000a3abeeca2858ae09903b6d2d40432

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2012-Nov-12 03:46:25
Detected languages English - United States

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 8.0
Suspicious The PE contains functions most legitimate programs don't use. Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Suspicious The PE header may have been manually modified. The resource timestamps differ from the PE header:
  • 2020-Jan-19 06:48:30
Suspicious The file contains overlay data. 3072 bytes of data starting at offset 0x7400.
Malicious VirusTotal score: 46/56 (Scanned on 2016-03-07 20:32:54) Bkav: HW32.Packed.8C57
MicroWorld-eScan: Gen:Variant.Zusy.107719
nProtect: Trojan/W32.TDSS.32768.GF
CMC: Packed.Win32.TDSS!O
CAT-QuickHeal: Worm.Pondfull.B6
ALYac: Gen:Variant.Zusy.107719
Malwarebytes: Rootkit.TDSS
Zillya: Worm.AutoRun.Win32.102264
K7AntiVirus: Trojan ( 004a54ec1 )
K7GW: Trojan ( 004a54ec1 )
TheHacker: Trojan/TDSS.c
NANO-Antivirus: Trojan.Win32.TDSS.bdcsyv
F-Prot: W32/A-5f58ee87!Eldorado
ESET-NOD32: a variant of Win32/AutoRun.Inject.C
TrendMicro-HouseCall: WORM_STASER.SM
Avast: Win32:Evo-gen [Susp]
ClamAV: Win.Trojan.Agent-945226
Kaspersky: Packed.Win32.TDSS.c
BitDefender: Gen:Variant.Zusy.107719
Agnitum: Worm.AutoRun!kPqnRl2e8mk
ViRobot: Backdoor.Win32.Xtreme.32768[h]
AegisLab: Packer.W32.TDSS
Rising: PE:Worm.Win32.Pondfull.c!1615827 [F]
Ad-Aware: Gen:Variant.Zusy.107719
Sophos: Troj/TDSS-IW
Comodo: TrojWare.Win32.Injector.KWA
F-Secure: Gen:Variant.Zusy.107719
DrWeb: Trojan.Inject1.14023
VIPRE: Worm.Win32.Pondfull.b (v)
TrendMicro: WORM_STASER.SM
McAfee-GW-Edition: BehavesLike.Win32.Sality.nh
Emsisoft: Gen:Variant.Zusy.107719 (B)
Cyren: W32/A-5f58ee87!Eldorado
Jiangmin: Packed.Tdss.bsct
Avira: TR/Dropper.Gen
Fortinet: W32/Autorun.C!tr
Antiy-AVL: Trojan[Packed]/Win32.Tdss
Arcabit: Trojan.Zusy.D1A4C7
AhnLab-V3: Trojan/Win32.Tdss
Microsoft: Worm:Win32/Pondfull.B
McAfee: Packed-DW!000A3ABEECA2
AVware: Worm.Win32.Pondfull.b (v)
Ikarus: Packer.Win32.Tdss
GData: Gen:Variant.Zusy.107719
AVG: Dropper.Generic7.MPH
Qihoo-360: HEUR/QVM02.0.Malware.Gen

Hashes

MD5 000a3abeeca2858ae09903b6d2d40432
SHA1 355a25cd40cf47430aee21622a9d6075a49430f9
SHA256 a50c0503b07b71905cc475711d6b94a170b87c37e1e4da74aefef20282c6cd1e
SHA3 9b80588758271ed480ffd1d8df239b5815d84b49e66786da782234b5581bcd1e
SSDeep 384:TapCVUqG0qojW9KduW2rNy/dqX4lfonaZzlezHQpoDBoLlhBqzHk87BsGhH94tP:TUCRqol2py/i4oaZYzjs0zH8yiOO
Imports Hash fe8741966d12741c26614390abac5da1

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2012-Nov-12 03:46:25
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 2.0
SizeOfCode 0xc00
SizeOfInitializedData 0x7000
SizeOfUninitializedData 0x200
AddressOfEntryPoint 0x00001130 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x2000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 1.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xc000
SizeOfHeaders 0x400
Checksum 0x10173
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5cbf806537da0f52e98abc285852fa7e
SHA1 2859f9601c068e7e9e13a91e8fbbee51235f389e
SHA256 f064fed0225695ef0d6fd34f337dc448ca2ffe690a75f98c8e12c3a1af06e795
SHA3 e67efb480a98f7493cd2c351801ebfaca090bb5dec224a7892bebe15c0af5018
VirtualSize 0xad0
VirtualAddress 0x1000
SizeOfRawData 0xc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.59827

.data

MD5 93b0769ef354502253291d3f15b482f9
SHA1 be229b3d81036a076be2d68a267d1328be4fba2a
SHA256 5ca36bffb255d90c27d0ae9fbe8dc3b2f964371e651fca7a66638e9e6ab839f7
SHA3 ecfb5c1ee3179b094c14e25bd9425f120c0719fd5c10334ce910ec341927e662
VirtualSize 0x10
VirtualAddress 0x2000
SizeOfRawData 0x200
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.143459

.rdata

MD5 8bb6ba2ff7351291de57f3a4b1eef62a
SHA1 86feb337b8b6e331ed5b57af69a34a0531944c28
SHA256 3d35295c05d733c25b8b5beb606ebd38844e73f5b3c317a9ba8ec63dc1b050b4
SHA3 32c3509c3cd3a994f74e11c554d38a3edfb62903d120b327f6fa7d3093c2760f
VirtualSize 0x59e0
VirtualAddress 0x3000
SizeOfRawData 0x5a00
PointerToRawData 0x1200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.85253

.bss

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x60
VirtualAddress 0x9000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_2048BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_8BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata

MD5 6ca216d3cfe5b360e3afbdcb8655e5a8
SHA1 577143645b0a1a14b166f02e8a4f5cad18cd91f9
SHA256 ccca384e3c4f8843ad1ab566175ef076bcb1cbf42c5ee0df8c06dba078252aa4
SHA3 fe0294ef33cbd7dcca9872a58cbd7312673d576dcea0bac091abde45383c8e67
VirtualSize 0x35c
VirtualAddress 0xa000
SizeOfRawData 0x400
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.70582

.rsrc

MD5 70c55af810d8f55b0ad1204fed670368
SHA1 1f4fe6932b5939c3503c53a036ec989b265640b3
SHA256 98b8427507874eddda75fadfb999a53f7e59385b412218a4544bbd998947f236
SHA3 423f97412967be168f79c5aa2f73b862be3c98765a5dadcbaa56b57fee607aba
VirtualSize 0x204
VirtualAddress 0xb000
SizeOfRawData 0x400
PointerToRawData 0x7000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_ALIGN_1024BYTES
IMAGE_SCN_ALIGN_16BYTES
IMAGE_SCN_ALIGN_1BYTES
IMAGE_SCN_ALIGN_256BYTES
IMAGE_SCN_ALIGN_2BYTES
IMAGE_SCN_ALIGN_32BYTES
IMAGE_SCN_ALIGN_4096BYTES
IMAGE_SCN_ALIGN_4BYTES
IMAGE_SCN_ALIGN_512BYTES
IMAGE_SCN_ALIGN_64BYTES
IMAGE_SCN_ALIGN_8192BYTES
IMAGE_SCN_ALIGN_MASK
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.24179

Imports

KERNEL32.dll SetUnhandledExceptionFilter
ExitProcess
GetModuleHandleA
GetProcAddress
FreeConsole
VirtualAlloc
KERNEL32.dll (#2) SetUnhandledExceptionFilter
ExitProcess
GetModuleHandleA
GetProcAddress
FreeConsole
VirtualAlloc
msvcrt.dll __getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
free
malloc
memcpy
signal

Delayed Imports

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x1aa
TimeDateStamp 2020-Jan-19 06:48:30
Entropy 4.85824
MD5 42f1249b35daba792ca25f025f12bae1
SHA1 121525204a4654308350024549a855618e068d90
SHA256 b9fdb375a18d1712f3f7c50d0f6c721015815c713bfd55086b0eff50c722d5db
SHA3 a6bd9585ea5ce02dba7660d48c91cdac970f396a45e0ec59f39e5db320690853

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!
<-- -->