filename0e829513658a891006163ccbf24efc292e42cc291af85b957c1603733f0c99d4
size17408 (0x4400)
md5e83f60fb0e0396ea309faf0aed64e53f
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Downloader-74679 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1472991
10816811
481682
93403515
10102
1181684
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x498a91b9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x2600
SizeOfInitializedData0x1a00
SizeOfUninitializedData0
AddressOfEntryPoint0x3392
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x7000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x25520x2600R-X CODE
.rdata0x40000xb700xc00R-- IDATA
.data0x50000x8ac0xa00RW- IDATA
.rsrc0x60000x3880x400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x42180xb4
RESOURCE0x60000x388
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x1b0
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18040
module_namehintordfunction_name
KERNEL32.dll298GetConsoleDisplayMode
KERNEL32.dll693ReadFile
KERNEL32.dll657PeekNamedPipe
KERNEL32.dll346GetExitCodeProcess
KERNEL32.dll102CreateProcessA
KERNEL32.dll350GetFileAttributesA
KERNEL32.dll449GetSystemDirectoryA
KERNEL32.dll188ExpandEnvironmentStringsA
KERNEL32.dll823SetStdHandle
KERNEL32.dll491GetVolumeInformationA
KERNEL32.dll339GetDriveTypeA
KERNEL32.dll957lstrcatA
KERNEL32.dll376GetLogicalDrives
KERNEL32.dll664Process32Next
KERNEL32.dll10AllocConsole
KERNEL32.dll114CreateToolhelp32Snapshot
KERNEL32.dll646OpenProcess
KERNEL32.dll932WriteFile
KERNEL32.dll355GetFileSize
KERNEL32.dll371GetLocalTime
KERNEL32.dll489GetVersionExA
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll96CreateMutexA
KERNEL32.dll67CopyFileA
KERNEL32.dll75CreateDirectoryA
KERNEL32.dll185ExitProcess
KERNEL32.dll972lstrlenA
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll83CreateFileA
KERNEL32.dll922WriteConsoleInputA
KERNEL32.dll276GetComputerNameA
KERNEL32.dll854Sleep
KERNEL32.dll101CreatePipe
KERNEL32.dll499GetWindowsDirectoryA
KERNEL32.dll778SetCurrentDirectoryA
KERNEL32.dll111CreateThread
KERNEL32.dll912WaitForSingleObject
KERNEL32.dll52CloseHandle
KERNEL32.dll862TerminateProcess
KERNEL32.dll662Process32First
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll369GetLastError
MSVCRT.dll709strstr
MSVCRT.dll453_strnicmp
MSVCRT.dll695strchr
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll183_controlfp
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll702strlen
MSVCRT.dll698strcpy
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll690sprintf
MSVCRT.dll573atoi
MSVCRT.dll445_strcmpi
MSVCRT.dll574atol
MSVCRT.dll694strcat
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll66_EH_prolog
MSVCRT.dll665memset
MSVCRT.dll693sscanf
MSVCRT.dll663memcpy
MSVCRT.dll707strrchr
WININET.dll152InternetQueryOptionA
WININET.dll146InternetOpenA
WININET.dll89HttpSendRequestA
WININET.dll111InternetConnectA
WININET.dll85HttpOpenRequestA
WININET.dll80HttpAddRequestHeadersA
WININET.dll105InternetCloseHandle
WININET.dll147InternetOpenUrlA
WININET.dll167InternetSetOptionA
WININET.dll154InternetReadFile
USERENV.dll29GetUserProfileDirectoryA
ADVAPI32.dll62CloseServiceHandle
ADVAPI32.dll429OpenSCManagerA
ADVAPI32.dll66ControlService
ADVAPI32.dll431OpenServiceA
ADVAPI32.dll585StartServiceA
ADVAPI32.dll95CreateProcessAsUserA
ADVAPI32.dll428OpenProcessToken
ADVAPI32.dll292GetUserNameA
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll472RegDeleteValueA
ADVAPI32.dll465RegCreateKeyExA
ADVAPI32.dll211EnumServicesStatusExA
urlmon.dll74URLDownloadToFileA
SHELL32.dll263ShellExecuteA
Secur32.dll24GetUserNameExA

StringTable 040904e4

Comments
CompanyNameAdobe Systems Incorporated
FileDescriptionAdobe Acrobat SpeedLauncher
FileVersion8, 0, 0, 0
LegalCopyrightCopyright Adobe Systems Incorporated 2004
OriginalFilenameAcroSpeedLaunch.exe
ProductNameAdobe Acrobat
ProductVersion8, 0, 0, 0

VS_FIXEDFILEINFO

FileVersion8.0.0.0
ProductVersion8.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
017408EXE02/05/2009 07:14:01#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK