Manalyzer :: 3b9302f99c9de81c02c2f9f4dc6c22cc068be777b38ebdc034fb921d9082b11b

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2005-Sep-17 08:41:28

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0` `Microsoft Visual C++` `Microsoft Visual C++ v6.0` `Microsoft Visual C++ v5.0/v6.0 (MFC)`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Miscellaneous malware strings: cmd.exe`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA LoadLibraryExA`
Malicious	VirusTotal score: 27/43 (Scanned on 2012-10-08 17:38:13)	`nProtect: Backdoor.Generic.230858` `McAfee: Artemis!B52DDC0DDA64` `K7AntiVirus: Riskware` `F-Prot: W32/MalwareF.GZWX` `Symantec: Backdoor.HackDefender` `Norman: W32/Vundo.GTY` `TrendMicro-HouseCall: GRAY_Generic` `Avast: Win32:Malware-gen` `eSafe: Suspicious File` `Kaspersky: Trojan.Win32.Genome.ihfj` `BitDefender: Backdoor.Generic.230858` `Agnitum: VirTool.Obfuscator!vx+laj6NLEw` `Sophos: Mal/FakeAV-FS` `Comodo: UnclassifiedMalware` `F-Secure: Backdoor.Generic.230858` `VIPRE: VirTool.Win32.Obfuscator.a (fs)` `AntiVir: TR/VTool.Obfuscator.HD` `TrendMicro: GRAY_Generic` `McAfee-GW-Edition: Artemis!B52DDC0DDA64` `Microsoft: VirTool:Win32/Obfuscator.HD` `AhnLab-V3: Win-Trojan/Obfuscator.73728.B` `GData: Backdoor.Generic.230858` `Commtouch: W32/MalwareF.GZWX` `ESET-NOD32: probably a variant of Win32/Obfuscated.DWYRJRM` `Rising: Trojan.Win32.Generic.11F20BAF` `Fortinet: Malware_fam.A` `Panda: Trj/Hmir.F`

Hashes

MD5	`b52ddc0dda64f35721d5692e168ad58c` 🔍
SHA1	`41c2f8ffdf130eb700b10a5303bc15310f94df11` 🔍
SHA256	`3b9302f99c9de81c02c2f9f4dc6c22cc068be777b38ebdc034fb921d9082b11b` 🔍
SHA3	`ef099bcb8cce8bcba075e0bbde1ec362c8b2eee48c26fc64129a71243891589c` 🔍
SSDeep	`1536:RegckskEiMJzNvXMGYUrbSEv9OXXvj+roxr:Re1pjhKYndYXvj+rod` 🔍
Imports Hash	`01cb92f6ae9c73001174c04acb465223` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xd8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2005-Sep-17 08:41:28
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED` `IMAGE_FILE_RELOCS_STRIPPED`

Image Optional Header

Magic	`PE32`
LinkerVersion	`6.0`
SizeOfCode	`0xe000`
SizeOfInitializedData	`0xb000`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000098FF (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0xf000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x1000`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x1a000`
SizeOfHeaders	`0x1000`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`bc1307d55e35707955eb34d95b86df6d 🔍`
SHA1	`83643a5e97acc7ca7d6e3a940e0f04f80a645cd8 🔍`
SHA256	`1c3fb40b0b90be53a359d80c0bcd014fba5b3e0fb52132142c6da5faed77690a 🔍`
SHA3	`4a61124d2a991b5f6563874119ca877958c751712f21a845d321651c741b7689 🔍`
VirtualSize	`0xd612`
VirtualAddress	`0x1000`
SizeOfRawData	`0xe000`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.48569`

.rdata

MD5	`aa766b141a6ce5231cc4108c3c581388 🔍`
SHA1	`a44b45771fa8656198caa4ff616ed670cdfe33b4 🔍`
SHA256	`1d127f42f24483f369687ae10eb9a35678349dcb7482529f178e145ec47b72ac 🔍`
SHA3	`9fa150e60ed801de9c4cc77aaaefc9c4aa351792ff43e4df09566833a3a77a67 🔍`
VirtualSize	`0xa76`
VirtualAddress	`0xf000`
SizeOfRawData	`0x1000`
PointerToRawData	`0xf000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.08521`

.data

MD5	`098f119cf020f85a4b4422195385e6e2 🔍`
SHA1	`c84dbfe0df08cf7e769be2a6b56159dbed2cdb91 🔍`
SHA256	`77973095b486a76b6aa34579a89f426723cde5612248190df76484e346f3b477 🔍`
SHA3	`925777dd6425e5c7fd44bab387e1dd13c9e8f874304ba8f94d82ae6481713cbb 🔍`
VirtualSize	`0x913c`
VirtualAddress	`0x10000`
SizeOfRawData	`0x2000`
PointerToRawData	`0x10000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.85547`

Imports

KERNEL32.dll	`GetProcAddress` `LoadLibraryA` `GetLastError` `VirtualAlloc` `VirtualFree` `FreeLibrary` `SizeofResource` `LockResource` `LoadResource` `FindResourceA` `LoadLibraryExA` `WriteFile` `SetEndOfFile` `SetFilePointer` `CloseHandle` `ReadFile` `GetFileSize` `CreateFileA` `CompareStringW` `CompareStringA` `GetTimeZoneInformation` `GetSystemTime` `GetLocalTime` `ExitProcess` `TerminateProcess` `GetCurrentProcess` `GetCommandLineA` `GetVersion` `UnhandledExceptionFilter` `GetModuleFileNameA` `FreeEnvironmentStringsA` `FreeEnvironmentStringsW` `WideCharToMultiByte` `GetEnvironmentStrings` `GetEnvironmentStringsW` `SetHandleCount` `GetStdHandle` `GetFileType` `GetStartupInfoA` `HeapDestroy` `HeapCreate` `HeapFree` `RtlUnwind` `HeapAlloc` `GetCPInfo` `GetACP` `GetOEMCP` `HeapReAlloc` `FlushFileBuffers` `MultiByteToWideChar` `LCMapStringA` `LCMapStringW` `GetStringTypeA` `GetStringTypeW` `SetStdHandle` `SetEnvironmentVariableA`
USER32.dll	`CharUpperBuffA`

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key	`0xd9217507`
Unmarked objects	`0`
C objects (VS98 build 8168)	`59`
14 (7299)	`15`
19 (8034)	`5`
Total imports	`58`
C++ objects (VS98 build 8168)	`2`

Errors

Leave a comment

No comments yet.