filenameadobeflashplayerv10.0.32.20.exe
size339968 (0x53000)
md5d083c8a59a063cfc81ccebd52a34cb56
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Fakeav-58603 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

DOS stub

00000000: 56 4c 56 00 01 00 00 00  00 e0 12 00 bc 0d da 4c  |VLV............L|
00000010: ab d8 98 6d 5b db a0 ea  0b 1a 92 a0 21 05 04 ba  |...m[.......!...|
00000020: 86 0d c1 65 ce a9 6d c7  fe 2c 8b 8c ae 07 80 df  |...e..m..,......|
00000030: be fd 27 00 58 5b 50 53  a0 d8 75 75 50 c9 19 37  |..'.X[PS..uuP..7|
00000040: c1 4a c1 ed a7 7d a0 8a  6d 7d b2 84 c8 f5 87 78  |.J...}..m}.....x|
00000050: 9a ff 78 0d b6 7d a8 4b  ba 1c 37 23 ff 17 be 1d  |..x..}.K..7#....|
00000060: 26 9e 1e 16 ae 8c fb ab  4a 60 9d 04 a3 bc 87 8f  |&.......J`......|
00000070: 5b 0e 47 9f d6 52 60 69  25 16 60 9e 18 25 e7 97  |[.G..R`i%.`..%..|
00000080: 12 0c 01 6c 44 65 c6 41  a1 75 20 c5 a3 c3 37 82  |...lDe.A.u ...7.|
00000090: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000d0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4cda0db5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x28000
SizeOfInitializedData0x27e000
SizeOfUninitializedData0
AddressOfEntryPoint0x3f85
BaseOfCode0x1000
BaseOfData0x34000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x2a7000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x280000x28000R-X CODE
.rdata0x290000xb0000xb000R-- IDATA
.data0x340000x2670000x13000RW- IDATA
.idata0x29b0000x30000x3000RW- IDATA
.rsrc0x29e0000x90000x9000R-- IDATA

Data Directory

typevasize
EXPORT0x29d2c60x4e
IMPORT0x29b5a80xdc
RESOURCE0x29e0000x87c0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x29d2f60x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x29b0000x5a8
Delay_IAT00
CLR_Header00
typenamesizecp
CONFIGDATACLIENTAPP_FILENAME121252
CONFIGDATACLIENTAPP_FILENAME121252
CONFIGDATAGENERALDIRECTORYSERVER_IPADDRPORTS1211252
CONFIGDATAGENERALDIRECTORYSERVER_IPADDRPORTS141252
CURSOR#113081252
CURSOR#121801252
CURSOR#133081252
CURSOR#143081252
CURSOR#153081252
CURSOR#163081252
CURSOR#173081252
CURSOR#183081252
CURSOR#193081252
CURSOR#203081252
CURSOR#213081252
CURSOR#223081252
CURSOR#233081252
CURSOR#243081252
CURSOR#253081252
CURSOR#263081252
BITMAP#13368421252
BITMAP#13468421252
BITMAP#1438081252
BITMAP#309941841252
BITMAP#309963241252
ICON#213841252
ICON#422161252
DIALOG#1023061252
DIALOG#307212321252
DIALOG#30734521252
STRING#38411301252
STRING#3842421252
STRING#38434021252
STRING#385712501252
STRING#38587941252
STRING#38597321252
STRING#38601381252
STRING#38651721252
STRING#38662221252
STRING#386712201252
STRING#38686121252
STRING#3869441252
STRING#3887661252
GROUP_CURSOR#30977341252
GROUP_CURSOR#30998201252
GROUP_CURSOR#30999201252
GROUP_CURSOR#31000201252
GROUP_CURSOR#31001201252
GROUP_CURSOR#31002201252
GROUP_CURSOR#31003201252
GROUP_CURSOR#31004201252
GROUP_CURSOR#31005201252
GROUP_CURSOR#31006201252
GROUP_CURSOR#31007201252
GROUP_CURSOR#31008201252
GROUP_CURSOR#31009201252
GROUP_CURSOR#31010201252
GROUP_CURSOR#31011201252
GROUP_ICON#128341252
VERSION#17721252
MANIFEST#13391252
idlangstring
614401033Open
614411033Save As
614421033All Files (*.*)
614431033Untitled
614461033an unnamed file
614571033&Hide
614721033No error message is available.
614731033An unsupported operation was attempted.
614741033A required resource was unavailable.
614751033Out of memory.
614761033An unknown error has occurred.
614771033An invalid argument was encountered.
616961033Invalid filename.
616971033Failed to open document.
616981033Failed to save document.
616991033Save changes to %1?
617001033Failed to create empty document.
617011033The file is too large to open.
617021033Could not start print job.
617031033Failed to launch help.
617041033Internal application error.
617051033Command failed.
617061033Insufficient memory to perform operation.
617071033System registry entries have been removed and the INI file (if any) was deleted.
617081033Not all of the system registry entries (or INI file) were removed.
617091033This program requires the file %s, which was not found on this system.
617101033This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
617121033Please enter an integer.
617131033Please enter a number.
617141033Please enter an integer between %1 and %2.
617151033Please enter a number between %1 and %2.
617161033Please enter no more than %1 characters.
617171033Please select a button.
617181033Please enter an integer between 0 and 255.
617191033Please enter a positive integer.
617201033Please enter a date and/or time.
617211033Please enter a currency.
617221033Please enter a GUID.
617231033Please enter a time.
617241033Please enter a date.
617281033Unexpected file format.
617291033%1 Cannot find this file. Please verify that the correct path and file name are given.
617301033Destination disk drive is full.
617311033Unable to read from %1, it is opened by someone else.
617321033Unable to write to %1, it is read-only or opened by someone else.
617331033An unexpected error occurred while reading %1.
617341033An unexpected error occurred while writing %1.
617441033%1: %2 Continue running script?
617451033Dispatch exception: %1
618361033Unable to read write-only property.
618371033Unable to write read-only property.
618401033Unable to load mail system support.
618411033Mail system DLL is invalid.
618421033Send Mail failed to send message.
618561033No error occurred.
618571033An unknown error occurred while accessing %1.
618581033%1 was not found.
618591033%1 contains an invalid path.
618601033%1 could not be opened because there are too many open files.
618611033Access to %1 was denied.
618621033An invalid file handle was associated with %1.
618631033%1 could not be removed because it is the current directory.
618641033%1 could not be created because the directory is full.
618651033Seek failed on %1
618661033A hardware I/O error was reported while accessing %1.
618671033A sharing violation occurred while accessing %1.
618681033A locking violation occurred while accessing %1.
618691033Disk full while accessing %1.
618701033An attempt was made to access %1 past its end.
618721033No error occurred.
618731033An unknown error occurred while accessing %1.
618741033An attempt was made to write to the reading %1.
618751033An attempt was made to access %1 past its end.
618761033An attempt was made to read from the writing %1.
618771033%1 has a bad format.
618781033%1 contained an unexpected object.
618791033%1 contains an incorrect schema.
618881033pixels
621771033Uncheck
621781033Check
621791033Mixed
module_namehintordfunction_name
WS2_32.dll20
WS2_32.dll19
WS2_32.dll18
WS2_32.dll17
WS2_32.dll16
WS2_32.dll10
WS2_32.dll21
WS2_32.dll9
WS2_32.dll8
WS2_32.dll6
WS2_32.dll57
WS2_32.dll52
WS2_32.dll4
WS2_32.dll3
WS2_32.dll22
WS2_32.dll23
WS2_32.dll11
WS2_32.dll2
WS2_32.dll151
WS2_32.dll115
WS2_32.dll112
WS2_32.dll56WSASend
WS2_32.dll51WSARecv
WS2_32.dll111
WS2_32.dll116
KERNEL32.dll175ExitProcess
KERNEL32.dll176ExitThread
KERNEL32.dll187FileTimeToLocalFileTime
KERNEL32.dll188FileTimeToSystemTime
KERNEL32.dll197FindClose
KERNEL32.dll201FindFirstFileA
KERNEL32.dll211FindNextFileA
KERNEL32.dll218FindResourceA
KERNEL32.dll229FlushFileBuffers
KERNEL32.dll231FlushViewOfFile
KERNEL32.dll234FormatMessageA
KERNEL32.dll237FreeEnvironmentStringsA
KERNEL32.dll238FreeEnvironmentStringsW
KERNEL32.dll239FreeLibrary
KERNEL32.dll241FreeResource
KERNEL32.dll245GetACP
KERNEL32.dll252GetCPInfo
KERNEL32.dll264GetCommandLineA
KERNEL32.dll282GetConsoleCP
KERNEL32.dll299GetConsoleMode
KERNEL32.dll301GetConsoleOutputCP
KERNEL32.dll312GetCurrentDirectoryA
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll315GetCurrentProcessId
KERNEL32.dll317GetCurrentThread
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll326GetDiskFreeSpaceExA
KERNEL32.dll331GetDriveTypeA
KERNEL32.dll334GetEnvironmentStringsA
KERNEL32.dll335GetEnvironmentStringsW
KERNEL32.dll338GetExitCodeProcess
KERNEL32.dll339GetExitCodeThread
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll347GetFileSize
KERNEL32.dll350GetFileType
KERNEL32.dll353GetFullPathNameA
KERNEL32.dll361GetLastError
KERNEL32.dll364GetLocaleInfoA
KERNEL32.dll365GetLocaleInfoW
KERNEL32.dll370GetLongPathNameA
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll374GetModuleFileNameW
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll395GetOEMCP
KERNEL32.dll408GetProcAddress
KERNEL32.dll411GetProcessHeap
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll433GetStdHandle
KERNEL32.dll434GetStringTypeA
KERNEL32.dll437GetStringTypeW
KERNEL32.dll443GetSystemInfo
KERNEL32.dll446GetSystemTime
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll457GetTempFileNameA
KERNEL32.dll459GetTempPathA
KERNEL32.dll464GetThreadLocale
KERNEL32.dll469GetTickCount
KERNEL32.dll472GetTimeZoneInformation
KERNEL32.dll473GetUserDefaultLCID
KERNEL32.dll165EnumSystemLocalesA
KERNEL32.dll479GetVersionExA
KERNEL32.dll492GlobalAddAtomA
KERNEL32.dll494GlobalAlloc
KERNEL32.dll496GlobalDeleteAtom
KERNEL32.dll497GlobalFindAtomA
KERNEL32.dll500GlobalFlags
KERNEL32.dll501GlobalFree
KERNEL32.dll502GlobalGetAtomNameA
KERNEL32.dll504GlobalHandle
KERNEL32.dll505GlobalLock
KERNEL32.dll508GlobalReAlloc
KERNEL32.dll512GlobalUnlock
KERNEL32.dll518HeapAlloc
KERNEL32.dll520HeapCreate
KERNEL32.dll522HeapDestroy
KERNEL32.dll524HeapFree
KERNEL32.dll528HeapReAlloc
KERNEL32.dll530HeapSize
KERNEL32.dll537InitializeCriticalSection
KERNEL32.dll542InterlockedDecrement
KERNEL32.dll543InterlockedExchange
KERNEL32.dll546InterlockedIncrement
KERNEL32.dll559IsDebuggerPresent
KERNEL32.dll565IsValidCodePage
KERNEL32.dll567IsValidLocale
KERNEL32.dll570LCMapStringA
KERNEL32.dll571LCMapStringW
KERNEL32.dll583LeaveCriticalSection
KERNEL32.dll584LoadLibraryA
KERNEL32.dll589LoadResource
KERNEL32.dll590LocalAlloc
KERNEL32.dll594LocalFree
KERNEL32.dll597LocalReAlloc
KERNEL32.dll603LockResource
KERNEL32.dll606MapViewOfFile
KERNEL32.dll612MoveFileA
KERNEL32.dll618MulDiv
KERNEL32.dll619MultiByteToWideChar
KERNEL32.dll625OpenEventA
KERNEL32.dll663QueryPerformanceCounter
KERNEL32.dll664QueryPerformanceFrequency
KERNEL32.dll667RaiseException
KERNEL32.dll681ReadFile
KERNEL32.dll696RemoveDirectoryA
KERNEL32.dll706ResetEvent
KERNEL32.dll709ResumeThread
KERNEL32.dll714RtlUnwind
KERNEL32.dll765SetCurrentDirectoryA
KERNEL32.dll766SetCurrentDirectoryW
KERNEL32.dll771SetEndOfFile
KERNEL32.dll774SetEnvironmentVariableA
KERNEL32.dll775SetEnvironmentVariableW
KERNEL32.dll776SetErrorMode
KERNEL32.dll777SetEvent
KERNEL32.dll780SetFileAttributesA
KERNEL32.dll782SetFilePointer
KERNEL32.dll791SetHandleCount
KERNEL32.dll795SetLastError
KERNEL32.dll810SetStdHandle
KERNEL32.dll822SetThreadPriority
KERNEL32.dll827SetUnhandledExceptionFilter
KERNEL32.dll838SizeofResource
KERNEL32.dll839Sleep
KERNEL32.dll844SystemTimeToFileTime
KERNEL32.dll847TerminateProcess
KERNEL32.dll848TerminateThread
KERNEL32.dll852TlsAlloc
KERNEL32.dll853TlsFree
KERNEL32.dll854TlsGetValue
KERNEL32.dll855TlsSetValue
KERNEL32.dll864UnhandledExceptionFilter
KERNEL32.dll867UnmapViewOfFile
KERNEL32.dll883VirtualAlloc
KERNEL32.dll886VirtualFree
KERNEL32.dll897WaitForMultipleObjects
KERNEL32.dll899WaitForSingleObject
KERNEL32.dll903WideCharToMultiByte
KERNEL32.dll154EnumResourceLanguagesA
KERNEL32.dll915WriteConsoleW
KERNEL32.dll916WriteFile
KERNEL32.dll921WritePrivateProfileStringA
KERNEL32.dll944lstrcmpA
KERNEL32.dll945lstrcmpW
KERNEL32.dll956lstrlenA
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll124DeleteFileA
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll105CreateThread
KERNEL32.dll96CreateProcessA
KERNEL32.dll90CreateMutexA
KERNEL32.dll80CreateFileW
KERNEL32.dll78CreateFileMappingA
KERNEL32.dll77CreateFileA
KERNEL32.dll73CreateEventA
KERNEL32.dll69CreateDirectoryA
KERNEL32.dll61CopyFileA
KERNEL32.dll57ConvertDefaultLocale
KERNEL32.dll53CompareStringW
KERNEL32.dll52CompareStringA
KERNEL32.dll46CloseHandle
KERNEL32.dll478GetVersion
KERNEL32.dll905WriteConsoleA
USER32.dll270GetDesktopWindow
USER32.dll272GetDlgCtrlID
USER32.dll273GetDlgItem
USER32.dll278GetFocus
USER32.dll279GetForegroundWindow
USER32.dll289GetKeyState
USER32.dll296GetLastActivePopup
USER32.dll300GetMenu
USER32.dll302GetMenuCheckMarkDimensions
USER32.dll306GetMenuItemCount
USER32.dll307GetMenuItemID
USER32.dll311GetMenuState
USER32.dll314GetMessageA
USER32.dll316GetMessagePos
USER32.dll317GetMessageTime
USER32.dll323GetNextDlgTabItem
USER32.dll325GetParent
USER32.dll330GetPropA
USER32.dll345GetSubMenu
USER32.dll346GetSysColor
USER32.dll347GetSysColorBrush
USER32.dll349GetSystemMetrics
USER32.dll355GetTopWindow
USER32.dll362GetWindow
USER32.dll366GetWindowLongA
USER32.dll371GetWindowPlacement
USER32.dll372GetWindowRect
USER32.dll375GetWindowTextA
USER32.dll379GetWindowThreadProcessId
USER32.dll381GrayStringA
USER32.dll394InflateRect
USER32.dll417IsDialogMessageA
USER32.dll422IsIconic
USER32.dll429IsWindow
USER32.dll430IsWindowEnabled
USER32.dll433IsWindowVisible
USER32.dll436KillTimer
USER32.dll439LoadBitmapA
USER32.dll441LoadCursorA
USER32.dll445LoadIconA
USER32.dll447LoadImageA
USER32.dll473MapWindowPoints
USER32.dll478MessageBoxA
USER32.dll485MessageBoxW
USER32.dll486ModifyMenuA
USER32.dll491MoveWindow
USER32.dll500OffsetRect
USER32.dll268GetDC
USER32.dll513PostMessageA
USER32.dll515PostQuitMessage
USER32.dll523PtInRect
USER32.dll534RegisterClassA
USER32.dll551RegisterWindowMessageA
USER32.dll554ReleaseDC
USER32.dll556RemovePropA
USER32.dll566SendDlgItemMessageA
USER32.dll571SendMessageA
USER32.dll576SendMessageW
USER32.dll579SetActiveWindow
USER32.dll589SetCursor
USER32.dll598SetFocus
USER32.dll599SetForegroundWindow
USER32.dll609SetMenuItemBitmaps
USER32.dll618SetPropA
USER32.dll634SetTimer
USER32.dll640SetWindowLongA
USER32.dll643SetWindowPos
USER32.dll646SetWindowTextA
USER32.dll650SetWindowsHookExA
USER32.dll658ShowWindow
USER32.dll665SystemParametersInfoA
USER32.dll667TabbedTextOutA
USER32.dll682TranslateMessage
USER32.dll686UnhookWindowsHookEx
USER32.dll691UnregisterClassA
USER32.dll699UpdateWindow
USER32.dll707ValidateRect
USER32.dll720WinHelpA
USER32.dll191DrawTextW
USER32.dll189DrawTextExA
USER32.dll188DrawTextA
USER32.dll182DrawIcon
USER32.dll161DispatchMessageA
USER32.dll153DestroyWindow
USER32.dll151DestroyMenu
USER32.dll142DefWindowProcA
USER32.dll96CreateWindowExA
USER32.dll82CreateDialogIndirectParamA
USER32.dll74CopyRect
USER32.dll64ClientToScreen
USER32.dll57CheckMenuItem
USER32.dll27CallWindowProcA
USER32.dll26CallNextHookEx
USER32.dll13BeginPaint
USER32.dll2AdjustWindowRectEx
USER32.dll267GetCursorPos
USER32.dll255GetClientRect
USER32.dll252GetClassNameA
USER32.dll250GetClassLongA
USER32.dll247GetClassInfoExA
USER32.dll246GetClassInfoA
USER32.dll243GetCapture
USER32.dll235GetActiveWindow
USER32.dll200EndPaint
USER32.dll198EndDialog
USER32.dll196EnableWindow
USER32.dll511PeekMessageA
USER32.dll194EnableMenuItem
GDI32.dll521ScaleWindowExtEx
GDI32.dll526SelectObject
GDI32.dll534SetBkMode
GDI32.dll555SetMapMode
GDI32.dll572SetTextColor
GDI32.dll574SetViewportExtEx
GDI32.dll575SetViewportOrgEx
GDI32.dll578SetWindowExtEx
GDI32.dll590TextOutA
GDI32.dll533SetBkColor
GDI32.dll39CreateBitmap
GDI32.dll45CreateCompatibleDC
GDI32.dll80CreateSolidBrush
GDI32.dll140DeleteDC
GDI32.dll143DeleteObject
GDI32.dll212Escape
GDI32.dll221ExtTextOutA
GDI32.dll352GetClipBox
GDI32.dll363GetDeviceCaps
GDI32.dll405GetObjectA
GDI32.dll421GetStockObject
GDI32.dll469OffsetViewportOrgEx
GDI32.dll497PtVisible
GDI32.dll501RectVisible
GDI32.dll512RestoreDC
GDI32.dll519SaveDC
GDI32.dll520ScaleViewportExtEx
GDI32.dll18BitBlt
ADVAPI32.dll466RegDeleteValueA
ADVAPI32.dll464RegDeleteKeyA
ADVAPI32.dll461RegCreateKeyExA
ADVAPI32.dll457RegCloseKey
ADVAPI32.dll306InitializeSecurityDescriptor
ADVAPI32.dll473RegEnumValueA
ADVAPI32.dll481RegOpenKeyA
ADVAPI32.dll482RegOpenKeyExA
ADVAPI32.dll487RegQueryInfoKeyA
ADVAPI32.dll491RegQueryValueA
ADVAPI32.dll492RegQueryValueExA
ADVAPI32.dll505RegSetValueExA
ADVAPI32.dll559SetSecurityDescriptorDacl
ADVAPI32.dll469RegEnumKeyA
SHELL32.dll274Shell_NotifyIconA
SHELL32.dll275Shell_NotifyIconW
SHELL32.dll262ShellExecuteA
OLEAUT32.dll12
OLEAUT32.dll9
OLEAUT32.dll8
WINSPOOL.DRV70DocumentPropertiesA
WINSPOOL.DRV27ClosePrinter
WINSPOOL.DRV125OpenPrinterA
SHLWAPI.dll43PathFindFileNameA
SHLWAPI.dll41PathFindExtensionA
SHLWAPI.dll140SHDeleteKeyA
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dll10VerQueryValueA
VERSION.dllGetFileVersionInfoA
ordentry_vafunction_name
10x7a56Win32MiniDumpInit
module_nameSteam.exe
flags0
timestamp2011-02-15 11:02:10
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x29d2f2
Functions(1)0x29d2ee
NameOrdinals(1)0x29d2f6

StringTable 040904b0

CompanyNameValve Corporation
LegalCopyright© Copyright 2000-2003 Valve Corporation All rights reserved.
ProductNameSteam
ProductVersion1.0.0.0
FileDescriptionSteam
FileVersion1.0.968.628
OriginalFilenameSteam.exe
Source Control ID968628

VS_FIXEDFILEINFO

FileVersion1.0.968.628
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0339968EXE11/10/2010 03:12:53#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK