ac1b07df167f2a1692176bb099474111

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2009-Apr-11 16:23:07
Detected languages English - United States
Debug artifacts 0\asf\release\build-2.2.14\support\Release\ab.pdb
Comments Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName Apache Software Foundation
FileDescription ApacheBench command line utility
FileVersion 2.2.14
InternalName ab.exe
LegalCopyright Copyright 2009 The Apache Software Foundation.
OriginalFilename ab.exe
ProductName Apache HTTP Server
ProductVersion 2.2.14

Plugin Output

Info Interesting strings found in the binary: Contains domain names:
  • apache.org
  • http://www.apache.org
  • http://www.apache.org/
  • http://www.apache.org/licenses/LICENSE-2.0
  • http://www.zeustech.net
  • http://www.zeustech.net/
  • www.apache.org
  • www.zeustech.net
  • zeustech.net
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Leverages the raw socket API to access the Internet:
  • WSARecv
  • WSASend
Suspicious The file contains overlay data. 74 bytes of data starting at offset 0x12000.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 ac1b07df167f2a1692176bb099474111
SHA1 be88ec7607a46881f820f7359d758442fc862b51
SHA256 dd99efbed86b265144939c649fa58c8e48eff4b1d3af6930d1584f5eb4efda32
SHA3 66d719158f4de4de629e7c5e5ede81f6c06c23ac3ff07ec8c28a1417ad7e8a9b
SSDeep 1536:IoGM7mZDOOI2mDXjtqMb+KR0Nc8QsJq39:FGMIyZ26XUe0Nc8QsC9
Imports Hash 4c6e5b9cc5b626d38b0b4a6780d021dc

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2009-Apr-11 16:23:07
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0xb000
SizeOfInitializedData 0xa000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00004C94 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xc000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x16000
SizeOfHeaders 0x1000
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 e67767064be4c3fd1fb5f2d7a0ccfc46
SHA1 64fafea6a1cd2f7a4ccd7c87443f8d4e2ed85e61
SHA256 c80a0a862e1fa41f4e9b42ad10eb0f26f42c038a19235a4bf9a1f58c0bc4eb7c
SHA3 add0e800620ae0be6b612c9ae606d79a581f910f6a2fb0633d1e05eaf2d3ffa9
VirtualSize 0xa966
VirtualAddress 0x1000
SizeOfRawData 0xb000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.00914

.rdata

MD5 25d7ceee3aa85bb3e8c5174736f6f830
SHA1 2d1b3b256819734be18a5171828f544f2fe3c678
SHA256 c9c158955ada53055c12e5d0c4060730470167d0059b1f02aafcf886370d57e0
SHA3 da6fb56135ed03a247ebd4b2173b4e9871b1a9f5cd2867b977a36af64b3c9954
VirtualSize 0xfe6
VirtualAddress 0xc000
SizeOfRawData 0x1000
PointerToRawData 0xc000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.31839

.data

MD5 283b5f792323d57b9db4d2bcc46580f8
SHA1 46bdccde681141c8e779b47220c1d7b1a1b9b011
SHA256 36c0aa22fb65d0f60ab7fc5648994eece1f2ef8c5d4d60855fada2f8bff4c3c2
SHA3 8516558c3e62d8d2e08dbde5e61186efeaa28491e42168849ebd5da8d879d7b7
VirtualSize 0x705c
VirtualAddress 0xd000
SizeOfRawData 0x4000
PointerToRawData 0xd000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.40784

.rsrc

MD5 c13a9413aea7291b6fc85d75bfcde381
SHA1 2e051ef30946f9bed1931d1f9dde3ebdb9b99b89
SHA256 77d4d9b7bcf6235ac21dc6b2569ecc9c3a854539e23d8b939078d4ce151baae0
SHA3 620378dff7f5fa3d0b3d5417b589a509dd0cb5902c34fcac6034e8bd2d6e626a
VirtualSize 0x7c8
VirtualAddress 0x15000
SizeOfRawData 0x1000
PointerToRawData 0x11000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.9583

Imports

MSVCRT.dll _iob
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
strrchr
wcsncmp
_close
wcslen
wcscpy
strerror
modf
strspn
realloc
__p__environ
__p__wenviron
_errno
free
strncmp
strstr
strncpy
_ftol
qsort
fopen
perror
fclose
fflush
calloc
malloc
signal
printf
_isctype
atoi
exit
__mb_cur_max
_pctype
strchr
fprintf
_controlfp
_strdup
_strnicmp
KERNEL32.dll PeekNamedPipe
ReadFile
WriteFile
LoadLibraryA
GetProcAddress
GetVersionExA
GetExitCodeProcess
TerminateProcess
LeaveCriticalSection
SetEvent
ReleaseMutex
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMutexA
GetFileType
SetLastError
FreeEnvironmentStringsW
GetEnvironmentStringsW
GlobalFree
GetCommandLineW
TlsAlloc
TlsFree
DuplicateHandle
GetCurrentProcess
SetHandleInformation
CloseHandle
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetTimeZoneInformation
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
Sleep
FormatMessageA
GetLastError
WaitForSingleObject
CreateEventA
SetStdHandle
SetFilePointer
CreateFileA
CreateFileW
GetOverlappedResult
DeviceIoControl
GetFileInformationByHandle
LocalFree
ADVAPI32.dll FreeSid
AllocateAndInitializeSid
WSOCK32.dll #7
#4
#9
#52
#14
#12
#21
#23
#3
#18
#10
#151
#115
#116
#111
WS2_32.dll WSARecv
WSASend

Delayed Imports

1

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x768
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.49991
MD5 ddfda397f78597f8a3a40b972300dc26
SHA1 1e92b61cf6c7f7d73422bb7a2c0c335a7e459a7d
SHA256 465417d96548ce85076f6509efac41e5ad02fee2b8f712416e8b6aa08d93c494
SHA3 d057bd49bc4c303fa2411089f9681ec0f7baa4225cc802200eb9508872771603

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2.2.14.0
ProductVersion 2.2.14.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
Comments Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName Apache Software Foundation
FileDescription ApacheBench command line utility
FileVersion (#2) 2.2.14
InternalName ab.exe
LegalCopyright Copyright 2009 The Apache Software Foundation.
OriginalFilename ab.exe
ProductName Apache HTTP Server
ProductVersion (#2) 2.2.14
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2009-Sep-29 03:34:14
Version 0.0
SizeofData 74
AddressOfRawData 0
PointerToRawData 0x12000
Referenced File 0\asf\release\build-2.2.14\support\Release\ab.pdb

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x859e59d7
Unmarked objects 0
12 (7291) 4
14 (7299) 9
C objects (8047) 11
Linker (8047) 3
Total imports 201
Imports (2179) 8
48 (9044) 40
Resource objects (VS98 SP6 cvtres build 1736) 1

Errors