4a57f100a1c4d204d40b86e033007b9fd675f2a227f201cee087ac627cd54035

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2011-Oct-18 18:46:44

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++
Microsoft Visual C++ v6.0
Suspicious PEiD Signature: ASPack v2.12
Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • cmd.exe
 Contains domain names:
  • command.com
  • http://www.practicalmalwareanalysis.com
  • practicalmalwareanalysis.com
  • www.practicalmalwareanalysis.com
Suspicious The PE is packed with Aspack or Armadillo Unusual section name found: .aspack
Unusual section name found: .adata
The PE only has 0 import(s).
Suspicious The PE contains functions most legitimate programs don't use. Leverages the raw socket API to access the Internet:
  • ws2_32.dll
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 6165516c17831f934153370e3791266f 🔍
SHA1 bf4e056b4e159b40fb41083032c3e3740920524c 🔍
SHA256 4a57f100a1c4d204d40b86e033007b9fd675f2a227f201cee087ac627cd54035 🔍
SHA3 9a82663e04f92ac9cef5cff0d57b45f80f709c38ad5486345da084da9efc40c6 🔍
SSDeep 768:5BMB7uLhDdWaX1ZOE/XZAv39SHOIXjTpF9VM+JG4o7PBkbQDoLxSha5:5Bm7uLhDdWQaP9SHlzlFPM+xRbWo8 🔍
Imports Hash d41d8cd98f00b204e9800998ecf8427e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xd0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 5
TimeDateStamp 2011-Oct-18 18:46:44
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0xa000
SizeOfInitializedData 0x6000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00003896 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0xb000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x14000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 dcef355bc83f1d3a1be4764e139f624f 🔍
SHA1 9b2385da0a147b06d792b5f029b2314607b09189 🔍
SHA256 c2e3d3a75f61d839dd93a752a05d441f0ed2ea214d8dbfe91e6b531fd3bdfef7 🔍
SHA3 35ff186663a6d136875847b33dca085fb0134ce9aa52e96d69b59efd982ae9c7 🔍
VirtualSize 0xa000
VirtualAddress 0x1000
SizeOfRawData 0x9400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.59702

.rdata

MD5 db4701a2daf86ff3b9b49db59a27ded6 🔍
SHA1 ca2f9345265411c270cf54f3e89090d918add9f0 🔍
SHA256 bf5072cfb55d92bf1e6a7cdba4bf51a06e60d036f7d06d5d31a52d68dee16a95 🔍
SHA3 33cd160d0b84d18a7161748a69c92f4df2de382029a1f232984c11cea4fc0d26 🔍
VirtualSize 0x1000
VirtualAddress 0xb000
SizeOfRawData 0xe00
PointerToRawData 0x9800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.58619

.data

MD5 fe43a890e0407fa8049be67ccc9ed096 🔍
SHA1 05f2880f19d53a1a6d74fab0f6907441cfb6bc83 🔍
SHA256 22c9c848ac6b95ba907dd4b200a29d313dd81a721e565bd88e5b7af620bc764e 🔍
SHA3 7fdf8edb9dd1fc14e9041c2d77dc74be68a4cbc24e77930900337a9a05548c6d 🔍
VirtualSize 0x5000
VirtualAddress 0xc000
SizeOfRawData 0x2c00
PointerToRawData 0xa600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.871251

.aspack

MD5 104fc4dce06437624c8c5008c854faed 🔍
SHA1 2610ff060b293f86a12da3475112d3aa0d99cd97 🔍
SHA256 d0b4a1ad8a59dba1aa57bc684ccb1caa4626526bb447d157d2f54546fa0223da 🔍
SHA3 0694cbc045a0b6c318ad4121f08703005dcac4f3b95da8dc90fd7635bcd0b2dd 🔍
VirtualSize 0x2000
VirtualAddress 0x11000
SizeOfRawData 0x1200
PointerToRawData 0xd200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.74012

.adata

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x1000
VirtualAddress 0x13000
SizeOfRawData 0
PointerToRawData 0xe400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Imports

kernel32.dll (EMPTY)
advapi32.dll (EMPTY)
shell32.dll (EMPTY)
ws2_32.dll (EMPTY)

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x4b3692b7
Unmarked objects 0
C++ objects (VS98 SP6 build 8804) 1
14 (7299) 17
C objects (VS98 SP6 build 8804) 84
19 (8034) 9
Total imports 88
C++ objects (VS98 SP6 build 8804) (#2) 1

Errors

[!] Error: Could not reach the HINT/NAME table. [*] Warning: An error occurred while trying to read functions imported by module kernel32.dll. [*] Warning: Section .adata has a size of 0!
Leave a comment

No comments yet.