BigfileSearchUpdate(Malware Obejct Top #2).exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	BigfileSearchUpdate(Malware Obejct Top #2).exe
size	147456 (0x24000)
md5	dd16440ab3ecd625d3ad3a959701554f

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Agent-399183 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
11	8798	2
95	4035	1
93	4035	14
14	7299	2
11	8047	1
10	8047	11
4	8047	2
11	8569	3
4	8569	3
1	0	262
11	8966	6
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x49a252ac
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x4000
SizeOfInitializedData	0x1f000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x409a
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x24000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3938	0x4000	R-X CODE
.rdata	0x5000	0x179a	0x2000	R-- IDATA
.data	0x7000	0x444	0x1000	RW- IDATA
.rsrc	0x8000	0x1b564	0x1c000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x5cf8	0xc8
RESOURCE	0x8000	0x1b564
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5000	0x3a0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
DIALOG	#102	180	1252
RCDATA	#100	244	1252
RCDATA	#101	81920	1252
RCDATA	#102	28672	1252
VERSION	#1	628	1252

module_name	hint	ord	function_name
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		5714
MFC42.DLL		2982
MFC42.DLL		3147
MFC42.DLL		3259
MFC42.DLL		4465
MFC42.DLL		3136
MFC42.DLL		3262
MFC42.DLL		2985
MFC42.DLL		3081
MFC42.DLL		2976
MFC42.DLL		3830
MFC42.DLL		3831
MFC42.DLL		3825
MFC42.DLL		3079
MFC42.DLL		4080
MFC42.DLL		4622
MFC42.DLL		4424
MFC42.DLL		3738
MFC42.DLL		561
MFC42.DLL		815
MFC42.DLL		641
MFC42.DLL		2514
MFC42.DLL		2621
MFC42.DLL		1134
MFC42.DLL		2725
MFC42.DLL		5265
MFC42.DLL		4376
MFC42.DLL		4853
MFC42.DLL		4998
MFC42.DLL		6052
MFC42.DLL		4078
MFC42.DLL		1775
MFC42.DLL		4407
MFC42.DLL		4698
MFC42.DLL		2385
MFC42.DLL		5163
MFC42.DLL		6374
MFC42.DLL		4353
MFC42.DLL		5280
MFC42.DLL		3798
MFC42.DLL		4837
MFC42.DLL		4441
MFC42.DLL		2648
MFC42.DLL		2055
MFC42.DLL		6376
MFC42.DLL		3749
MFC42.DLL		5065
MFC42.DLL		1727
MFC42.DLL		5261
MFC42.DLL		2446
MFC42.DLL		2124
MFC42.DLL		5277
MFC42.DLL		4627
MFC42.DLL		4425
MFC42.DLL		3597
MFC42.DLL		1146
MFC42.DLL		1168
MFC42.DLL		324
MFC42.DLL		4234
MFC42.DLL		6215
MFC42.DLL		4299
MFC42.DLL		922
MFC42.DLL		1768
MFC42.DLL		4287
MFC42.DLL		4710
MFC42.DLL		2379
MFC42.DLL		755
MFC42.DLL		470
MFC42.DLL		1200
MFC42.DLL		4079
MFC42.DLL		5302
MFC42.DLL		5300
MFC42.DLL		3346
MFC42.DLL		2396
MFC42.DLL		5199
MFC42.DLL		1089
MFC42.DLL		3922
MFC42.DLL		5731
MFC42.DLL		2512
MFC42.DLL		2554
MFC42.DLL		4486
MFC42.DLL		6375
MFC42.DLL		4274
MFC42.DLL		4673
MFC42.DLL		6883
MFC42.DLL		6877
MFC42.DLL		6663
MFC42.DLL		541
MFC42.DLL		2764
MFC42.DLL		801
MFC42.DLL		4277
MFC42.DLL		6143
MFC42.DLL		5861
MFC42.DLL		5683
MFC42.DLL		924
MFC42.DLL		4278
MFC42.DLL		536
MFC42.DLL		5710
MFC42.DLL		941
MFC42.DLL		4129
MFC42.DLL		823
MFC42.DLL		825
MFC42.DLL		5572
MFC42.DLL		2614
MFC42.DLL		389
MFC42.DLL		1228
MFC42.DLL		3229
MFC42.DLL		5204
MFC42.DLL		5808
MFC42.DLL		5356
MFC42.DLL		5353
MFC42.DLL		2915
MFC42.DLL		860
MFC42.DLL		2393
MFC42.DLL		1988
MFC42.DLL		690
MFC42.DLL		537
MFC42.DLL		540
MFC42.DLL		2818
MFC42.DLL		926
MFC42.DLL		858
MFC42.DLL		800
MFC42.DLL		939
MFC42.DLL		4204
MFC42.DLL		5241
MFC42.DLL		535
MFC42.DLL		1576
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	106		__p__commode
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	271		_initterm
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	143		_acmdln
MSVCRT.dll	585		exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	390		_onexit
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	573		atoi
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	65		_CxxThrowException
MSVCRT.dll	345		_mbscmp
MSVCRT.dll	441		_splitpath
MSVCRT.dll	351		_mbsicmp
MSVCRT.dll	14		public: virtual __thiscall type_info::~type_info(void) ??1type_info@@UAE@XZ
MSVCRT.dll	183		_controlfp
KERNEL32.dll	369		GetLastError
KERNEL32.dll	381		GetModuleFileNameA
KERNEL32.dll	131		DeleteFileA
KERNEL32.dll	350		GetFileAttributesA
KERNEL32.dll	383		GetModuleHandleA
KERNEL32.dll	227		FindResourceA
KERNEL32.dll	853		SizeofResource
KERNEL32.dll	599		LoadResource
KERNEL32.dll	613		LockResource
KERNEL32.dll	932		WriteFile
KERNEL32.dll	83		CreateFileA
KERNEL32.dll	355		GetFileSize
KERNEL32.dll	693		ReadFile
KERNEL32.dll	52		CloseHandle
KERNEL32.dll	917		WinExec
KERNEL32.dll	885		UpdateResourceA
KERNEL32.dll	150		EndUpdateResourceA
KERNEL32.dll	594		LoadLibraryA
KERNEL32.dll	416		GetProcAddress
KERNEL32.dll	248		FreeLibrary
KERNEL32.dll	344		GetEnvironmentVariableA
KERNEL32.dll	437		GetShortPathNameA
KERNEL32.dll	412		GetPrivateProfileStringA
KERNEL32.dll	511		GlobalFree
KERNEL32.dll	522		GlobalUnlock
KERNEL32.dll	515		GlobalLock
KERNEL32.dll	504		GlobalAlloc
KERNEL32.dll	854		Sleep
KERNEL32.dll	790		SetEvent
KERNEL32.dll	79		CreateEventA
KERNEL32.dll	67		CopyFileA
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	664		Process32Next
KERNEL32.dll	912		WaitForSingleObject
KERNEL32.dll	862		TerminateProcess
KERNEL32.dll	646		OpenProcess
KERNEL32.dll	662		Process32First
KERNEL32.dll	114		CreateToolhelp32Snapshot
KERNEL32.dll	102		CreateProcessA
KERNEL32.dll	32		BeginUpdateResourceA
KERNEL32.dll	604		LocalFree
USER32.dll	571		SendMessageA
USER32.dll	446		LoadIconA
USER32.dll	182		DrawIcon
USER32.dll	255		GetClientRect
USER32.dll	349		GetSystemMetrics
USER32.dll	422		IsIconic
USER32.dll	252		GetClassNameA
USER32.dll	437		KillTimer
USER32.dll	196		EnableWindow
USER32.dll	634		SetTimer
USER32.dll	727		wsprintfA
USER32.dll	479		MessageBoxA
ADVAPI32.dll	503		RegQueryValueExA
ADVAPI32.dll	516		RegSetValueExA
ADVAPI32.dll	491		RegOpenKeyA
ADVAPI32.dll	464		RegCreateKeyA
ADVAPI32.dll	459		RegCloseKey
SHELL32.dll	263		ShellExecuteA
SHELL32.dll	183		SHGetMalloc
SHELL32.dll	195		SHGetSpecialFolderLocation
SHELL32.dll	188		SHGetPathFromIDListA
ole32.dll	16		CoCreateInstance
ole32.dll	105		CoUninitialize
ole32.dll	59		CoInitialize
ole32.dll	253		OleRun
OLEAUT32.dll		9
OLEAUT32.dll		200
WININET.dll	146		InternetOpenA
WININET.dll	147		InternetOpenUrlA
WININET.dll	105		InternetCloseHandle

StringTable 041204b0

Comments
CompanyName
FileDescription
FileVersion
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductName
ProductVersion
SpecialBuild

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	147456	EXE	02/23/2009 07:39:24	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

BigfileSearchUpdate(Malware Obejct Top #2).exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 041204b0

VS_FIXEDFILEINFO

BigfileSearchUpdate(Malware Obejct Top #2).exe
-