filenameSARansom.exe
size44032 (0xac00)
md5e756b5fe175e8e627584d908f1d39ddb
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-6646506-0 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
257259302
2612593023
2602593013
257252034
221406293
1092
260261281
255261281
258261281

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x5b685bf8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.13
SizeOfCode0x6400
SizeOfInitializedData0x4800
SizeOfUninitializedData0
AddressOfEntryPoint0x1041
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x10000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x62f30x6400R-X CODE
.rdata0x80000x21310x2200R-- IDATA
.data0xb0000x90c0x600RW- IDATA
.idata0xc0000xda30xe00R-- IDATA
.00cfg0xd0000x1040x200R-- IDATA
.rsrc0xe0000x4590x600R-- IDATA
.reloc0xf0000x5560x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xc2640x64
RESOURCE0xe0000x459
EXCEPTION00
SECURITY00
BASERELOC0xf0000x41c
DEBUG0x94f00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x95280x40
Bound_IAT00
IAT0xc0000x264
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#14060
module_namehintordfunction_name
libcrypto-1_1.dll1472EVP_CIPHER_CTX_new
libcrypto-1_1.dll1517EVP_CipherFinal
libcrypto-1_1.dll1521EVP_CipherUpdate
libcrypto-1_1.dll1519EVP_CipherInit
libcrypto-1_1.dll1781EVP_aes_256_cbc
libcrypto-1_1.dll1465EVP_CIPHER_CTX_free
libcrypto-1_1.dll1458EVP_CIPHER_CTX_block_size
KERNEL32.dll682GetProcAddress
KERNEL32.dll1115RaiseException
KERNEL32.dll1000MultiByteToWideChar
KERNEL32.dll1526WideCharToMultiByte
KERNEL32.dll1445UnhandledExceptionFilter
KERNEL32.dll1381SetUnhandledExceptionFilter
KERNEL32.dll533GetCurrentProcess
KERNEL32.dll425FreeLibrary
KERNEL32.dll371FindClose
KERNEL32.dll377FindFirstFileExW
KERNEL32.dll394FindNextFileW
KERNEL32.dll597GetFullPathNameW
KERNEL32.dll1412TerminateProcess
KERNEL32.dll897IsProcessorFeaturePresent
KERNEL32.dll1094QueryPerformanceCounter
KERNEL32.dll534GetCurrentProcessId
KERNEL32.dll538GetCurrentThreadId
KERNEL32.dll741GetSystemTimeAsFileTime
KERNEL32.dll862InitializeSListHead
KERNEL32.dll716GetStartupInfoW
KERNEL32.dll628GetModuleHandleW
KERNEL32.dll1478VirtualQuery
KERNEL32.dll688GetProcessHeap
KERNEL32.dll837HeapFree
KERNEL32.dll833HeapAlloc
KERNEL32.dll605GetLastError
KERNEL32.dll890IsDebuggerPresent
VCRUNTIME140D.dll46__vcrt_GetModuleFileNameW
VCRUNTIME140D.dll53_except_handler4_common
VCRUNTIME140D.dll72memset
VCRUNTIME140D.dll37__std_type_info_destroy_list
VCRUNTIME140D.dll76strstr
VCRUNTIME140D.dll49__vcrt_LoadLibraryExW
VCRUNTIME140D.dll47__vcrt_GetModuleHandleW
ucrtbased.dll354_get_initial_narrow_environment
ucrtbased.dll409_initterm
ucrtbased.dll410_initterm_e
ucrtbased.dll1141exit
ucrtbased.dll220_configure_narrow_argv
ucrtbased.dll758_set_fmode
ucrtbased.dll111__p___argc
ucrtbased.dll112__p___argv
ucrtbased.dll202_cexit
ucrtbased.dll197_c_exit
ucrtbased.dll738_register_thread_local_exe_atexit_callback
ucrtbased.dll219_configthreadlocale
ucrtbased.dll761_set_new_mode
ucrtbased.dll115__p__commode
ucrtbased.dll1352strcpy_s
ucrtbased.dll1348strcat_s
ucrtbased.dll142__stdio_common_vsprintf_s
ucrtbased.dll749_seh_filter_dll
ucrtbased.dll407_initialize_onexit_table
ucrtbased.dll737_register_onexit_function
ucrtbased.dll268_execute_onexit_table
ucrtbased.dll232_crt_atexit
ucrtbased.dll231_crt_at_quick_exit
ucrtbased.dll224_controlfp_s
ucrtbased.dll1381terminate
ucrtbased.dll968_wmakepath_s
ucrtbased.dll996_wsplitpath_s
ucrtbased.dll1406wcscpy_s
ucrtbased.dll406_initialize_narrow_environment
ucrtbased.dll129__setusermatherr
ucrtbased.dll753_set_app_type
ucrtbased.dll750_seh_filter_exe
ucrtbased.dll21_CrtDbgReportW
ucrtbased.dll20_CrtDbgReport
ucrtbased.dll1429wcstombs_s
ucrtbased.dll1281mbstowcs_s
ucrtbased.dll1272malloc
ucrtbased.dll1190free
ucrtbased.dll130__stdio_common_vfprintf
ucrtbased.dll1320remove
ucrtbased.dll1197fwrite
ucrtbased.dll1188fread
ucrtbased.dll1182fopen
ucrtbased.dll1150fclose
ucrtbased.dll69__acrt_iob_func
ucrtbased.dll1357strlen
ucrtbased.dll1351strcpy
ucrtbased.dll1349strcmp
ucrtbased.dll1347strcat
ucrtbased.dll756_set_errno
ucrtbased.dll273_exit
offsetsizetypecomment
044032EXE08/06/2018 14:32:24#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK