16e83206b869e39e610f475a6d089725

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Sep-18 07:03:40
Detected languages English - United States
Debug artifacts 0\asf\release\build-2.2.14\support\Release\ab.pdb
Comments Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName Apache Software Foundation
FileDescription ApacheBench command line utility
FileVersion 2.2.14
InternalName ab.exe
LegalCopyright Copyright 2009 The Apache Software Foundation.
OriginalFilename ab.exe
ProductName Apache HTTP Server
ProductVersion 2.2.14

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Leverages the raw socket API to access the Internet:
  • WSARecv
  • WSASend
Suspicious The file contains overlay data. 74 bytes of data starting at offset 0x12000.
Malicious VirusTotal score: 52/70 (Scanned on 2019-01-06 18:11:11) Bkav: W32.FamVT.RorenNHc.Trojan
MicroWorld-eScan: Trojan.CryptZ.Gen
CAT-QuickHeal: Trojan.Swrort.A
McAfee: Swrort.i
Cylance: Unsafe
BitDefender: Trojan.CryptZ.Gen
K7GW: Trojan ( 004c49f81 )
K7AntiVirus: Trojan ( 004c49f81 )
Invincea: heuristic
Cyren: W32/Swrort.A.gen!Eldorado
Symantec: Packed.Generic.347
ESET-NOD32: a variant of Win32/Rozena.ED
TrendMicro-HouseCall: BKDR_SWRORT.SM
ClamAV: Win.Trojan.MSShellcode-7
Kaspersky: HEUR:Trojan.Win32.Generic
NANO-Antivirus: Trojan.Win32.Shellcode.ewfvwj
ViRobot: Trojan.Win32.Elzob.Gen
SUPERAntiSpyware: Trojan.Backdoor-PoisonIvy
Ad-Aware: Trojan.CryptZ.Gen
Sophos: Mal/EncPk-TZ
Comodo: TrojWare.Win32.Rozena.A@4jwdqr
F-Secure: Trojan.CryptZ.Gen
DrWeb: Trojan.Swrort.1
VIPRE: Trojan.Win32.Swrort.B (v)
TrendMicro: BKDR_SWRORT.SM
McAfee-GW-Edition: BehavesLike.Win32.Swrort.lh
Trapmine: malicious.high.ml.score
Emsisoft: Trojan.CryptZ.Gen (B)
SentinelOne: static engine - malicious
F-Prot: W32/Swrort.A.gen!Eldorado
Webroot: W32.Malware.Gen
Avira: TR/Crypt.EPACK.Gen2
Endgame: malicious (high confidence)
Microsoft: Trojan:Win32/Meterpreter.O
AegisLab: Trojan.Win32.Generic.lB6l
ZoneAlarm: HEUR:Trojan.Win32.Generic
GData: Trojan.CryptZ.Gen
AhnLab-V3: Trojan/Win32.Shell.R1283
Acronis: suspicious
ALYac: Trojan.CryptZ.Gen
MAX: malware (ai score=89)
Arcabit: Trojan.CryptZ.Gen
Rising: Trojan.Rozena!8.6D/N3#100% (RDM+:cmRtazoMJk8Ej5LfL1IgyQLF8n6X)
Yandex: Trojan.Rosena.Gen.1
Ikarus: Trojan.Win32.Swrort
eGambit: Trojan.Generic
Fortinet: W32/Swrort.C!tr
AVG: Win32:SwPatch [Wrm]
Cybereason: malicious.6b869e
Avast: Win32:SwPatch [Wrm]
CrowdStrike: malicious_confidence_100% (D)
Qihoo-360: HEUR/QVM20.1.5EDD.Malware.Gen

Hashes

MD5 16e83206b869e39e610f475a6d089725
SHA1 927257e4a4cc2b13e910298a4bcc705ca5bb715a
SHA256 d8c2639576fa7c8e0264c950c1b5de714322881f514db64f7a9579167b8dbf95
SHA3 41682cde93a39c908a87b6ac149035f71c92d6e0f338bced046752921a29b9f3
SSDeep 1536:IjB2y/dKPwmzQ++SDFjev/V/F6yzUMb+KR0Nc8QsJq39:Ly/dK/zQ+DDFjk/BF6CUe0Nc8QsC9
Imports Hash 4c6e5b9cc5b626d38b0b4a6780d021dc

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2009-Sep-18 07:03:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0xb000
SizeOfInitializedData 0xa000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000023A1 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xc000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x16000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f1ebefe6fb9032ef737c0960038fbfae
SHA1 8f6ca6cccedfa1c47d819cc11730d8f0bf70587c
SHA256 6b0e49b52626715d81e4876251f9dc2b584741c22693908cda3547e6d83233f5
SHA3 93d124164c5582e23d327977b4519b367289265bd6ec9ca5309736dd8e74987b
VirtualSize 0xa966
VirtualAddress 0x1000
SizeOfRawData 0xb000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.00929

.rdata

MD5 25d7ceee3aa85bb3e8c5174736f6f830
SHA1 2d1b3b256819734be18a5171828f544f2fe3c678
SHA256 c9c158955ada53055c12e5d0c4060730470167d0059b1f02aafcf886370d57e0
SHA3 da6fb56135ed03a247ebd4b2173b4e9871b1a9f5cd2867b977a36af64b3c9954
VirtualSize 0xfe6
VirtualAddress 0xc000
SizeOfRawData 0x1000
PointerToRawData 0xc000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.31839

.data

MD5 283b5f792323d57b9db4d2bcc46580f8
SHA1 46bdccde681141c8e779b47220c1d7b1a1b9b011
SHA256 36c0aa22fb65d0f60ab7fc5648994eece1f2ef8c5d4d60855fada2f8bff4c3c2
SHA3 8516558c3e62d8d2e08dbde5e61186efeaa28491e42168849ebd5da8d879d7b7
VirtualSize 0x705c
VirtualAddress 0xd000
SizeOfRawData 0x4000
PointerToRawData 0xd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.40784

.rsrc

MD5 c13a9413aea7291b6fc85d75bfcde381
SHA1 2e051ef30946f9bed1931d1f9dde3ebdb9b99b89
SHA256 77d4d9b7bcf6235ac21dc6b2569ecc9c3a854539e23d8b939078d4ce151baae0
SHA3 620378dff7f5fa3d0b3d5417b589a509dd0cb5902c34fcac6034e8bd2d6e626a
VirtualSize 0x7c8
VirtualAddress 0x15000
SizeOfRawData 0x1000
PointerToRawData 0x11000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.9583

Imports

MSVCRT.dll _iob
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
strrchr
wcsncmp
_close
wcslen
wcscpy
strerror
modf
strspn
realloc
__p__environ
__p__wenviron
_errno
free
strncmp
strstr
strncpy
_ftol
qsort
fopen
perror
fclose
fflush
calloc
malloc
signal
printf
_isctype
atoi
exit
__mb_cur_max
_pctype
strchr
fprintf
_controlfp
_strdup
_strnicmp
KERNEL32.dll PeekNamedPipe
ReadFile
WriteFile
LoadLibraryA
GetProcAddress
GetVersionExA
GetExitCodeProcess
TerminateProcess
LeaveCriticalSection
SetEvent
ReleaseMutex
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMutexA
GetFileType
SetLastError
FreeEnvironmentStringsW
GetEnvironmentStringsW
GlobalFree
GetCommandLineW
TlsAlloc
TlsFree
DuplicateHandle
GetCurrentProcess
SetHandleInformation
CloseHandle
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetTimeZoneInformation
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
Sleep
FormatMessageA
GetLastError
WaitForSingleObject
CreateEventA
SetStdHandle
SetFilePointer
CreateFileA
CreateFileW
GetOverlappedResult
DeviceIoControl
GetFileInformationByHandle
LocalFree
ADVAPI32.dll FreeSid
AllocateAndInitializeSid
WSOCK32.dll #7
#4
#9
#52
#14
#12
#21
#23
#3
#18
#10
#151
#115
#116
#111
WS2_32.dll WSARecv
WSASend

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x768
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.49991
MD5 ddfda397f78597f8a3a40b972300dc26
SHA1 1e92b61cf6c7f7d73422bb7a2c0c335a7e459a7d
SHA256 465417d96548ce85076f6509efac41e5ad02fee2b8f712416e8b6aa08d93c494
SHA3 d057bd49bc4c303fa2411089f9681ec0f7baa4225cc802200eb9508872771603

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.2.14.0
ProductVersion 2.2.14.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName Apache Software Foundation
FileDescription ApacheBench command line utility
FileVersion (#2) 2.2.14
InternalName ab.exe
LegalCopyright Copyright 2009 The Apache Software Foundation.
OriginalFilename ab.exe
ProductName Apache HTTP Server
ProductVersion (#2) 2.2.14
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2009-Sep-29 03:34:14
Version 0.0
SizeofData 74
AddressOfRawData 0
PointerToRawData 0x12000
Referenced File 0\asf\release\build-2.2.14\support\Release\ab.pdb

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x859e59d7
Unmarked objects 0
12 (7291) 4
14 (7299) 9
C objects (8047) 11
Linker (8047) 3
Total imports 201
Imports (2179) 8
48 (9044) 40
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors