malo.exe - Trojan.Ransom-179

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	malo.exe
size	417804 (0x6600c)
md5	ec93c597a1235f217247e8312b95e7df

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Trojan.Ransom-179 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xb8

Rich Header

lib id	version	times used
13	8169	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4a4b378f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x3000
SizeOfInitializedData	0x55000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1090
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x59000
SizeOfHeaders	0x1000
CheckSum	0x65971
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual Basic v5.0/v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x22ac	0x3000	R-X CODE
.data	0x4000	0x380	0	RW- IDATA
.rsrc	0x5000	0x53dac	0x54000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3204	0x28
RESOURCE	0x5000	0x53dac
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0x228	0x2e0020
IAT	0x1000	0x38
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	25917	0
ICON	#2	10344	0
ICON	#3	1640	0
ICON	#4	744	0
ICON	#5	488	0
ICON	#6	296	0
ICON	#7	77414	0
ICON	#8	19496	0
ICON	#9	3752	0
ICON	#10	2216	0
ICON	#11	1736	0
ICON	#12	1384	0
ICON	#13	111165	0
ICON	#14	67624	0
ICON	#15	9640	0
ICON	#16	4264	0
ICON	#17	2440	0
ICON	#18	1128	0
GROUP_ICON	#1	258	1200
VERSION	#1	464	1200

module_name	hint	ord	function_name
MSVBVM60.dlL		16777732
MSVBVM60.dlL		16777848
MSVBVM60.dlL		16777742
MSVBVM60.dlL	1		DllFunctionCall
MSVBVM60.dlL			__vbaExceptHandler
MSVBVM60.dlL		16777927
MSVBVM60.dlL		16777824
MSVBVM60.dlL		16777933
MSVBVM60.dlL	1		ProcCallEngine
MSVBVM60.dlL		16777860
MSVBVM60.dlL		16777786
MSVBVM60.dlL		16777897
MSVBVM60.dlL		16777316

VS_FIXEDFILEINFO

FileVersion	1.0.0.0
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	360448	EXE	07/01/2009 10:16:47	#
15c1	15	HTM		#
4418	25917	PNG	(256 x 256)	#
de20	77414	PNG	(256 x 256)	#
27c30	111165	PNG	(256 x 256)	#
58000	57356	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] invalid VS_VERSIONINFO child type "\x00\x00\x00\x00\x00\x00"

[?] can't find file_offset of VA 0x228

malo.exe-