| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2006-Jan-24 19:35:42 |
| Detected languages |
English - United States
|
| Debug artifacts |
e:\bt\127064\private\client\msbl\obj\i386\msnmsgr.pdb
|
| CompanyName | Microsoft Corporation |
| FileDescription | MSN Messenger |
| FileVersion | 7.5.0324 |
| InternalName | msnmsgr |
| LegalCopyright | Copyright (c) Microsoft Corporation 1997-2004 |
| LegalTrademarks | Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. |
| OriginalFilename | msnmsgr.exe |
| ProductName | MSN Messenger |
| ProductVersion | 7.5.0324 |
| Info | Matching compiler(s): |
Microsoft Visual C++ 7.1
Microsoft Visual C++ 6.0 - 8.0 Microsoft Visual C++ v7.0 Microsoft Visual C++ v7.1 EXE Microsoft Visual C++ 7.0 MFC MASM/TASM - sig2(h) Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Microsoft's Cryptography API |
| Malicious | The PE contains functions mostly used by malware. |
Functions which can be used for anti-debugging purposes:
|
| Info | The PE's resources present abnormal characteristics. |
Resource 1102 is possibly compressed or encrypted.
Resource 1103 is possibly compressed or encrypted. Resource 1104 is possibly compressed or encrypted. Resource 1105 is possibly compressed or encrypted. |
| Suspicious | VirusTotal score: 1/72 (Scanned on 2022-10-14 03:21:18) | APEX: Malicious |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x138 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2006-Jan-24 19:35:42 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 7.2 |
| SizeOfCode | 0x429000 |
| SizeOfInitializedData | 0x29a000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x001B9A40 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x42a000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 5.2 |
| ImageVersion | 5.2 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x6dc000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0x6d20ee |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x40000 |
| SizeofStackCommit | 0x2000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| ADVAPI32.dll |
RegCloseKey
RegCreateKeyExA RegSetValueExA RegQueryValueExA RegDeleteValueA RegQueryInfoKeyA RegEnumValueA RegEnumKeyA RegDeleteKeyA FreeSid RevertToSelf AccessCheck IsValidSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid InitializeSecurityDescriptor AllocateAndInitializeSid OpenProcessToken OpenThreadToken ImpersonateSelf CryptReleaseContext CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptHashData CryptGetHashParam RegOpenKeyA RegOpenKeyExA |
|---|---|
| KERNEL32.dll |
GetSystemDirectoryA
GetWindowsDirectoryA SetEnvironmentVariableA SetEndOfFile GetTimeZoneInformation CreateFileA FlushFileBuffers SetStdHandle GlobalFree GetStringTypeA IsValidLocale GetUserDefaultLCID GetDateFormatA GetTimeFormatA IsBadCodePtr GetOEMCP LCMapStringA HeapSize IsBadWritePtr VirtualFree HeapCreate HeapDestroy TlsSetValue GetThreadPriority CreateSemaphoreA ReleaseSemaphore IsBadStringPtrA QueryPerformanceFrequency DebugBreak GetProcessTimes lstrcmpiA GetFileSize TlsGetValue lstrlenA FreeLibrary FormatMessageA LoadLibraryA TlsFree GetCurrentThread TlsAlloc GetFileType SetHandleCount GetEnvironmentStrings FreeEnvironmentStringsA GetStdHandle IsBadReadPtr ExitThread VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind GetStartupInfoA UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime QueryPerformanceCounter GetSystemDefaultLCID CompareStringA ResumeThread CompareFileTime MapViewOfFileEx SetThreadExecutionState GetSystemTime SystemTimeToFileTime GetCurrentProcessId CreateMutexA DuplicateHandle GetModuleFileNameA CreateProcessA ReleaseMutex SetLastError GetExitCodeThread TerminateThread GetVersionExA CreateEventA GetCommandLineA SetUnhandledExceptionFilter GetModuleHandleA OpenEventA ResetEvent ExpandEnvironmentStringsA DeleteFileA CreateFileMappingA OpenFileMappingA MapViewOfFile UnmapViewOfFile lstrcmpA RtlMoveMemory GlobalSize MoveFileExW ReadFile SetFilePointer FileTimeToSystemTime GetCurrentProcess FlushInstructionCache GlobalAlloc GlobalLock GlobalUnlock MulDiv GetLocalTime GetDriveTypeA SetProcessWorkingSetSize DeleteAtom InitializeCriticalSectionAndSpinCount FileTimeToLocalFileTime CreateToolhelp32Snapshot Process32First Process32Next FreeResource OutputDebugStringA GetPrivateProfileIntA GetCurrentDirectoryA SetCurrentDirectoryA lstrcpyA lstrcatA WaitForMultipleObjects InterlockedCompareExchange SetThreadPriority GetExitCodeProcess FindResourceA GlobalMemoryStatus MoveFileExA FindFirstFileA FindClose SetErrorMode GetStringTypeExA IsDBCSLeadByteEx LocalAlloc Sleep CreateThread GetTickCount HeapFree HeapReAlloc HeapAlloc LocalFree ExitProcess SetEvent WaitForSingleObject InterlockedDecrement InterlockedIncrement GetCurrentThreadId WriteFile CloseHandle LeaveCriticalSection EnterCriticalSection GetLastError LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection RaiseException GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetProcessHeap IsProcessorFeaturePresent |
| GDI32.dll |
CreatePolygonRgn
SetDIBColorTable GetMapMode GetViewportExtEx GetWindowExtEx GetObjectA CreateFontIndirectA GetWindowOrgEx PatBlt GetTextExtentPoint32A GetTextExtentExPointA GetEnhMetaFileHeader DeleteEnhMetaFile SetTextAlign CreatePatternBrush PlayEnhMetaFile SetBrushOrgEx GetBrushOrgEx CreateDIBPatternBrushPt ExtTextOutA SetDIBits GetNearestPaletteIndex GetSystemPaletteEntries CreatePalette GetPaletteEntries OffsetViewportOrgEx SelectPalette RealizePalette CreateHalftonePalette SetPixel SetBitmapBits SetDIBitsToDevice GetClipBox SetStretchBltMode StretchDIBits CreateDIBSection GetObjectType GetCurrentObject GetDIBits OffsetWindowOrgEx GetClipRgn CreateDCA SetWorldTransform SetGraphicsMode SetRectRgn Polyline GetTextMetricsA RectVisible OffsetRgn GetRgnBox SetBkColor CombineRgn CreatePen MoveToEx LineTo GetPixel CreateRectRgn ExtSelectClipRgn SelectClipRgn SetTextColor SetBkMode SetWindowExtEx CloseMetaFile DeleteMetaFile LPtoDP SaveDC DeleteObject SelectObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC BitBlt GetDeviceCaps GetStockObject GetDIBColorTable CreateSolidBrush StretchBlt CreateRoundRectRgn CreateRectRgnIndirect RestoreDC SetViewportOrgEx SetWindowOrgEx SetMapMode SetViewportExtEx |
| USER32.dll |
RegisterClassA
SetTimer SetParent TranslateMessage IsIconic GetParent CallNextHookEx UnhookWindowsHookEx MessageBoxA CheckMenuItem ReleaseCapture SetCapture FillRect GetDC ReleaseDC GetDesktopWindow DestroyMenu TrackPopupMenuEx GetSubMenu LoadMenuA CopyRect MapWindowPoints SetForegroundWindow IsWindow IsRectEmpty DeleteMenu SetCursorPos GetLastActivePopup GetClassNameA GetAsyncKeyState SetActiveWindow AdjustWindowRect RegisterWindowMessageA GetDoubleClickTime MoveWindow GetDialogBaseUnits IsWindowEnabled SetRectEmpty GetWindow CheckDlgButton GetActiveWindow EndDialog FindWindowA PostQuitMessage CheckRadioButton AdjustWindowRectEx DrawAnimatedRects DrawIconEx SetRect ScreenToClient BeginPaint EndPaint DestroyIcon UnionRect IsMenu RemoveMenu SetMenu MessageBeep GetMenu CreateMenu InvalidateRect SetFocus CheckMenuRadioItem LoadCursorA FlashWindow GetKeyState IsZoomed SetWindowRgn GetCursorPos PtInRect GetSystemMetrics GetClientRect wvsprintfA EqualRect OffsetRect IsWindowVisible SetWindowPos SetMenuDefaultItem FrameRect GetForegroundWindow InflateRect GetSysColorBrush GetFocus IsChild GetClassInfoExA CharNextA CharLowerA GetWindowThreadProcessId LoadStringA WindowFromDC GetWindowDC GetKeyboardLayoutList RedrawWindow GetTopWindow GetNextDlgTabItem SystemParametersInfoA EnumChildWindows GetMenuItemID GetMenuState GetUpdateRect GetDlgCtrlID GetCapture ClientToScreen GetWindowRgn GetSystemMenu DrawFocusRect SendNotifyMessageA HideCaret ShowCaret SetCaretPos CreateCaret DestroyCaret GetIconInfo SendMessageA MsgWaitForMultipleObjects GetCursor MapDialogRect SetDlgItemInt GetDlgItemInt EnumThreadWindows EnumWindows DrawTextA GetMessageA PeekMessageA DefWindowProcA CreateIconIndirect DrawFrameControl PostMessageA GetMessagePos DispatchMessageA IsDialogMessageA PostThreadMessageA GetQueueStatus MsgWaitForMultipleObjectsEx DrawEdge GetCaretBlinkTime ChildWindowFromPointEx GetMenuItemCount SetWindowPlacement GetWindowPlacement CreatePopupMenu GetWindowRect TrackPopupMenu EnableMenuItem SetCursor IntersectRect IsDlgButtonChecked DestroyWindow LoadIconA GetDlgItem UpdateWindow ShowWindow KillTimer CreateWindowExA RegisterClassExA ValidateRect GetDCEx GetCaretPos TrackMouseEvent GetKeyboardState GetMessageTime GetSysColor DestroyAcceleratorTable |
| WS2_32.dll |
shutdown
WSASocketA WSAEventSelect WSAEnumNetworkEvents recv WSACreateEvent WSACloseEvent WSAStartup gethostname getpeername WSAIoctl setsockopt sendto recvfrom select WSCEnumProtocols WSCGetProviderPath bind listen WSAAsyncGetHostByName send getsockname accept WSAAsyncSelect WSACancelAsyncRequest ntohl socket connect closesocket gethostbyname getservbyport ntohs gethostbyaddr htons getservbyname htonl WSAGetLastError WSACleanup inet_ntoa inet_addr |
| ole32.dll |
CLSIDFromProgID
CoInitializeSecurity CoCreateInstance CoUninitialize CoInitializeEx OleInitialize OleUninitialize CoRegisterClassObject CoRevokeClassObject StringFromGUID2 CoTaskMemAlloc OleLockRunning CLSIDFromString CoFreeUnusedLibraries CoGetTreatAsClass CoTaskMemFree StringFromCLSID ReleaseStgMedium OleFlushClipboard OleSetClipboard OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CreateOleAdviseHolder CreateDataAdviseHolder CreateStreamOnHGlobal GetHGlobalFromStream OleLoadFromStream WriteClassStm OleSaveToStream CoCreateFreeThreadedMarshaler StgOpenStorageOnILockBytes CreateILockBytesOnHGlobal CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoCreateGuid StgCreateDocfileOnILockBytes CoSetProxyBlanket CoInitialize OleRun CoDisconnectObject DoDragDrop GetHGlobalFromILockBytes |
| OLEAUT32.dll |
LoadRegTypeLib
LoadTypeLib VariantChangeType SysAllocStringLen OleCreateFontIndirect DispCallFunc VariantCopy SafeArrayGetVartype SafeArrayCopy VarCmp SysStringLen SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector OleCreatePropertyFrame SafeArrayGetElement SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayGetDim SysAllocStringByteLen SysStringByteLen SysAllocString VariantClear SysFreeString VariantInit SysReAllocStringLen VarUdateFromDate SystemTimeToVariantTime VarBstrCat CreateStdDispatch SafeArrayRedim SafeArrayCreate SafeArrayLock SafeArrayUnlock SafeArrayDestroy |
| SHELL32.dll |
ShellExecuteExA
SHAppBarMessage Shell_NotifyIconA #171 SHGetMalloc ShellExecuteA |
| iphlpapi.dll |
GetIfEntry
GetIpAddrTable |
| SHLWAPI.dll |
UrlGetPartW
PathFileExistsW PathFindFileNameW PathAppendW StrCpyNW PathUnquoteSpacesW |
| CRYPT32.dll |
CryptFormatObject
CertFreeCertificateContext CryptDecodeObjectEx CryptMsgClose CryptVerifyMessageSignature CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CryptHashPublicKeyInfo CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam CertFindAttribute |
| CRYPTNET.dll |
CryptRetrieveObjectByUrlW
|
| MSACM32.dll |
acmStreamOpen
acmStreamUnprepareHeader acmStreamConvert acmStreamPrepareHeader acmStreamClose |
| RPCRT4.dll |
UuidFromStringA
|
| msi.dll |
#67
|
| DSOUND.dll |
#8
#6 |
| msidcrl.dll |
#2
#1 #29 #19 #18 #17 #24 #5 #31 #38 #15 #16 #8 #34 #30 #60 #4 #13 #3 #23 |
| SETUPAPI.dll (delay-loaded) |
SetupIterateCabinetW
SetupIterateCabinetA |
| Attributes | 0x1 |
|---|---|
| Name | SETUPAPI.dll |
| ModuleHandle | 0x47eda8 |
| DelayImportAddressTable | 0x47cbd0 |
| DelayImportNameTable | 0x42523c |
| BoundDelayImportTable | 0x4260b8 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
| {CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5} |
| <theme><titleBar background="C0D0F0,F8F8F8"/><clientArea background="F8F8F8,E2EAF3" backgroundImage="" /><toolBar background="CDD9EE,EEF2F8" foreground="000075" /></theme> |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 7.5.324.0 |
| ProductVersion | 7.5.324.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | MSN Messenger |
| FileVersion (#2) | 7.5.0324 |
| InternalName | msnmsgr |
| LegalCopyright | Copyright (c) Microsoft Corporation 1997-2004 |
| LegalTrademarks | Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. |
| OriginalFilename | msnmsgr.exe |
| ProductName | MSN Messenger |
| ProductVersion (#2) | 7.5.0324 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2006-Jan-24 19:35:42 |
| Version | 0.0 |
| SizeofData | 78 |
| AddressOfRawData | 0x90954 |
| PointerToRawData | 0x90954 |
| Referenced File | e:\bt\127064\private\client\msbl\obj\i386\msnmsgr.pdb |
| XOR Key | 0x943933fb |
|---|---|
| Unmarked objects | 0 |
| C++ objects (VS2003 (.NET) build 4035) | 3 |
| ASM objects (VS2003 (.NET) build 4035) | 1 |
| C objects (9178) | 1 |
| C objects (8799) | 2 |
| Imports (VS2003 (.NET) build 3077) | 2 |
| C++ objects (9178) | 1 |
| Imports (9210) | 6 |
| C objects (2179) | 20 |
| Imports (2067) | 2 |
| Imports (2179) | 25 |
| Total imports | 797 |
| 105 (2067) | 148 |
| ASM objects (VS2003 (.NET) build 3077) | 43 |
| C objects (VS2003 (.NET) build 4035) | 303 |
| C objects (VS2003 (.NET) build 3077) | 297 |
| C++ objects (VS2003 (.NET) build 3077) | 775 |
| Resource objects (9111) | 1 |
| Unmarked objects (#2) | 27 |
| Linker (VS2003 (.NET) build 3077) | 1 |
No comments yet.