filenamekuplay.exe?_upd=tinupo_422_44.exe
size470215 (0x72cc7)
md5e23b5f3c95801e8198ab227685e07a13
typePE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
mimetypeapplication/x-dosexec
clamavTrojan.Dropper-25041 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
9540352
10155
93403517
10816812
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4a3ab298
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x5c00
SizeOfInitializedData0x39bc00
SizeOfUninitializedData0x400
AddressOfEntryPoint0x3134
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion6.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x3b5000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Nullsoft install system v2.x

Sections

namevavsizeraw sizeflags
.text0x10000x5b760x5c00R-X CODE
.rdata0x70000x11900x1200R-- IDATA
.data0x90000x3997980x400RW- IDATA
.ndata0x3a30000xb0000RW- UDATA
.rsrc0x3ae0000x68f00x6a00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x73a40xb4
RESOURCE0x3ae0000x68f0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x70000x28c
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#196400
ICON#242640
ICON#337520
ICON#422160
ICON#513840
ICON#611280
DIALOG#1055140
DIALOG#1062480
DIALOG#1112380
DIALOG#2054940
DIALOG#2062280
DIALOG#2112180
DIALOG#3054980
DIALOG#3062320
DIALOG#3112220
GROUP_ICON#103900
MANIFEST#15330
module_namehintordfunction_name
KERNEL32.dll54CompareFileTime
KERNEL32.dll712SearchPathA
KERNEL32.dll426GetShortPathNameA
KERNEL32.dll353GetFullPathNameA
KERNEL32.dll605MoveFileA
KERNEL32.dll759SetCurrentDirectoryA
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll360GetLastError
KERNEL32.dll71CreateDirectoryA
KERNEL32.dll772SetFileAttributesA
KERNEL32.dll830Sleep
KERNEL32.dll465GetTickCount
KERNEL32.dll347GetFileSize
KERNEL32.dll371GetModuleFileNameA
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll63CopyFileA
KERNEL32.dll182ExitProcess
KERNEL32.dll485GetWindowsDirectoryA
KERNEL32.dll778SetFileTime
KERNEL32.dll265GetCommandLineA
KERNEL32.dll768SetErrorMode
KERNEL32.dll577LoadLibraryA
KERNEL32.dll944lstrcpynA
KERNEL32.dll325GetDiskFreeSpaceA
KERNEL32.dll508GlobalUnlock
KERNEL32.dll501GlobalLock
KERNEL32.dll108CreateThread
KERNEL32.dll98CreateProcessA
KERNEL32.dll690RemoveDirectoryA
KERNEL32.dll79CreateFileA
KERNEL32.dll454GetTempFileNameA
KERNEL32.dll947lstrlenA
KERNEL32.dll932lstrcatA
KERNEL32.dll438GetSystemDirectoryA
KERNEL32.dll474GetVersion
KERNEL32.dll49CloseHandle
KERNEL32.dll938lstrcmpiA
KERNEL32.dll935lstrcmpA
KERNEL32.dll185ExpandEnvironmentStringsA
KERNEL32.dll497GlobalFree
KERNEL32.dll490GlobalAlloc
KERNEL32.dll890WaitForSingleObject
KERNEL32.dll338GetExitCodeProcess
KERNEL32.dll373GetModuleHandleA
KERNEL32.dll578LoadLibraryExA
KERNEL32.dll407GetProcAddress
KERNEL32.dll240FreeLibrary
KERNEL32.dll612MultiByteToWideChar
KERNEL32.dll912WritePrivateProfileStringA
KERNEL32.dll403GetPrivateProfileStringA
KERNEL32.dll907WriteFile
KERNEL32.dll675ReadFile
KERNEL32.dll611MulDiv
KERNEL32.dll774SetFilePointer
KERNEL32.dll204FindClose
KERNEL32.dll217FindNextFileA
KERNEL32.dll208FindFirstFileA
KERNEL32.dll129DeleteFileA
KERNEL32.dll456GetTempPathA
USER32.dll198EndDialog
USER32.dll561ScreenToClient
USER32.dll372GetWindowRect
USER32.dll194EnableMenuItem
USER32.dll348GetSystemMenu
USER32.dll583SetClassLongA
USER32.dll428IsWindowEnabled
USER32.dll643SetWindowPos
USER32.dll346GetSysColor
USER32.dll366GetWindowLongA
USER32.dll589SetCursor
USER32.dll439LoadCursorA
USER32.dll56CheckDlgButton
USER32.dll316GetMessagePos
USER32.dll437LoadBitmapA
USER32.dll27CallWindowProcA
USER32.dll431IsWindowVisible
USER32.dll66CloseClipboard
USER32.dll586SetClipboardData
USER32.dll193EmptyClipboard
USER32.dll534RegisterClassA
USER32.dll676TrackPopupMenu
USER32.dll8AppendMenuA
USER32.dll94CreatePopupMenu
USER32.dll349GetSystemMetrics
USER32.dll595SetDlgItemTextA
USER32.dll275GetDlgItemTextA
USER32.dll479MessageBoxIndirectA
USER32.dll45CharPrevA
USER32.dll161DispatchMessageA
USER32.dll509PeekMessageA
USER32.dll153DestroyWindow
USER32.dll85CreateDialogParamA
USER32.dll634SetTimer
USER32.dll646SetWindowTextA
USER32.dll513PostQuitMessage
USER32.dll599SetForegroundWindow
USER32.dll728wsprintfA
USER32.dll574SendMessageTimeoutA
USER32.dll228FindWindowExA
USER32.dll665SystemParametersInfoA
USER32.dll96CreateWindowExA
USER32.dll246GetClassInfoA
USER32.dll158DialogBoxParamA
USER32.dll42CharNextA
USER32.dll499OpenClipboard
USER32.dll225ExitWindowsEx
USER32.dll427IsWindow
USER32.dll273GetDlgItem
USER32.dll640SetWindowLongA
USER32.dll445LoadImageA
USER32.dll268GetDC
USER32.dll196EnableWindow
USER32.dll403InvalidateRect
USER32.dll571SendMessageA
USER32.dll142DefWindowProcA
USER32.dll13BeginPaint
USER32.dll255GetClientRect
USER32.dll226FillRect
USER32.dll188DrawTextA
USER32.dll200EndPaint
USER32.dll658ShowWindow
GDI32.dll533SetBkColor
GDI32.dll363GetDeviceCaps
GDI32.dll143DeleteObject
GDI32.dll41CreateBrushIndirect
GDI32.dll58CreateFontIndirectA
GDI32.dll534SetBkMode
GDI32.dll572SetTextColor
GDI32.dll526SelectObject
SHELL32.dll188SHGetPathFromIDListA
SHELL32.dll121SHBrowseForFolderA
SHELL32.dll172SHGetFileInfoA
SHELL32.dll263ShellExecuteA
SHELL32.dll154SHFileOperationA
SHELL32.dll195SHGetSpecialFolderLocation
ADVAPI32.dll493RegQueryValueExA
ADVAPI32.dll506RegSetValueExA
ADVAPI32.dll470RegEnumKeyA
ADVAPI32.dll474RegEnumValueA
ADVAPI32.dll483RegOpenKeyExA
ADVAPI32.dll465RegDeleteKeyA
ADVAPI32.dll467RegDeleteValueA
ADVAPI32.dll458RegCloseKey
ADVAPI32.dll462RegCreateKeyExA
COMCTL32.dll52ImageList_AddMasked
COMCTL32.dll56ImageList_Destroy
COMCTL32.dll17
COMCTL32.dll55ImageList_Create
ole32.dll100CoTaskMemFree
ole32.dll252OleInitialize
ole32.dll275OleUninitialize
ole32.dll16CoCreateInstance
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dll10VerQueryValueA
offsetsizetypecomment
057344EXE06/18/2009 21:33:12#
15c115HTM#
e000412871BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 470215 bytes (460 KiB)


--
Type = Nsis
Physical Size = 470215
Method = BZip2
Solid = -
Headers Size = 35843
Embedded Stub Size = 57344
SubType = NSIS-2

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2012-10-17 01:27:38 .....                    366997  play.exe
                    .....                      1685  $PLUGINSDIR/FindProcDLL.dll
                    .....                     10581  $PLUGINSDIR/inetc.dll
                    .....                      6564  $PLUGINSDIR/System.dll
                    .....                      5058  uninst.exe
------------------- ----- ------------ ------------  ------------------------
2012-10-17 01:27:38                          390885  5 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK