| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| Compilation Date | 2014-Jun-24 22:53:56 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/67 (Scanned on 2018-10-05 15:21:19) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd0 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 4 |
| TimeDateStamp | 2014-Jun-24 22:53:56 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 9.0 |
| SizeOfCode | 0x9800 |
| SizeOfInitializedData | 0x6c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000000027B4 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.2 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x13000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_CUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| PSAPI.DLL |
EnumProcesses
GetModuleBaseNameA |
|---|---|
| KERNEL32.dll |
ReleaseMutex
CreateThread SetEvent CreateEventA DeleteFileA GetCurrentProcess Sleep LocalFree FormatMessageA GetLastError CreateMutexA GetModuleHandleA GetModuleFileNameA GetProcAddress VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread WaitForSingleObject OpenProcess CloseHandle GetWindowsDirectoryA GetEnvironmentStringsW RtlUnwindEx GetCommandLineA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EnterCriticalSection LeaveCriticalSection GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount HeapAlloc HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA |
| ADVAPI32.dll |
CreateServiceA
CloseServiceHandle OpenServiceA QueryServiceStatus ControlService DeleteService StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA SetServiceStatus OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges OpenSCManagerA |
| XOR Key | 0x3acddd8d |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2008 SP1 build 30729) | 91 |
| ASM objects (VS2008 SP1 build 30729) | 9 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 7 |
| Total imports | 116 |
| C++ objects (VS2008 SP1 build 30729) | 32 |
| Resource objects (VS2008 SP1 build 30729) | 1 |