e9856f4f9002935014176fa03932ddf7
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1970-Jan-01 00:00:00 |
| Detected languages |
English - United States
|
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains obfuscated function names:
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The file contains overlay data. |
1216 bytes of data starting at offset 0x9e00.
The overlay data has an entropy of 7.79065 and is possibly compressed or encrypted. |
| Malicious | VirusTotal score: 69/72 (Scanned on 2023-10-05 14:36:05) |
ALYac:
Win32.Mydoom.M@mm
APEX: Malicious AVG: Win32:Mydoom-DV [Wrm] Acronis: suspicious AhnLab-V3: Worm/Win32.MyDoom.C145120 Alibaba: Malware:Win32/Dorpal.ali1000029 Antiy-AVL: Worm[Email]/Win32.Mydoom Arcabit: Win32.Mydoom.EE61DB Avast: Win32:Mydoom-DV [Wrm] Avira: TR/Spy.Agent.afe Baidu: Win32.Worm-Email.Mydoom.a BitDefender: Win32.Mydoom.M@mm BitDefenderTheta: AI:Packer.FBFF46801C Bkav: W32.FamVT.MydomNHb.Worm CAT-QuickHeal: Worm.Mydoom.A3 ClamAV: Win.Worm.Mydoom-7 CrowdStrike: win/malicious_confidence_100% (W) Cybereason: malicious.0074c8 Cylance: unsafe Cynet: Malicious (score: 100) Cyren: W32/Mydoom.NHLR-0969 DeepInstinct: MALICIOUS DrWeb: Win32.HLLM.MyDoom.54464 ESET-NOD32: Win32/Mydoom.R Elastic: malicious (high confidence) Emsisoft: Win32.Mydoom.M@mm (B) F-Secure: Email-Worm:W32/Mydoom.gen!A FireEye: Generic.mg.e9856f4f90029350 Fortinet: W32/MyDoom.K!tr GData: Win32.Worm.Mydoom.A Google: Detected Gridinsoft: Worm.Win32.Mydoom.ka!i Ikarus: Email-Worm.Win32.Mydoom Jiangmin: I-Worm/MyDoom.m K7AntiVirus: EmailWorm ( 0000439f1 ) K7GW: EmailWorm ( 000043a01 ) Kaspersky: Email-Worm.Win32.Mydoom.m Lionic: Worm.Win32.Mydoom.l3y8 MAX: malware (ai score=80) Malwarebytes: Generic.Malware.AI.DDS MaxSecure: Worm.Mydoom.m McAfee: W32/Mydoom.c.o@MM McAfee-GW-Edition: BehavesLike.Win32.Mydoom.ph MicroWorld-eScan: Win32.Mydoom.M@mm Microsoft: Worm:Win32/Mydoom.O@mm NANO-Antivirus: Trojan.Win32.Mydoom.ekbf Panda: W32/Mydoom.N.worm Rising: Worm.Mydoom!1.A15B (CLASSIC) SUPERAntiSpyware: Worm.Mydoom Sangfor: Suspicious.Win32.Save.a SentinelOne: Static AI - Malicious PE Sophos: W32/MyDoom-O Symantec: W32.Mydoom!gen TACHYON: Worm/W32.Mydoom.41664 Tencent: Trojan.Win32.Mydoom.m Trapmine: malicious.high.ml.score TrendMicro: WORM_MYDOOM.GEN TrendMicro-HouseCall: WORM_MYDOOM.GEN VBA32: Trojan.Agent VIPRE: Win32.Mydoom.M@mm ViRobot: I-Worm.Win32.Mydoom.41664 VirIT: Worm.Win32.Mydoom.O Webroot: W32.Worm.Gen Xcitium: Worm.Win32.Mydoom.R@3nf5 Yandex: Trojan.GenAsa!ExGQZoHwzko Zillya: Worm.Mydoom.Win32.17 ZoneAlarm: Email-Worm.Win32.Mydoom.m Zoner: Worm.Win32.Mydoom.3815 tehtris: Generic.Malware |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xd8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 7.0 |
| SizeOfCode | 0x7200 |
| SizeOfInitializedData | 0x2a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00003280 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x9000 |
| ImageBase | 0x500000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xd000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.data
.rsrc
Imports
| KERNEL32.DLL |
FindClose
GetFileSize FindNextFileA MapViewOfFile UnmapViewOfFile FindFirstFileA GetEnvironmentVariableA GetDriveTypeA GetSystemTime WriteFile CreateFileMappingA LoadLibraryA CreateProcessA GlobalAlloc GetLastError CreateMutexA lstrcatA GetFileAttributesA CopyFileA DeleteFileA CloseHandle CreateFileA SetFileAttributesA lstrlenA GetTempPathA GetWindowsDirectoryA lstrcpyA GetModuleFileNameA ExitThread GetProcAddress GetModuleHandleA Sleep CreateThread ExitProcess GetTimeZoneInformation FileTimeToSystemTime FileTimeToLocalFileTime GetLocalTime GetTickCount WideCharToMultiByte InterlockedIncrement ReadFile SetFilePointer HeapFree GetProcessHeap HeapAlloc lstrcpynA lstrcmpA lstrcmpiA SetThreadPriority GetCurrentThread GlobalFree InterlockedDecrement GetTempFileNameA |
|---|---|
| ADVAPI32.dll |
RegCloseKey
RegOpenKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA RegCreateKeyExA |
| MSVCRT.dll |
memset
tolower memcpy isdigit strchr isalnum isspace malloc strstr |
| USER32.dll |
CharUpperBuffA
CharUpperA CharLowerA wvsprintfA wsprintfA FindWindowA PostMessageA |
| WS2_32.dll |
connect
send inet_addr gethostbyname socket select recv closesocket ntohs htons sendto WSAStartup gethostname |