Virus.Win9x.Atom.4790 - CALC.EXE - Windows Calculator application file

info
MZ
PE
resources
strings
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	Virus.Win9x.Atom.4790
size	64182 (0xfab6)
md5	e9af9633c6cd8e405fef66a777119a0e

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Atom-5 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x2ff353db
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10e
Magic	0x10b
LinkerVersion	2.50
SizeOfCode	0x9800
SizeOfInitializedData	0x4c00
SizeOfUninitializedData	0xa00
AddressOfEntryPoint	0x13000
BaseOfCode	0x1000
BaseOfData	0xb000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x13000
SizeOfHeaders	0x400
CheckSum	0x12345678
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Free Pascal v1.06

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x96b0	0x9800	R-X CODE
.bss	0xb000	0x94c	0	RW- UDATA
.data	0xc000	0x1700	0x1800	RW- IDATA
.idata	0xe000	0xb64	0xc00	R-- IDATA
.rsrc	0xf000	0x15cc	0x1600	R-- IDATA
.reloc	0x11000	0x1040	0x1200	R-- IDATA DISCARDABLE
ATOMIC99	0x13000	0x12b6	0x1400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xe000	0xb64
RESOURCE	0xf000	0x15cc
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x11000	0xeb4
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	744
ICON	#2	296
MENU	SM	238
MENU	#4	40
DIALOG	SB	312
DIALOG	SC	502
STRING	#1	116
STRING	#2	86
STRING	#3	78
STRING	#4	118
STRING	#5	674
ACCELERATORS	SA	608
GROUP_ICON	SC	34
VERSION	#1	840

id	lang	string
0	1033	Sta
1	1033	Ave
2	1033	Sum
3	1033	s
4	1033	Dat
5	1033	F-E
6	1033	dms
7	1033	sin
8	1033	cos
9	1033	tan
10	1033	(
11	1033	Exp
12	1033	x^y
13	1033	x^3
14	1033	x^2
15	1033	)
16	1033	ln
17	1033	log
18	1033	n!
19	1033	1/x
20	1033	MC
21	1033	MR
22	1033	MS
23	1033	M+
24	1033	PI
25	1033	7
26	1033	4
27	1033	1
28	1033	0
29	1033	A
30	1033	8
31	1033	5
32	1033	2
33	1033	+/-
34	1033	B
35	1033	9
36	1033	6
37	1033	3
38	1033	.
39	1033	C
40	1033	/
41	1033	*
42	1033	-
43	1033	+
44	1033	D
45	1033	Mod
46	1033	Or
47	1033	Lsh
48	1033	sqrt
49	1033	%
50	1033	1/x
51	1033	=
52	1033	E
53	1033	And
54	1033	Xor
55	1033	Not
56	1033	Int
57	1033	F
58	1033	C
59	1033	CE
60	1033	Back
61	1033	Dword
62	1033	Word
63	1033	Byte
64	1033	Deg
65	1033	Rad
66	1033	Grad
67	1033	Cannot divide by zero.
68	1033	Invalid input for function.
69	1033	Result of function is undefined.
70	1033	Result is too large.
71	1033	Result is too small.
72	1033	calc.hlp
73	1033	Cannot open Clipboard.
74	1033	There is not enough memory for data. Close one or more programs, and then try again.
75	1033	stat
76	1033	Calculator
77	1033	Developed for Microsoft by Kraig Brockschmidt
78	1033	Not Enough Memory

module_name	hint	ord	function_name
SHELL32.dll	50		ShellAboutA
KERNEL32.dll	369		GlobalUnlock
KERNEL32.dll	352		GlobalAlloc
KERNEL32.dll	365		GlobalReAlloc
KERNEL32.dll	366		GlobalSize
KERNEL32.dll	353		GlobalCompact
KERNEL32.dll	359		GlobalFree
KERNEL32.dll	363		GlobalLock
KERNEL32.dll	706		lstrlenA
KERNEL32.dll	691		lstrcatA
KERNEL32.dll	676		WriteProfileStringA
KERNEL32.dll	270		GetModuleHandleA
KERNEL32.dll	311		GetStartupInfoA
KERNEL32.dll	240		GetEnvironmentStrings
KERNEL32.dll	192		GetCommandLineA
KERNEL32.dll	605		Sleep
KERNEL32.dll	694		lstrcmpA
KERNEL32.dll	306		GetProfileStringA
KERNEL32.dll	627		UnhandledExceptionFilter
KERNEL32.dll	268		GetModuleFileNameA
KERNEL32.dll	182		GetACP
KERNEL32.dll	280		GetOEMCP
KERNEL32.dll	185		GetCPInfo
KERNEL32.dll	313		GetStdHandle
KERNEL32.dll	253		GetFileType
KERNEL32.dll	639		VirtualFree
KERNEL32.dll	638		VirtualAlloc
KERNEL32.dll	482		RaiseException
KERNEL32.dll	450		MultiByteToWideChar
KERNEL32.dll	654		WideCharToMultiByte
KERNEL32.dll	293		GetProcAddress
KERNEL32.dll	260		GetLastError
KERNEL32.dll	417		LocalAlloc
KERNEL32.dll	424		LocalReAlloc
KERNEL32.dll	700		lstrcpyA
KERNEL32.dll	302		GetProfileIntA
KERNEL32.dll	337		GetTickCount
KERNEL32.dll	421		LocalFree
KERNEL32.dll	343		GetVersion
KERNEL32.dll	118		ExitProcess
KERNEL32.dll	506		RtlUnwind
KERNEL32.dll		1073179787
KERNEL32.dll		1073170692
KERNEL32.dll		1073335230
KERNEL32.dll		1073335264
KERNEL32.dll		1073170743
KERNEL32.dll		1073179821
KERNEL32.dll		1073179719
KERNEL32.dll		1073181265
KERNEL32.dll		1073181207
KERNEL32.dll		1073335157
KERNEL32.dll		1073181817
KERNEL32.dll		1073181968
KERNEL32.dll		1073251832
KERNEL32.dll		1073258567
KERNEL32.dll		1073287257
KERNEL32.dll		1073180972
KERNEL32.dll		1073182003
KERNEL32.dll		1073324639
KERNEL32.dll		1073181786
KERNEL32.dll		1073265695
KERNEL32.dll		1073276278
KERNEL32.dll		1073183518
KERNEL32.dll		1073174096
KERNEL32.dll		1073174369
KERNEL32.dll		1073224687
KERNEL32.dll		1073208040
KERNEL32.dll		1073335646
KERNEL32.dll		1073183441
KERNEL32.dll		1073183471
KERNEL32.dll		1073179672
KERNEL32.dll		1073228319
KERNEL32.dll		1073179855
KERNEL32.dll		1073181088
KERNEL32.dll		1073335046
KERNEL32.dll		1073178684
KERNEL32.dll		1073170976
KERNEL32.dll		1073288147
KERNEL32.dll		1073262512
KERNEL32.dll		1073241465
USER32.dll	549		WinHelpA
USER32.dll	216		GetDC
USER32.dll	292		GetWindowRect
USER32.dll	70		CreateDialogParamA
USER32.dll	49		CheckRadioButton
USER32.dll	360		LoadStringA
USER32.dll	406		RegisterClassExA
USER32.dll	276		GetSysColorBrush
USER32.dll	346		LoadCursorA
USER32.dll	350		LoadIconA
USER32.dll	454		SetDlgItemTextA
USER32.dll	221		GetDlgItem
USER32.dll	185		FillRect
USER32.dll	475		SetRect
USER32.dll	47		CheckMenuItem
USER32.dll	274		GetSubMenu
USER32.dll	243		GetMenu
USER32.dll	492		SetWindowPos
USER32.dll	366		MapDialogRect
USER32.dll	315		InvalidateRect
USER32.dll	457		SetFocus
USER32.dll	333		IsIconic
USER32.dll	275		GetSysColor
USER32.dll	128		DestroyMenu
USER32.dll	522		TrackPopupMenuEx
USER32.dll	356		LoadMenuA
USER32.dll	418		ReleaseCapture
USER32.dll	440		SetCapture
USER32.dll	220		GetDlgCtrlID
USER32.dll	165		EnableMenuItem
USER32.dll	327		IsClipboardFormatAvailable
USER32.dll	419		ReleaseDC
USER32.dll	425		ScreenToClient
USER32.dll	129		DestroyWindow
USER32.dll	400		PostQuitMessage
USER32.dll	120		DefWindowProcA
USER32.dll	373		MessageBeep
USER32.dll	294		GetWindowTextA
USER32.dll	153		DrawFrameControl
USER32.dll	207		GetClientRect
USER32.dll	502		ShowCursor
USER32.dll	448		SetCursor
USER32.dll	170		EndPaint
USER32.dll	150		DrawEdge
USER32.dll	9		BeginPaint
USER32.dll	55		CloseClipboard
USER32.dll	42		CharUpperA
USER32.dll	209		GetClipboardData
USER32.dll	391		OpenClipboard
USER32.dll	494		SetWindowTextA
USER32.dll	167		EnableWindow
USER32.dll	46		CheckDlgButton
USER32.dll	505		ShowWindow
USER32.dll	537		UpdateWindow
USER32.dll	80		CreateWindowExA
USER32.dll	431		SendMessageA
USER32.dll	342		LoadAcceleratorsA
USER32.dll	255		GetMessageA
USER32.dll	524		TranslateAcceleratorA
USER32.dll	527		TranslateMessage
USER32.dll	329		IsDialogMessageA
USER32.dll	134		DispatchMessageA
USER32.dll	374		MessageBoxA
USER32.dll		1073090806
USER32.dll		1073095519
USER32.dll		1073104237
USER32.dll		1073098132
USER32.dll		1073092256
USER32.dll		1073105676
USER32.dll		1073098001
USER32.dll		1073103775
USER32.dll		1073106831
USER32.dll		1073106809
USER32.dll		1073092145
USER32.dll		1073104150
USER32.dll		1073094712
USER32.dll		1073105236
USER32.dll		1073097622
USER32.dll		1073093196
USER32.dll		1073095387
USER32.dll		1073091702
USER32.dll		1073092289
USER32.dll		1073094706
USER32.dll		1073095495
USER32.dll		1073104535
USER32.dll		1073103742
USER32.dll		1073095609
USER32.dll		1073093433
USER32.dll		1073091145
USER32.dll		1073094036
USER32.dll		1073095503
USER32.dll		1073104208
USER32.dll		1073097630
USER32.dll		1073104911
USER32.dll		1073094482
USER32.dll		1073104423
USER32.dll		1073095569
USER32.dll		1073095553
USER32.dll		1073107243
USER32.dll		1073095617
USER32.dll		1073092376
USER32.dll		1073093103
USER32.dll		1073104301
USER32.dll		1073097832
USER32.dll		1073097562
USER32.dll		1073092496
USER32.dll		1073093109
USER32.dll		1073092415
USER32.dll		1073097544
USER32.dll		1073102933
USER32.dll		1073090917
USER32.dll		1073097840
USER32.dll		1073091848
USER32.dll		1073094502
USER32.dll		1073092225
USER32.dll		1073094490
USER32.dll		1073095593
USER32.dll		1073107407
USER32.dll		1073106358
USER32.dll		1073091149
USER32.dll		1073106109
USER32.dll		1073106210
USER32.dll		1073106153
USER32.dll		1073106300
USER32.dll		1073102431
USER32.dll		1073101017
GDI32.dll	188		GetStockObject
GDI32.dll	142		GetDeviceCaps
GDI32.dll	205		GetTextMetricsA
GDI32.dll	301		SetTextColor
GDI32.dll	268		SetBkColor
GDI32.dll	317		TextOutA
GDI32.dll	201		GetTextExtentPointA
GDI32.dll	269		SetBkMode
GDI32.dll	262		SelectObject
GDI32.dll	70		DeleteObject
GDI32.dll		1072907543
GDI32.dll		1072894799
GDI32.dll		1072894177
GDI32.dll		1072909625
GDI32.dll		1072909632
GDI32.dll		1072898473
GDI32.dll		1072896822
GDI32.dll		1072899303
GDI32.dll		1072898394
GDI32.dll		1072899231

StringTable 040904E4

CompanyName	Microsoft Corporation
FileDescription	Windows Calculator application file
FileVersion	4.00.950
InternalName	CALC
LegalCopyright	Copyright © Microsoft Corp. 1991-1995
OriginalFilename	CALC.EXE
ProductName	Microsoft® Windows® Operating System
ProductVersion	4.00.950

VS_FIXEDFILEINFO

FileVersion	4.0.0.950
ProductVersion	4.0.0.950
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x10001
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	64182	EXE	06/30/1995 01:31:07	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

Virus.Win9x.Atom.4790- -

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904E4

VS_FIXEDFILEINFO

Virus.Win9x.Atom.4790
-
-