newbot_load.EXE - JLKSDFJ

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	newbot_load.EXE
size	91136 (0x16400)
md5	d3ce3c3fef14189b047ef7a9356b64da

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x80
blocks_in_file	1
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0x10
max_extra_paragraphs	0xffff
ss	0
sp	0x140
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0a 24  00 00 00 00 00 00 00 00  |mode...$........|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x504838f2
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	1.70
SizeOfCode	0x12e00
SizeOfInitializedData	0x3400
SizeOfUninitializedData	0
AddressOfEntryPoint	0xd107
BaseOfCode	0x1000
BaseOfData	0x14000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1f000
SizeOfHeaders	0x200
CheckSum	0x1ad82
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x1000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x10000
SizeOfHeapCommit	0
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x12d2d	0x12e00	R-X CODE
.data	0x14000	0x92d4	0x2c00	RW- IDATA
.rsrc	0x1e000	0x680	0x800	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x14000	0x92d4
RESOURCE	0x1e000	0x680
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	744
DIALOG	#100	56
GROUP_ICON	#17	20
VERSION	#1	540

module_name	hint	ord	function_name
KERNEL32.DLL			Beep
KERNEL32.DLL			CloseHandle
KERNEL32.DLL			CreateDirectoryW
KERNEL32.DLL			CreateEventW
KERNEL32.DLL			CreateFileW
KERNEL32.DLL			CreateMutexA
KERNEL32.DLL			CreateThread
KERNEL32.DLL			DisableThreadLibraryCalls
KERNEL32.DLL			EnterCriticalSection
KERNEL32.DLL			FreeLibrary
KERNEL32.DLL			GetCPInfo
KERNEL32.DLL			GetCurrentProcess
KERNEL32.DLL			GetCurrentProcessId
KERNEL32.DLL			GetCurrentThreadId
KERNEL32.DLL			GetDateFormatW
KERNEL32.DLL			GetGeoInfoA
KERNEL32.DLL			GetLastError
KERNEL32.DLL			GetModuleFileNameW
KERNEL32.DLL			GetModuleHandleW
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			GetProcessHeap
KERNEL32.DLL			GetSystemTimeAsFileTime
KERNEL32.DLL			GetTickCount
KERNEL32.DLL			GetVersionExW
KERNEL32.DLL			HeapDestroy
KERNEL32.DLL			InterlockedCompareExchange
KERNEL32.DLL			InterlockedDecrement
KERNEL32.DLL			InterlockedExchange
KERNEL32.DLL			InterlockedIncrement
KERNEL32.DLL			IsBadCodePtr
KERNEL32.DLL			IsBadReadPtr
KERNEL32.DLL			LeaveCriticalSection
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			MultiByteToWideChar
KERNEL32.DLL			ReadFile
KERNEL32.DLL			ReadFileEx
KERNEL32.DLL			Sleep
KERNEL32.DLL			lstrlenW
USER32.DLL			BeginPaint
USER32.DLL			CharNextW
USER32.DLL			CreateWindowExW
USER32.DLL			DefWindowProcW
USER32.DLL			DialogBoxParamW
USER32.DLL			DispatchMessageW
USER32.DLL			EnableWindow
USER32.DLL			EndDialog
USER32.DLL			EndPaint
USER32.DLL			GetClientRect
USER32.DLL			GetDC
USER32.DLL			GetDesktopWindow
USER32.DLL			GetDlgItem
USER32.DLL			GetFocus
USER32.DLL			GetParent
USER32.DLL			GetSysColor
USER32.DLL			GetSystemMetrics
USER32.DLL			GetWindowLongW
USER32.DLL			GetWindowRect
USER32.DLL			IsDlgButtonChecked
USER32.DLL			IsWindow
USER32.DLL			KillTimer
USER32.DLL			LoadCursorW
USER32.DLL			LoadIconW
USER32.DLL			LoadStringW
USER32.DLL			MessageBoxW
USER32.DLL			PeekMessageW
USER32.DLL			PostMessageW
USER32.DLL			PostQuitMessage
USER32.DLL			ReleaseDC
USER32.DLL			SendDlgItemMessageW
USER32.DLL			SendMessageW
USER32.DLL			SetCursor
USER32.DLL			SetDlgItemTextW
USER32.DLL			SetFocus
GDI32.DLL			BitBlt
GDI32.DLL			CloseMetaFile
GDI32.DLL			CreatePen
GDI32.DLL			EnumMetaFile
GDI32.DLL			GdiGetDC
GDI32.DLL			GetFontData
ADVAPI32.DLL			ClearEventLogA
ADVAPI32.DLL			CreateServiceA
ADVAPI32.DLL			CryptSignHashA
ADVAPI32.DLL			GetNumberOfEventLogRecords
ADVAPI32.DLL			GetServiceDisplayNameA
ADVAPI32.DLL			GetUserNameA
ADVAPI32.DLL			InitializeAcl
ADVAPI32.DLL			IsTextUnicode
ADVAPI32.DLL			IsValidAcl
ADVAPI32.DLL			OpenEventLogA
ADVAPI32.DLL			OpenSCManagerA
ADVAPI32.DLL			ReadEventLogA
ADVAPI32.DLL			RegCloseKey
ADVAPI32.DLL			RegLoadKeyA
ADVAPI32.DLL			RegQueryValueA
ADVAPI32.DLL			RegUnLoadKeyA
SHELL32.DLL			ExtractIconA
SHELL32.DLL			StrChrA
SHELL32.DLL			StrRStrA
WININET.DLL			CreateUrlCacheEntryA
msvcrt.dll			__argv
msvcrt.dll			_beep
msvcrt.dll			_cscanf
msvcrt.dll			_dup
msvcrt.dll			_fileinfo
msvcrt.dll			_findnext
msvcrt.dll			_findfirst
msvcrt.dll			_getch
msvcrt.dll			atoi
msvcrt.dll			atof
msvcrt.dll			difftime
msvcrt.dll			fclose
msvcrt.dll			fread
msvcrt.dll			fmod
msvcrt.dll			free
msvcrt.dll			gets
ole32.dll			CoFreeLibrary
ole32.dll			CoGetCurrentProcess
ole32.dll			CoGetDefaultContext
ole32.dll			BindMoniker
ole32.dll			CoInitialize
ole32.dll			CoLoadLibrary
ole32.dll			CoMarshalInterface
ole32.dll			CoTaskMemAlloc
ole32.dll			CoUninitialize
ole32.dll			CreateErrorInfo
ole32.dll			CreateFileMoniker
ole32.dll			CreateItemMoniker
ole32.dll			CreatePointerMoniker
ole32.dll			GetClassFile
ole32.dll			GetErrorInfo
ole32.dll			IsEqualGUID
ole32.dll			OleCreate
oleaut32.dll			CreateTypeLib
oleaut32.dll			OleIconToCursor
oleaut32.dll			SafeArrayAccessData
oleaut32.dll			SafeArrayGetElement
oleaut32.dll			SafeArrayGetRecordInfo
oleaut32.dll			SysStringLen
oleaut32.dll			VarDecFix
gdiplus.dll			GdipCloneBrush
gdiplus.dll			GdipClonePath
gdiplus.dll			GdipCreateBitmapFromGraphics
gdiplus.dll			GdipCreateFont
gdiplus.dll			GdipCreateRegion
gdiplus.dll			GdipDeleteBrush
wmvcore.dll			WMCreateSyncReader
iphlpapi.dll			DeleteIPAddress
crypt32.dll			CertAddCertificateLinkToStore
crypt32.dll			CertDuplicateCTLContext
crypt32.dll			CryptBinaryToStringW
crypt32.dll			CryptEnumOIDInfo
crypt32.dll			CryptGetDefaultOIDDllList
crypt32.dll			CryptHashMessage
crypt32.dll			CryptMsgSignCTL
ws2_32.dll			freeaddrinfo
ws2_32.dll			htonl
ws2_32.dll			ntohs
ws2_32.dll			WSACancelAsyncRequest
ws2_32.dll			WSAEventSelect
ws2_32.dll			WSAEnumProtocolsA
ws2_32.dll			WSAEnumNetworkEvents
ws2_32.dll			WSAGetLastError
ws2_32.dll			WSANtohs
ws2_32.dll			WSASetServiceA
ws2_32.dll			WSCDeinstallProvider

StringTable 040904E4

FileDescription	dhkd67dh
LegalCopyright	1993-2011 LTD
FileVersion	2.23.31
OriginalFilename	JLKSDFJ
Company	FGMLS
CompanyName	MFLGJTI LTD

VS_FIXEDFILEINFO

FileVersion	2.23.31.0
ProductVersion	0.0.0.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	91136	EXE	09/06/2012 05:47:30	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

newbot_load.EXE-

MZ Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904E4

VS_FIXEDFILEINFO

newbot_load.EXE
-