jjwbsh.exe - WIN.Trojan.Shiz-88

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	jjwbsh.exe
size	308736 (0x4b600)
md5	e1d9be15a61363e06f4170a21899bd03

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	WIN.Trojan.Shiz-88 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	0
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 4d 5a 90 00 03 00 00 00  00 00 00 00 ff ff 00 00  |MZ..............|
00000010: b8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  |........@.......|
00000020: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030: 00 00 00 00 00 00 00 00  00 00 00 00 80 00 00 00  |................|
00000040: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000050: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000060: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000070: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x26b5f140
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	9.14
SizeOfCode	0x4600
SizeOfInitializedData	0x46c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x38fc
BaseOfCode	0x1000
BaseOfData	0
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	3.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1d9000
SizeOfHeaders	0x400
CheckSum	0x13e7beb6
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4444	0x4600	R-X CODE
.bss	0x6000	0x9d2b7	0x7000	RW- IDATA
.reloc	0xa4000	0xed2fd	0x2d800	R-- IDATA
.rdata	0x192000	0x1056	0x1200	R-- IDATA
.data	0x194000	0x3fdf5	0xea00	RW- IDATA
.rsrc	0x1d4000	0x4099	0x2800	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x19225c	0xb4
RESOURCE	0x1d4000	0x4099
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x1d4000	0x6ebff2
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x192000	0x260
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
VERSION.dll	268	GetFileVersionInfoSizeW
VERSION.dll	146	VerQueryValueW
VERSION.dll	198	GetFileVersionInfoW
IPHLPAPI.DLL	206	GetAdaptersInfo
SHELL32.DLL	293	SHGetFolderPathW
SHELL32.DLL	12	ShellExecuteExW
USER32.dll	260	MessageBoxA
USER32.dll	84	SetWindowLongW
ADVAPI32.DLL	134	RegCreateKeyExW
ADVAPI32.DLL	172	OpenSCManagerW
ADVAPI32.DLL	85	RegOpenKeyExW
ADVAPI32.DLL	202	RegCloseKey
ADVAPI32.DLL	179	DeleteService
ADVAPI32.DLL	251	QueryServiceStatus
ADVAPI32.DLL	285	StartServiceW
ADVAPI32.DLL	204	RegQueryValueExW
ADVAPI32.DLL	180	RegEnumValueW
ADVAPI32.DLL	116	CreateServiceW
ADVAPI32.DLL	88	SetServiceStatus
ADVAPI32.DLL	178	ChangeServiceConfig2W
ADVAPI32.DLL	210	RegisterServiceCtrlHandlerW
ADVAPI32.DLL	42	ReportEventW
ADVAPI32.DLL	170	ChangeServiceConfigW
ADVAPI32.DLL	191	DeregisterEventSource
ADVAPI32.DLL	129	RegDeleteKeyW
ADVAPI32.DLL	239	CloseServiceHandle
ADVAPI32.DLL	110	ControlService
ADVAPI32.DLL	31	RegDeleteValueW
ADVAPI32.DLL	290	RegEnumKeyExW
ADVAPI32.DLL	73	QueryServiceConfigW
ADVAPI32.DLL	284	RegisterEventSourceW
ADVAPI32.DLL	131	StartServiceCtrlDispatcherW
ADVAPI32.DLL	274	OpenServiceW
ADVAPI32.DLL	253	RegSetValueExW
ADVAPI32.DLL	145	RegQueryInfoKeyW
KERNEL32.DLL	242	TlsGetValue
KERNEL32.DLL	159	GetLogicalDriveStringsW
KERNEL32.DLL	100	CopyFileW
KERNEL32.DLL	258	HeapReAlloc
KERNEL32.DLL	237	HeapFree
KERNEL32.DLL	192	MoveFileExW
KERNEL32.DLL	169	GetModuleHandleA
KERNEL32.DLL	299	GetProcessHeap
KERNEL32.DLL	180	ExpandEnvironmentStringsW
KERNEL32.DLL	16	LeaveCriticalSection
KERNEL32.DLL	298	GetCommandLineW
KERNEL32.DLL	173	GetTempFileNameW
KERNEL32.DLL	242	SetEnvironmentVariableA
KERNEL32.DLL	110	IsDebuggerPresent
KERNEL32.DLL	131	IsValidLocale
KERNEL32.DLL	281	HeapAlloc
KERNEL32.DLL	147	GetTempPathW
KERNEL32.DLL	298	SetEnvironmentVariableW
KERNEL32.DLL	43	GetFileType
KERNEL32.DLL	250	GetTempPathA
KERNEL32.DLL	245	SetFileAttributesW
KERNEL32.DLL	164	GetACP
KERNEL32.DLL	219	ResetEvent
KERNEL32.DLL	100	SetEndOfFile
KERNEL32.DLL	97	TlsSetValue
KERNEL32.DLL	179	MoveFileW
KERNEL32.DLL	227	VirtualAlloc
KERNEL32.DLL	290	SetFilePointer
KERNEL32.DLL	189	HeapSize
KERNEL32.DLL	262	GetCurrentDirectoryW
KERNEL32.DLL	100	LocalAlloc
KERNEL32.DLL	207	GetStdHandle
KERNEL32.DLL	101	VirtualFree
KERNEL32.DLL	255	TlsFree
KERNEL32.DLL	237	LCMapStringA
KERNEL32.DLL	104	CompareStringA
KERNEL32.DLL	129	RtlUnwind
KERNEL32.DLL	24	EnterCriticalSection
KERNEL32.DLL	59	CreateDirectoryW
KERNEL32.DLL	246	LocalFree
KERNEL32.DLL	259	ReadFile
KERNEL32.DLL	206	RaiseException
KERNEL32.DLL	138	FlushFileBuffers
KERNEL32.DLL	213	OpenProcess
KERNEL32.DLL	224	WaitForMultipleObjects
KERNEL32.DLL	138	IsValidCodePage
KERNEL32.DLL	28	CreateFileA
KERNEL32.DLL	218	GetComputerNameW
KERNEL32.DLL	171	LCMapStringW
KERNEL32.DLL	128	FindClose
KERNEL32.DLL	281	GetSystemInfo
KERNEL32.DLL	289	CreateFileW
KERNEL32.DLL	150	DeleteFileW
KERNEL32.DLL	112	SetLastError
KERNEL32.DLL	51	GetCurrentThreadId
KERNEL32.DLL	186	SetThreadPriority
KERNEL32.DLL	225	EnumSystemLocalesA
KERNEL32.DLL	279	CreatePipe
KERNEL32.DLL	271	FindNextFileW
KERNEL32.DLL	77	CreateThread
KERNEL32.DLL	164	GetExitCodeThread
KERNEL32.DLL	279	FreeLibrary
KERNEL32.DLL	288	CreateMutexW
KERNEL32.DLL	236	WriteConsoleW
KERNEL32.DLL	237	DeleteCriticalSection
KERNEL32.DLL	98	GetSystemTimeAsFileTime
KERNEL32.DLL	271	GetFileAttributesExW
KERNEL32.DLL	54	WideCharToMultiByte
KERNEL32.DLL	32	FindFirstFileW
KERNEL32.DLL	291	TlsAlloc
KERNEL32.DLL	10	ExitThread
KERNEL32.DLL	75	WriteConsoleA
KERNEL32.DLL	260	GetConsoleCP
KERNEL32.DLL	13	GetUserDefaultLCID
KERNEL32.DLL	250	ReleaseMutex
KERNEL32.DLL	290	GetModuleHandleW
KERNEL32.DLL	40	SetConsoleCtrlHandler
KERNEL32.DLL	29	GetOEMCP
KERNEL32.DLL	69	CreateEventW
KERNEL32.DLL	183	GetProcessTimes
KERNEL32.DLL	69	GetTimeZoneInformation
KERNEL32.DLL	21	UnhandledExceptionFilter
KERNEL32.DLL	24	TryEnterCriticalSection
KERNEL32.DLL	209	SetStdHandle
KERNEL32.DLL	228	FreeEnvironmentStringsW
KERNEL32.DLL	266	SetFileTime
KERNEL32.DLL	236	CompareStringW
KERNEL32.DLL	176	WriteFile
KERNEL32.DLL	238	RemoveDirectoryW
KERNEL32.DLL	179	CreateProcessW
KERNEL32.DLL	143	InitializeCriticalSectionAndSpinCount
KERNEL32.DLL	56	CloseHandle
KERNEL32.DLL	41	SetHandleCount
KERNEL32.DLL	155	DuplicateHandle
KERNEL32.DLL	210	GetConsoleOutputCP
KERNEL32.DLL	203	SetUnhandledExceptionFilter
KERNEL32.DLL	10	GetConsoleMode
KERNEL32.DLL	267	WaitForSingleObject
KERNEL32.DLL	36	GetLocalTime
KERNEL32.DLL	73	VirtualAllocEx
COMCTL32.DLL	159	CreateStatusWindow
COMCTL32.DLL	141	ImageList_GetFlags
COMCTL32.DLL	184	ImageList_Add
COMCTL32.DLL	52	ImageList_Merge
COMCTL32.DLL	183	ImageList_LoadImageW
COMCTL32.DLL	143	ImageList_SetBkColor
COMCTL32.DLL	222	DrawStatusText
COMCTL32.DLL	145	FlatSB_EnableScrollBar
syssetup.dll	29	SetupChangeFontSize
syssetup.dll	9584	19 \|. \|

show previews

offset	size	type	comment
0	308736	EXE	07/31/1990 20:59:44	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

jjwbsh.exe-

MZ Header

DOS stub

PE Header

Sections

Data Directory

jjwbsh.exe
-