669b879dfea1eebef5d08ecc65b061d6

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2008-Oct-22 16:47:10
Detected languages English - United States

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. Manipulates other processes:
  • ReadProcessMemory
Info The PE's resources present abnormal characteristics. Resource ncekmmqb is possibly compressed or encrypted.
Malicious VirusTotal score: 33/41 (Scanned on 2009-04-29 16:45:50) McAfee+Artemis: DNSChanger.gen
nProtect: Trojan/W32.DNSChanger.69120.E
CAT-QuickHeal: Trojan.DNSChanger.kpx
McAfee: DNSChanger.gen
K7AntiVirus: Trojan.Win32.Malware.1
VirusBuster: Trojan.FakeAlert.Gen!Pac.2
NOD32: a variant of Win32/TrojanDownloader.Zlob.BXN
F-Prot: W32/FakeAlert.3!Maximus
Symantec: Packed.Generic.200
Norman: W32/FakeAlert.ADC
Avast: Win32:Fasec
eSafe: Suspicious File
Kaspersky: Trojan.Win32.DNSChanger.kpx
BitDefender: MemScan:Trojan.Agent.AKUL
F-Secure: Trojan.Win32.DNSChanger.kpx
DrWeb: Trojan.Packed.365
NOD32Beta: a variant of Win32/TrojanDownloader.Zlob.BXN
AntiVir: TR/Dropper.Gen
McAfee-GW-Edition: Trojan.Dropper.Gen
Sophos: Troj/DNSChan-MN
eTrust-Vet: Win32/Alureon.TL
Authentium: W32/FakeAlert.3!Maximus
Prevx1: High Risk Fraudulent Security Program
a-squared: Trojan.TDss.1!IK
Microsoft: Trojan:Win32/Alureon.gen
GData: MemScan:Trojan.Agent.AKUL
AhnLab-V3: Win-Trojan/Fakeav.69120.F
VBA32: Trojan.Win32.DNSChanger.kpx
Sunbelt: Trojan.FakeAV.1.Gen
Ikarus: Trojan.TDss.1
Fortinet: W32/DNSChanger!tr
AVG: Generic12.BGV
Panda: Malicious Packer

Hashes

MD5 669b879dfea1eebef5d08ecc65b061d6
SHA1 690e8cb2bcdde03801bd531062d200125457328e
SHA256 6914cd8a9dc2678c54680aa940cd02abe52751bf9e13b15e20ab26dc3566e408
SHA3 e7892194ca762032c9d4a9990729be33853e0a4b5b32d738b236340129937636
SSDeep 1536:B/MecQhG7qGurD6gBU6vB753Fsm1A2txLB8rG9XM67wAE:BoqGurGeZB7fM23aCNj7w5
Imports Hash 6beb986c1c016c64e92326b4709bbd19

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2008-Oct-22 16:47:10
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x13600
SizeOfInitializedData 0x1c00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000016A8 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x15000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x2b000
SizeOfHeaders 0x400
Checksum 0x20a73
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x10000
SizeofStackCommit 0x10000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a3bd64a76ab679deb1ac295492f4b291
SHA1 923360d420b6cc321cbca3f14a001edf13e28301
SHA256 45fa8c3b28099b88a56373748ace26176d0ceb6e3c90b9d3289f5605e3c6f395
SHA3 f227fb82b62ec4ed75ce777dda6a7c05614768bf41c0248ed5eb2773514a221f
VirtualSize 0x154ac
VirtualAddress 0x1000
SizeOfRawData 0x1000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.28837

.data

MD5 064652136591cd5cd3fb9658e846c697
SHA1 39c04402b46e0f550f883a8d545a0603f15cc30e
SHA256 9e0ec2eb3260a79cc11f6150155ba97610160ac4ce9a3296db166e1a905811e9
SHA3 f3609a73c36e4f82560fa8163376d2b2ad5b43f5241b0379a947d40dfc8bf6c4
VirtualSize 0xf26c
VirtualAddress 0x17000
SizeOfRawData 0xec00
PointerToRawData 0x1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99673

.rsrc

MD5 b0f8c31ebef566e57bf6a67dba55a37c
SHA1 10a8c769ec5cdfedf2ba95092a2ccfd24351e063
SHA256 5a2c4c8b0d51bc88e8753987bedec77ec4a3bd552e80efb3a27e82b7d42f1304
SHA3 925335e04b3b56381876fbe6cbd465149edb5eae38c39c84ba81aacf2c1137e9
VirtualSize 0x1000
VirtualAddress 0x27000
SizeOfRawData 0x400
PointerToRawData 0x10000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.94931

.edata

MD5 af0260ed218ad1c65dcc3bc728f30811
SHA1 249b0cd80018d873117405606bc6e29b67cacf17
SHA256 33bc00277feee522ecd3184dc90f926a776fd55c205106976065a268d546f0e6
SHA3 ac98740ff402b7ce4993b84ca4d0adfbf42c52582f2a720549cbb888a46f9bec
VirtualSize 0x1d40
VirtualAddress 0x28000
SizeOfRawData 0xa00
PointerToRawData 0x10400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.78425

.reloc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
VirtualSize 0x1000
VirtualAddress 0x2a000
SizeOfRawData 0
PointerToRawData 0x10e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Imports

kernel32.dll ReadProcessMemory
SetConsoleMaximumWindowSize
VerifyConsoleIoHandle
PeekNamedPipe
GetNamedPipeHandleStateA
ConnectNamedPipe
SetConsoleOS2OemFormat
TryEnterCriticalSection
GetCommandLineA
ExitProcess
GetStartupInfoA
user32.dll RegisterDeviceNotificationA
PostQuitMessage
ScrollWindow
PostQuitMessage
gdi32.dll GdiSetPixelFormat
GdiEntry1
EngGetDriverName
CreatePolyPolygonRgn
EnumFontFamiliesA
GetEnhMetaFileHeader
cGetTTFFromFOT
SetBrushOrgEx
ColorMatchToTarget
GdiConvertDC
RemoveFontResourceExA
PlayMetaFileRecord
PolyBezierTo
ScaleViewportExtEx
InvertRgn
GdiAddGlsBounds
EngTransparentBlt
EnumFontsA
GdiGetSpoolFileHandle
IntersectClipRect

Delayed Imports

Ordinal 1
Address 0x1566

ncekmmqb

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0x31e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.76332
MD5 c01af63bcd6eac39df585b4ff49f4c84
SHA1 b44a0cd5b0596169bf8e327b510b48fd548a1cde
SHA256 98a499797fb0ecb4be6faa9071cbb67dcd65216535c7db3dbbef2fd6bf3eccf9
SHA3 0204cde05e12ed4a801b22258443ad4a3a41d1aad84711ec2a05620d2c874171

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors

[!] Error: Could not match an export name with its address! [*] Warning: Section .reloc has a size of 0! [*] Warning: 1 invalid export(s) not shown.