType
user32.dllDestroyWindow
user32.dllLoadStringA
user32.dllMessageBoxA
user32.dllCharNextA
kernel32.dllGetACP
kernel32.dllSleep
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dllGetCurrentThreadId
kernel32.dllVirtualQuery
kernel32.dlllstrlenA
kernel32.dlllstrcpynA
kernel32.dllLoadLibraryExA
kernel32.dllGetThreadLocale
kernel32.dllGetStartupInfoA
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleA
kernel32.dllGetModuleFileNameA
kernel32.dllGetLocaleInfoA
kernel32.dllGetCommandLineA
kernel32.dllFreeLibrary
kernel32.dllFindFirstFileA
kernel32.dllFindClose
kernel32.dllExitProcess
kernel32.dllWriteFile
kernel32.dllUnhandledExceptionFilter
kernel32.dllRtlUnwind
kernel32.dllRaiseException
kernel32.dllGetStdHandle
kernel32.dllTlsSetValue
kernel32.dllTlsGetValue
kernel32.dllLocalAlloc
kernel32.dllGetModuleHandleA
user32.dllMessageBoxA
user32.dllCharPrevA
kernel32.dllWriteFile
kernel32.dllWaitForSingleObject
kernel32.dllSizeofResource
kernel32.dllLockResource
kernel32.dllLoadResource
kernel32.dllGetWindowsDirectoryA
kernel32.dllGetFullPathNameA
kernel32.dllGetFileAttributesA
kernel32.dllGetExitCodeProcess
kernel32.dllGetEnvironmentVariableA
kernel32.dllGetCommandLineA
kernel32.dllFreeResource
kernel32.dllFreeLibrary
kernel32.dllFindResourceA
kernel32.dllDeleteFileA
kernel32.dllCreateProcessA
kernel32.dllCreateFileA
kernel32.dllCloseHandle
offsetsizetypecomment
15c115HTM#
20ebc2998EXE10/03/2008 10:35:44#
2203c2007JPG#
24fbc106496DLL10/03/2008 10:37:20#
411bc6412JPG#
42dbc20992DLL10/03/2008 10:35:47#
47fbc4048452BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 4343296 bytes (4242 KiB)


--
Type = PE
Physical Size = 4343296
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms Little-Endian Big-Endian
Created = 2009-10-15 14:14:54
Headers Size = 1024
Checksum = 0
Image Size = 4382720
Section Alignment = 4096
File Alignment = 512
Code Size = 15872
Initialized Data Size = 4326400
Uninitialized Data Size = 0
Linker Version = 2.25
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 1048576
Stack Commit = 16384
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
----
Path = .rsrc/RCDATA/MSI
Size = 4313088
Packed Size = 4313088
--
Path = .rsrc/RCDATA/MSI
Type = Compound
Physical Size = 4313088
Extension = msi
Cluster Size = 512
Sector Size = 64

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    .....         2998         3008  Binary.insticon
                    .....         2998         3008  Binary.completi
                    .....          112          128  !EventMapping
                    .....        14448        14848  !_Validation
                    .....         7150         7168  !Control
                    .....            8           64  !CheckBox
                    .....           16           64  !Feature
                    .....           12           64  !Media
                    .....          396          448  !File
                    .....            4           64  !Icon
                    .....          224          256  !UIText
                    .....           90          128  !_Tables
                    .....          318          320  Binary.New
                    .....          616          640  !Dialog
                    .....           56           64  !Binary
                    .....          768          768  !Error
                    .....      4001258      4001280  disk1.cab
                    .....          318          320  Binary.Up
                    .....         1840         1856  !_Columns
                    .....           52           64  !SelfReg
                    .....           72          128  !Shortcut
                    .....           30           64  !Directory
                    .....          240          256  !Property
                    .....           32           64  !Upgrade
                    .....          450          512  !ActionText
                    .....         1078         1088  Binary.info
                    .....           36           64  !TextStyle
                    .....        60965        61440  !_StringData
                    .....          252          256  !Component
                    .....         7736         8192  !_StringPool
                    .....         1452         1472  !ControlEvent
                    .....           36           64  !RadioButton
                    .....          216          256  !CustomAction
                    .....            4           64  !CreateFolder
                    .....          766          768  Binary.exclamic
                    .....         2998         3008  Binary.custicon
                    .....           66          128  !AdminUISequence
                    .....         2998         3008  Binary.repairic
                    .....         2998         3008  Binary.removico
                    .....         2560         2560  Binary.viewer.exe
                    .....           48           64  !AdminExecuteSequence
                    .....           84          128  !FeatureComponents
                    .....           56           64  !ControlCondition
                    .....        20992        20992  Binary.aicustact.dll
                    .....       106496       106496  Binary.NetFirewall.dll
                    .....          162          192  !InstallUISequence
                    .....           32           64  !AI_FirewallException
                    .....        10134        10240  Icon.SystemFolder_msiexec.exe
                    .....         6412         6656  Binary.style4_dialog.jpg
                    .....           84          128  !AdvtExecuteSequence
                    .....         2007         2048  Binary.style4_banner.jpg
                    .....          456          512  !InstallExecuteSequence
                    .....          560          576  [5]SummaryInformation
------------------- ----- ------------ ------------  ------------------------
                               4266190      4269120  53 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0xd000