filename11822ae6c65113bfe710abed1683db545509222cb7ba93c74322f13fb8344fb7
size283648 (0x45400)
md5cbdaccc755176a8d48ec3c3ff156b2b0
typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavWin.Trojan.Zbot-22312 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
1211420212
2251975
7143782408
716633164
68136561037
9232455224
5919161252
3530932682
9362000590
8456777995
8345947697

DOS stub

00000000: 6f 8a de b0 dc 19 a7 51  aa 4e 0a c4 8e 46 f5 c6  |o......Q.N...F..|
00000010: a7 f8 bf 2f 29 71 1e b0  ba 30 ba ac 1c 65 9d 19  |.../)q...0...e..|
00000020: a8 44 bf 8d e8 fc eb 26  6b 36 dc d2 aa b6 b9 be  |.D.....&k6......|
00000030: c5 84 9c 56 3e 69 eb f0  93 93 b4 73 ef b8 0e ff  |...V>i.....s....|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x4093c034
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.12
SizeOfCode0x20000
SizeOfInitializedData0x2000
SizeOfUninitializedData0x24000
AddressOfEntryPoint0xdcba
BaseOfCode0x25000
BaseOfData0x45000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion4.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x47000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX v2.00-V2.90 (Markus Oberhumer & Laszlo Molnar & John Reiser)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
UPX00x10000x240000x24000RWX UDATA
UPX10x250000x200000x1fc00RWX IDATA
.rsrc0x450000x20000x1400RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x462000xb4
RESOURCE0x450000xe5c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#116400
ICON#24320
ICON#33600
GROUP_ICON#1480
VERSION#18480
module_namehintordfunction_name
KERNEL32.DLL256SetUnhandledExceptionFilter
KERNEL32.DLL256GetSystemInfo
KERNEL32.DLL256GetLastError
KERNEL32.DLL256GetSystemDirectoryW
KERNEL32.DLL256FileTimeToSystemTime
KERNEL32.DLL256UnmapViewOfFile
KERNEL32.DLL256GetModuleHandleW
KERNEL32.DLL256GlobalAlloc
KERNEL32.DLL256CreateEventW
KERNEL32.DLL256CompareStringW
KERNEL32.DLL256DisconnectNamedPipe
KERNEL32.DLL256LoadResource
KERNEL32.DLL256GetTempPathW
KERNEL32.DLL256FreeLibrary
KERNEL32.DLL256ResetEvent
KERNEL32.DLL256ReleaseMutex
KERNEL32.DLL256GetComputerNameExW
KERNEL32.DLL256CreateFileMappingW
KERNEL32.DLL256WideCharToMultiByte
KERNEL32.DLL256MultiByteToWideChar
KERNEL32.DLL256GetCurrentProcessId
KERNEL32.DLL256SetFilePointer
KERNEL32.DLL256GetModuleHandleA
KERNEL32.DLL256GetTickCount
KERNEL32.DLL256GlobalUnlock
KERNEL32.DLL256GetComputerNameW
KERNEL32.DLL256LoadLibraryW
KERNEL32.DLL256GetSystemTime
KERNEL32.DLL256GetCurrentThreadId
KERNEL32.DLL256WaitForSingleObject
KERNEL32.DLL256InterlockedIncrement
KERNEL32.DLL256LockResource
KERNEL32.DLL256GetProcAddress
KERNEL32.DLL256VirtualFree
KERNEL32.DLL256SetEvent
KERNEL32.DLL256DeleteFileW
KERNEL32.DLL256SetProcessWorkingSetSize
KERNEL32.DLL256GlobalLock
KERNEL32.DLL256GetLocalTime
KERNEL32.DLL256InterlockedDecrement
KERNEL32.DLL256WaitForMultipleObjects
KERNEL32.DLL256CreateMutexW
KERNEL32.DLL256SetFileAttributesW
KERNEL32.DLL256GetCurrentProcess
KERNEL32.DLL256GetCurrentThread
KERNEL32.DLL256GetFileSize
KERNEL32.DLL256GetFileAttributesW
KERNEL32.DLL256InterlockedExchange
KERNEL32.DLL256FindResourceW
KERNEL32.DLL256ConnectNamedPipe
KERNEL32.DLL256SetNamedPipeHandleState
KERNEL32.DLL256SystemTimeToFileTime
KERNEL32.DLL256CreateProcessW
KERNEL32.DLL256GlobalFree
KERNEL32.DLL256GetSystemDefaultLCID
KERNEL32.DLL256LocalFree
KERNEL32.DLL256ReadFile
KERNEL32.DLL256SetEndOfFile
KERNEL32.DLL256GetExitCodeProcess
KERNEL32.DLL256CloseHandle
KERNEL32.DLL256MoveFileExW
KERNEL32.DLL256GetExitCodeThread
KERNEL32.DLL256ProcessIdToSessionId
KERNEL32.DLL256VirtualAlloc
KERNEL32.DLL256OpenThread
KERNEL32.DLL256CancelIo
KERNEL32.DLL256GetSystemTimeAsFileTime
KERNEL32.DLL256Sleep
KERNEL32.DLL256GetWindowsDirectoryW
KERNEL32.DLL256WriteFile
KERNEL32.DLL256GetModuleFileNameW
KERNEL32.DLL256InterlockedCompareExchange
KERNEL32.DLL256LoadLibraryA
KERNEL32.DLL256CreateNamedPipeW
KERNEL32.DLL256GetACP
KERNEL32.DLL256WaitNamedPipeW
KERNEL32.DLL256ResumeThread
KERNEL32.DLL256GetOverlappedResult
KERNEL32.DLL256MapViewOfFile
KERNEL32.DLL256SetLastError
KERNEL32.DLL256CreateFileW
KERNEL32.DLL256GetCurrentDirectoryW
KERNEL32.DLL256GetVersionExW
KERNEL32.DLL256FlushFileBuffers
KERNEL32.DLL256LocalAlloc
KERNEL32.DLL256SetThreadPriority
KERNEL32.DLL256CompareFileTime
ADVAPI32.DLL256RegQueryValueExW
ADVAPI32.DLL256OpenProcessToken
ADVAPI32.DLL256FreeSid
ADVAPI32.DLL256RegCreateKeyW
ADVAPI32.DLL256RegOpenKeyExA
ADVAPI32.DLL256ImpersonateNamedPipeClient
ADVAPI32.DLL256RegSetValueExW
ADVAPI32.DLL256CheckTokenMembership
ADVAPI32.DLL256RegCloseKey
ADVAPI32.DLL256OpenThreadToken
ADVAPI32.DLL256RegOpenKeyW
ADVAPI32.DLL256AllocateAndInitializeSid
ADVAPI32.DLL256RevertToSelf
ADVAPI32.DLL256RegQueryValueExA
ADVAPI32.DLL256GetTokenInformation
COMCTL32.DLL256ImageList_Destroy
COMCTL32.DLL256ImageList_AddMasked
COMCTL32.DLL256InitCommonControlsEx
COMCTL32.DLL256_TrackMouseEvent
COMCTL32.DLL256ImageList_Draw
COMCTL32.DLL256ImageList_GetImageInfo
COMCTL32.DLL256ImageList_LoadImageW
MSIMG32.DLL256TransparentBlt
OLE32.DLL256CreateStreamOnHGlobal
SHELL32.DLL256Shell_NotifyIconW
SHELL32.DLL256ExtractIconExW
SHELL32.DLL256ShellExecuteExW
SHELL32.DLL256ShellExecuteW
USER32.DLL256GetWindowThreadProcessId
USER32.DLL256GetSysColorBrush
USER32.DLL256TranslateMessage
USER32.DLL256GetDoubleClickTime
USER32.DLL256GetMessageW
USER32.DLL256DeferWindowPos
USER32.DLL256BeginDeferWindowPos
USER32.DLL256InflateRect
USER32.DLL256AppendMenuW
USER32.DLL256DrawIconEx
USER32.DLL256GetMenuItemInfoW
USER32.DLL256GetIconInfo
USER32.DLL256SetPropW
USER32.DLL256EndDeferWindowPos
USER32.DLL256GetTopWindow
USER32.DLL256GetClassNameW
USER32.DLL256RegisterClassExW
USER32.DLL256IsMenu
USER32.DLL256EnumWindows
USER32.DLL256IsWindowEnabled
USER32.DLL256DispatchMessageW
USER32.DLL256RemovePropW
USER32.DLL256SetWindowRgn
USER32.DLL256GetForegroundWindow
USER32.DLL256GetPropW
USER32.DLL256GetDlgCtrlID
USER32.DLL256AnimateWindow
USER32.DLL256FindWindowW
USER32.DLL256FrameRect
USER32.DLL256DrawTextW
USER32.DLL256EnumChildWindows
VERSION.DLL256GetFileVersionInfoW
VERSION.DLL256VerQueryValueW
VERSION.DLL256GetFileVersionInfoSizeW

StringTable 040904E4

CompanyNameCfkjfdmktv Lmubuw
FileDescriptionCfkjfdmktv Bpnyckyl Isighfxwp
FileVersion123,106,93,3
InternalNameCfkjfdmktv
LegalCopyrightCopyright © Cfkjfdmktv Lmubuw 1999-2011
OriginalFilenameCfkjfdmktv.exe
ProductNameCfkjfdmktv Bpnyckyl Isighfxwp
ProductVersion111,34,14,81

VS_FIXEDFILEINFO

FileVersion123.106.93.3
ProductVersion111.34.14.81
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0283648EXE05/01/2004 15:20:20#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK