filenameTrojan.Zbot_!_v20140305__223905__C66AD61E02C507968FF129D3B4159B47.exe.c66ad61e02c507968ff129d3b4159b47.@
size223905 (0x36aa1)
md5c66ad61e02c507968ff129d3b4159b47
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x120

Rich Header

lib idversiontimes used
18737127101
313712751
152371273
23537127193
18837127220
423712780
783712713
47371275
1503712730
1613712710
15537127112
853712745
833712746
2403712785
22237127109

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4d4ff2d2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion18.4
SizeOfCode0x34800
SizeOfInitializedData0x81e00
SizeOfUninitializedData0
AddressOfEntryPoint0xc468
BaseOfCode0x1000
BaseOfData0x36000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0xb9000
SizeOfHeaders0x400
CheckSum0x429cf
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x346300x34800R-X CODE
.data0x360000x802200RW- IDATA
.rsrc0xb70000xccc0xe00R-- IDATA
.reloc0xb80000xa8c0xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x335d40x50
RESOURCE0xb70000x5cc
EXCEPTION00
SECURITY00
BASERELOC0xb80000xa8c
DEBUG0x336c40x1e
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x32e440xa0
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
SCECLI.dllSceAppendSecurityProfileInfo
SCECLI.dllSceAnalyzeSystem
SCECLI.dllSceCloseProfile
SCECLI.dllSceAddToNameStatusList
SCECLI.dllSceBrowseDatabaseTable
KERNEL32.dllLoadLibraryW
KERNEL32.dllMultiByteToWideChar
KERNEL32.dllGetCurrentThread
KERNEL32.dllHeapAlloc
KERNEL32.dllGetProcessHeap
KERNEL32.dllSetLastError
KERNEL32.dllCreateFileA
KERNEL32.dllGetCPInfo
KERNEL32.dllGetTickCount
KERNEL32.dllOutputDebugStringA
KERNEL32.dllGetSystemDefaultLangID
KERNEL32.dlllstrlenW
KERNEL32.dlllstrcmpA
KERNEL32.dllGetACP
KERNEL32.dlllstrcpyW
KERNEL32.dllGetLocaleInfoA
KERNEL32.dllHeapFree
KERNEL32.dllSystemTimeToFileTime
KERNEL32.dllGetCurrentProcess
KERNEL32.dllFindResourceW
KERNEL32.dllWideCharToMultiByte
KERNEL32.dllSetUnhandledExceptionFilter
KERNEL32.dllCloseHandle
KERNEL32.dllGetLocalTime
KERNEL32.dllGlobalFindAtomA
KERNEL32.dllQueryPerformanceCounter
KERNEL32.dllGetSystemTimeAsFileTime
KERNEL32.dllOutputDebugStringW
KERNEL32.dllGetProcAddress
KERNEL32.dllGetCurrentProcessId
WIASHEXT.dllAddDeviceWasChosen
WIASHEXT.dllAddDeviceWasChosenW
offsetsizetypecomment
0222720EXE02/07/2011 13:25:38#
15c115HTM#
366001185BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 223905 bytes (219 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 41332 entries in directory, but got EOF on 979-th.
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 223905
[?] too many errors getting resource data, stopped on 233 of 979