smb-gfq2vopw.exe - Win.Trojan.Agent-1388727

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	smb-gfq2vopw.exe
size	61440 (0xf000)
md5	d89a8f66710e09eae91f0b006de7c258

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Agent-1388727 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
14	7299	2
10	8047	11
4	8047	2
19	8034	11
1	0	77
11	9782	2
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x58fadbad
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x5000
SizeOfInitializedData	0x47b000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4ec0
BaseOfCode	0x1000
BaseOfData	0x6000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x481000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x406a	0x5000	R-X CODE
.rdata	0x6000	0x86e	0x1000	R-- IDATA
.data	0x7000	0x10d58	0x11000	RW- IDATA
.rsrc	0x18000	0x4685a8	0x469000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6250	0x8c
RESOURCE	0x18000	0x4685a8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x6000	0x144
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.dll	718		WaitForSingleObject
KERNEL32.dll	365		GetTickCount
KERNEL32.dll	125		ExitProcess
KERNEL32.dll	722		WideCharToMultiByte
KERNEL32.dll	484		MultiByteToWideChar
KERNEL32.dll	671		TerminateThread
KERNEL32.dll	282		GetLastError
KERNEL32.dll	450		LoadLibraryA
KERNEL32.dll	40		CopyFileA
KERNEL32.dll	269		GetFileAttributesA
KERNEL32.dll	45		CreateDirectoryA
KERNEL32.dll	662		Sleep
KERNEL32.dll	478		MoveFileExA
KERNEL32.dll	68		CreateProcessA
KERNEL32.dll	163		FindResourceA
KERNEL32.dll	455		LoadResource
KERNEL32.dll	469		LockResource
KERNEL32.dll	661		SizeofResource
KERNEL32.dll	52		CreateFileA
KERNEL32.dll	735		WriteFile
KERNEL32.dll	27		CloseHandle
KERNEL32.dll	318		GetProcAddress
KERNEL32.dll	292		GetModuleFileNameA
KERNEL32.dll	294		GetModuleHandleA
KERNEL32.dll	336		GetStartupInfoA
ADVAPI32.dll	53		ControlService
ADVAPI32.dll	434		StartServiceA
ADVAPI32.dll	120		DeleteService
ADVAPI32.dll	325		OpenSCManagerA
ADVAPI32.dll	327		OpenServiceA
ADVAPI32.dll	52		CloseServiceHandle
ADVAPI32.dll	435		StartServiceCtrlDispatcherA
ADVAPI32.dll	398		RegisterServiceCtrlHandlerA
ADVAPI32.dll	43		ChangeServiceConfig2A
ADVAPI32.dll	430		SetServiceStatus
ADVAPI32.dll	76		CreateServiceA
WS2_32.dll		19
WS2_32.dll		16
WS2_32.dll		111
WS2_32.dll		15
WS2_32.dll		11
WS2_32.dll		12
WS2_32.dll		9
WS2_32.dll		3
WS2_32.dll		10
WS2_32.dll		4
WS2_32.dll		18
WS2_32.dll		115
WS2_32.dll		23
NETAPI32.dll	193		NetUserEnum
NETAPI32.dll	72		NetApiBufferFree
MPR.dll	12		WNetCancelConnection2A
MPR.dll	6		WNetAddConnection2A
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	106		__p__commode
MSVCRT.dll	183		_controlfp
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	271		_initterm
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	143		_acmdln
MSVCRT.dll	585		exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	678		rand
MSVCRT.dll	197		_endthreadex
MSVCRT.dll	705		strncpy
MSVCRT.dll	690		sprintf
MSVCRT.dll	166		_beginthreadex
MSVCRT.dll	211		_exit
MSVCRT.dll	692		srand
MSVCRT.dll	720		time
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	670		printf

show previews

offset	size	type	comment
15c1	15	HTM		#
72ac	32084	EXE	06/12/2014 02:12:45	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

smb-gfq2vopw.exe- Win.Trojan.Agent-1388727

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

smb-gfq2vopw.exe
- Win.Trojan.Agent-1388727