filenameugzus.exe
size210944 (0x33800)
md5f6c72fb62cdabca88db8477696de0512
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavTrojan.Zbot-22038 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 2a fc 62 3f 6e 9d 0c 6c  6e 9d 0c 6c 6e 9d 0c 6c  |*.b?n..ln..ln..l|
00000050: 6b 91 03 6c ff 9d 0c 6c  94 b9 31 6c 61 9d 0c 6c  |k..l...l..1la..l|
00000060: 6e 9d 0d 6c 7c 9d 0c 6c  94 b9 11 6c 7f 9d 0c 6c  |n..l|..l...l...l|
00000070: 6b 91 53 6c a7 9d 0c 6c  3a be 3c 6c 0c 9d 0c 6c  |k.Sl...l:.

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4f9811ca
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x4c00
SizeOfInitializedData0x200
SizeOfUninitializedData0
AddressOfEntryPoint0x4df6
BaseOfCode0x1000
BaseOfData0x37000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion1.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x38000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x4b810x4c00R-X CODE
.rdata0x60000x2df400x2e000R-- IDATA
.data0x340000x20180x200RW- IDATA
.rsrc0x3700040x200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x32ff00x50
RESOURCE0x370004
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x60000x330
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
MSVCRT.dll4692_write
MSVCRT.dll550sscanf
MSVCRT.dll3643__getmainargs
MSVCRT.dll1161_execve
MSVCRT.dll4539_strtoui64
MSVCRT.dll4273_ltow
MSVCRT.dll4331_ismbclegal
MSVCRT.dll4431_c_exit
MSVCRT.dll1733_execlp
MSVCRT.dll969_spawnve
MSVCRT.dll1953_mbsspnp
MSVCRT.dll1615_ismbslead
MSVCRT.dll3147_strupr
MSVCRT.dll4951_sleep
MSVCRT.dll248_wfindfirsti64
MSVCRT.dll2593_snwprintf
MSVCRT.dll758_popen
MSVCRT.dll1553_wspawnvp
MSVCRT.dll2816__p__fmode
MSVCRT.dll2452_ftime
MSVCRT.dll723_waccess
MSVCRT.dll2494_ismbcupper
MSVCRT.dll1465_flsbuf
MSVCRT.dll571_putw
MSVCRT.dll2635_toupper
MSVCRT.dll384_getdrives
MSVCRT.dll1396_mbscoll
MSVCRT.dll734exit
MSVCRT.dll4197_mbscspn
MSVCRT.dll731fscanf
MSVCRT.dll3452iswascii
MSVCRT.dll3077_daylight
MSVCRT.dll4982_getche
MSVCRT.dll2269_time64
MSVCRT.dll1646strtol
MSVCRT.dll4695strcpy
MSVCRT.dll1840strlen
MSVCRT.dll2726memset
MSVCRT.dll3123_acmdln
MSVCRT.dll154_exit
MSVCRT.dll4843_adj_fdivr_m64
MSVCRT.dll4274_ui64toa
MSVCRT.dll3489iswlower
MSVCRT.dll4970wcslen
MSVCRT.dll4786_seh_longjmp_unwind
MSVCRT.dll523ctime
MSVCRT.dll3025_fpclass
MSVCRT.dll3163_adjust_fdiv
MSVCRT.dll916_controlfp
MSVCRT.dll3470_beginthreadex
MSVCRT.dll3814_fdopen
MSVCRT.dll604malloc
MSVCRT.dll2407__p__commode
MSVCRT.dll2030_XcptFilter
MSVCRT.dll720calloc
MSVCRT.dll3204_winmajor
MSVCRT.dll570_vsnprintf
MSVCRT.dll783_ismbbtrail
MSVCRT.dll1031strncpy
MSVCRT.dll4104_spawnle
MSVCRT.dll542_except_handler3
MSVCRT.dll27_wfindnext64
MSVCRT.dll4995__set_app_type
MSVCRT.dll892_initterm
MSVCRT.dll2717_resetstkoflw
MSVCRT.dll1507wcscat
MSVCRT.dll395_mbsstr
MSVCRT.dll321_ismbbkprint
MSVCRT.dll94wcsftime
MSVCRT.dll3211strftime
MSVCRT.dll787_mbbtype
MSVCRT.dll1460_tzset
MSVCRT.dll2787_ismbbkana
MSVCRT.dll642_strtime
MSVCRT.dll1900_fileinfo
MSVCRT.dll1188memcpy
MSVCRT.dll2174sprintf
MSVCRT.dll1711_ismbcprint
MSVCRT.dll166strtok
MSVCRT.dll2481_longjmpex
MSVCRT.dll1536_mbsrchr
MSVCRT.dll4248__setusermatherr
MSVCRT.dll3841iscntrl
USER32.dll1419KillTimer
USER32.dll4872GetWindowRect
USER32.dll1414GetWindowDC
USER32.dll596IntersectRect
USER32.dll4472SetScrollInfo
USER32.dll1416BeginDeferWindowPos
USER32.dll3918EnableMenuItem
USER32.dll4187InsertMenuA
USER32.dll4951InvalidateRect
USER32.dll1717PostQuitMessage
USER32.dll1759GetUpdateRgn
USER32.dll2046RedrawWindow
USER32.dll2854DrawIconEx
USER32.dll4838InflateRect
USER32.dll3333SetDlgItemTextA
USER32.dll4729LoadImageA
USER32.dll1708GetDlgItem
USER32.dll3167GetMenu
USER32.dll4425CopyRect
USER32.dll1882SetWindowTextA
USER32.dll3719LoadIconA
USER32.dll1819GetDesktopWindow
USER32.dll2448IsDialogMessageA
USER32.dll4217SendMessageTimeoutA
USER32.dll991CallWindowProcA
USER32.dll224TrackPopupMenuEx
USER32.dll1400CheckDlgButton
USER32.dll3454LoadStringA
USER32.dll4064PostMessageA
USER32.dll4294GetKeyState
USER32.dll2601GetWindow
USER32.dll1795DestroyIcon
USER32.dll4861GetMessageA
USER32.dll1594GetCursorPos
USER32.dll3670GetWindowLongA
USER32.dll4880UnionRect
USER32.dll3784DefDlgProcA
USER32.dll2223TranslateAcceleratorA
USER32.dll25BeginPaint
USER32.dll4373GetMenuItemCount
USER32.dll924SendMessageA
USER32.dll555GetDlgCtrlID
USER32.dll2616ReleaseDC
USER32.dll4122CreateIconIndirect
USER32.dll3900TrackPopupMenu
USER32.dll2949ShowWindow
USER32.dll695IsDlgButtonChecked
USER32.dll689ReleaseCapture
USER32.dll3009MessageBoxA
USER32.dll1523wsprintfA
USER32.dll4087UpdateWindow
USER32.dll982EnumWindows
USER32.dll3121EndDialog
USER32.dll2077IsWindowVisible
USER32.dll1380PeekMessageA
USER32.dll3758CheckMenuRadioItem
KERNEL32.dll2946GetDateFormatA
KERNEL32.dll1100GetStringTypeW
KERNEL32.dll3162GetStringTypeA
KERNEL32.dll1934GlobalAlloc
KERNEL32.dll289RtlUnwind
KERNEL32.dll3519GetProcessAffinityMask
KERNEL32.dll3678GetConsoleCP
KERNEL32.dll4846GetStartupInfoA
KERNEL32.dll842SetEvent
KERNEL32.dll3814Module32Next
KERNEL32.dll1939Sleep
KERNEL32.dll4544UnhandledExceptionFilter
KERNEL32.dll2720VirtualAlloc
KERNEL32.dll174IsBadReadPtr
KERNEL32.dll3702GlobalUnlock
KERNEL32.dll605SearchPathA
KERNEL32.dll157GetModuleHandleA
KERNEL32.dll5GlobalMemoryStatus
KERNEL32.dll2410GetProcessWorkingSetSize
KERNEL32.dll330lstrcpynA
KERNEL32.dll393MapViewOfFile
KERNEL32.dll4659VirtualFree
KERNEL32.dll4879TlsGetValue
KERNEL32.dll1697lstrcpyA
KERNEL32.dll2451IsValidCodePage
KERNEL32.dll2988GetNumberFormatA
KERNEL32.dll2837GetTimeFormatA
KERNEL32.dll2146CreateEventA
KERNEL32.dll748GetConsoleMode
KERNEL32.dll3820GetOEMCP
KERNEL32.dll2196EnterCriticalSection
KERNEL32.dll180WaitForSingleObject
KERNEL32.dll2699lstrcatA
KERNEL32.dll4511GetCurrentDirectoryA
KERNEL32.dll3692LeaveCriticalSection
KERNEL32.dll4887lstrlenA
KERNEL32.dll3964GetCPInfo
KERNEL32.dll1594LocalFree
KERNEL32.dll430FindClose
KERNEL32.dll3131InterlockedIncrement
KERNEL32.dll76GetCurrentThread
KERNEL32.dll1924CloseHandle
KERNEL32.dll2408TlsSetValue
KERNEL32.dll2695HeapReAlloc
KERNEL32.dll3536FindFirstFileA
KERNEL32.dll1850GetProcAddress
KERNEL32.dll134FormatMessageA
KERNEL32.dll227InterlockedExchange
KERNEL32.dll2853TerminateProcess
KERNEL32.dll2107GetVersion
KERNEL32.dll415HeapAlloc
KERNEL32.dll2865OpenEventA
KERNEL32.dll923LockResource
KERNEL32.dll1853FreeLibrary
KERNEL32.dll2509SetLastError
KERNEL32.dll4824GetCurrentProcess
KERNEL32.dll3329GetModuleFileNameA
KERNEL32.dll3298FlushFileBuffers
KERNEL32.dll3798RaiseException
KERNEL32.dll4117InterlockedDecrement
KERNEL32.dll2983LCMapStringW
KERNEL32.dll1108FindResourceA
offsetsizetypecomment
0209920EXE04/25/2012 15:01:30#
15c115HTM#
334001024BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 210944 bytes (206 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[!] non-zero dos stub after rich_hdr: "\x11K\x00\x00\xB2\x10\x00\x00D\x17\x00\x00_g\x00\x00"