b350175a0533104204515b2b9364ef5b

FileName: 524288_b350175a0533104204515b2b9364ef5b.exe
Size : 524288
Md5 : b350175a0533104204515b2b9364ef5b
PEiD : [['Microsoft Visual C++ v7.1 EXE'], ['Microsoft Visual C++ v7.0']]
Virus Total Result:
K7AntiVirus -> Trojan
ClamAV -> W32.Suspect.Trojan.FakeAV

FileInfo:
----------DOS_HEADER----------

[IMAGE_DOS_HEADER]
0x0 0x0 e_magic: 0x5A4D
0x2 0x2 e_cblp: 0x90
0x4 0x4 e_cp: 0x3
0x6 0x6 e_crlc: 0x0
0x8 0x8 e_cparhdr: 0x4
0xA 0xA e_minalloc: 0x0
0xC 0xC e_maxalloc: 0xFFFF
0xE 0xE e_ss: 0x0
0x10 0x10 e_sp: 0xB8
0x12 0x12 e_csum: 0x0
0x14 0x14 e_ip: 0x0
0x16 0x16 e_cs: 0x0
0x18 0x18 e_lfarlc: 0x40
0x1A 0x1A e_ovno: 0x0
0x1C 0x1C e_res:
0x24 0x24 e_oemid: 0x0
0x26 0x26 e_oeminfo: 0x0
0x28 0x28 e_res2:
0x3C 0x3C e_lfanew: 0xE0

----------NT_HEADERS----------

[IMAGE_NT_HEADERS]
0xE0 0x0 Signature: 0x4550

----------FILE_HEADER----------

[IMAGE_FILE_HEADER]
0xE4 0x0 Machine: 0x14C
0xE6 0x2 NumberOfSections: 0x5
0xE8 0x4 TimeDateStamp: 0x4FBC9DF2 [Wed May 23 08:21:06 2012 UTC]
0xEC 0x8 PointerToSymbolTable: 0x0
0xF0 0xC NumberOfSymbols: 0x0
0xF4 0x10 SizeOfOptionalHeader: 0xE0
0xF6 0x12 Characteristics: 0x10F
Flags: IMAGE_FILE_LOCAL_SYMS_STRIPPED, IMAGE_FILE_32BIT_MACHINE, IMAGE_FILE_EXECUTABLE_IMAGE, IMAGE_FILE_LINE_NUMS_STRIPPED, IMAGE_FILE_RELOCS_STRIPPED

----------OPTIONAL_HEADER----------

[IMAGE_OPTIONAL_HEADER]
0xF8 0x0 Magic: 0x10B
0xFA 0x2 MajorLinkerVersion: 0x7
0xFB 0x3 MinorLinkerVersion: 0x0
0xFC 0x4 SizeOfCode: 0x6000
0x100 0x8 SizeOfInitializedData: 0x79000
0x104 0xC SizeOfUninitializedData: 0xA000
0x108 0x10 AddressOfEntryPoint: 0x17F2
0x10C 0x14 BaseOfCode: 0x1000
0x110 0x18 BaseOfData: 0x7000
0x114 0x1C ImageBase: 0x410000
0x118 0x20 SectionAlignment: 0x1000
0x11C 0x24 FileAlignment: 0x1000
0x120 0x28 MajorOperatingSystemVersion: 0x4
0x122 0x2A MinorOperatingSystemVersion: 0x0
0x124 0x2C MajorImageVersion: 0x0
0x126 0x2E MinorImageVersion: 0x0
0x128 0x30 MajorSubsystemVersion: 0x4
0x12A 0x32 MinorSubsystemVersion: 0x0
0x12C 0x34 Reserved1: 0x0
0x130 0x38 SizeOfImage: 0xC8000
0x134 0x3C SizeOfHeaders: 0x1000
0x138 0x40 CheckSum: 0x8960A
0x13C 0x44 Subsystem: 0x2
0x13E 0x46 DllCharacteristics: 0x0
0x140 0x48 SizeOfStackReserve: 0x100000
0x144 0x4C SizeOfStackCommit: 0x1000
0x148 0x50 SizeOfHeapReserve: 0x100000
0x14C 0x54 SizeOfHeapCommit: 0x1000
0x150 0x58 LoaderFlags: 0x0
0x154 0x5C NumberOfRvaAndSizes: 0x10
DllCharacteristics:

----------PE Sections----------

[IMAGE_SECTION_HEADER]
0x1D8 0x0 Name: .text
0x1E0 0x8 Misc: 0x55CA
0x1E0 0x8 Misc_PhysicalAddress: 0x55CA
0x1E0 0x8 Misc_VirtualSize: 0x55CA
0x1E4 0xC VirtualAddress: 0x1000
0x1E8 0x10 SizeOfRawData: 0x6000
0x1EC 0x14 PointerToRawData: 0x1000
0x1F0 0x18 PointerToRelocations: 0x0
0x1F4 0x1C PointerToLinenumbers: 0x0
0x1F8 0x20 NumberOfRelocations: 0x0
0x1FA 0x22 NumberOfLinenumbers: 0x0
0x1FC 0x24 Characteristics: 0x60000020
Flags: IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Entropy: 6.258798 (Min=0.0, Max=8.0)
MD5 hash: 450fe750c5af26f2ac4d5107cef5007b
SHA-1 hash: 133a2640057d4f2d94754a92573b55d84b63de20
SHA-256 hash: 8772bdb4e64268a887fba530ad3aef278d931923c121dde3fdfce4cfe2a258d6
SHA-512 hash: 2362847802337f0b84335cdec83f347c3357556125de762d5858aa85fc4f865e1ea40dddcff3ac38080ad0cef09de07618ef3340ff2417a4489465117fac15c8

[IMAGE_SECTION_HEADER]
0x200 0x0 Name: .rdata
0x208 0x8 Misc: 0x2BD6
0x208 0x8 Misc_PhysicalAddress: 0x2BD6
0x208 0x8 Misc_VirtualSize: 0x2BD6
0x20C 0xC VirtualAddress: 0x7000
0x210 0x10 SizeOfRawData: 0x3000
0x214 0x14 PointerToRawData: 0x7000
0x218 0x18 PointerToRelocations: 0x0
0x21C 0x1C PointerToLinenumbers: 0x0
0x220 0x20 NumberOfRelocations: 0x0
0x222 0x22 NumberOfLinenumbers: 0x0
0x224 0x24 Characteristics: 0x40000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Entropy: 2.316197 (Min=0.0, Max=8.0)
MD5 hash: 0d6462d61251a115d6a3868393698617
SHA-1 hash: aa0ef55b715861497d36c8b405a1bf5038cf5207
SHA-256 hash: 826364f42319c547ae4687126f524fca4d1fc16721c0d0664b71e09c0bd43c7d
SHA-512 hash: 5f1c66f4304802d2adbc0377f82063897b47ba2ad762db734897d4c0fe134df904de1c0c691f5e55b8367963745e2c710b699ec35c4cf9eff5dea9296e7ea66f

[IMAGE_SECTION_HEADER]
0x228 0x0 Name: .data
0x230 0x8 Misc: 0x66D34
0x230 0x8 Misc_PhysicalAddress: 0x66D34
0x230 0x8 Misc_VirtualSize: 0x66D34
0x234 0xC VirtualAddress: 0xA000
0x238 0x10 SizeOfRawData: 0x67000
0x23C 0x14 PointerToRawData: 0xA000
0x240 0x18 PointerToRelocations: 0x0
0x244 0x1C PointerToLinenumbers: 0x0
0x248 0x20 NumberOfRelocations: 0x0
0x24A 0x22 NumberOfLinenumbers: 0x0
0x24C 0x24 Characteristics: 0xC0000040
Flags: IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Entropy: 7.340010 (Min=0.0, Max=8.0)
MD5 hash: c4db865f27854625d73419fb68382ed0
SHA-1 hash: 843da21eb9deb619e1a5cf1242b35e435ad1068f
SHA-256 hash: 7181d9d8f98ac325a8088869601fa10d8af973ed0522a0d9921363f7a8de511e
SHA-512 hash: de6ef6d1cb6e1c4f8392d887becda7b322a59ba48902291b430c89ab70ef9535276adec247834e25d954d5d493a1546701bf005c0ee482204985f9d81872f58f

[IMAGE_SECTION_HEADER]
0x250 0x0 Name: .tls
0x258 0x8 Misc: 0x51400
0x258 0x8 Misc_PhysicalAddress: 0x51400
0x258 0x8 Misc_VirtualSize: 0x51400
0x25C 0xC VirtualAddress: 0x71000
0x260 0x10 SizeOfRawData: 0xA000
0x264 0x14 PointerToRawData: 0x71000
0x268 0x18 PointerToRelocations: 0x0
0x26C 0x1C PointerToLinenumbers: 0x0
0x270 0x20 NumberOfRelocations: 0x0
0x272 0x22 NumberOfLinenumbers: 0x0
0x274 0x24 Characteristics: 0xC00000C0
Flags: IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Entropy: 0.000000 (Min=0.0, Max=8.0)
MD5 hash: ab893875d697a3145af5eed5309bee26
SHA-1 hash: c90116149196cbf74ffb453ecb3b12945372ebfa
SHA-256 hash: 02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba
SHA-512 hash: 6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

[IMAGE_SECTION_HEADER]
0x278 0x0 Name: .rsrc
0x280 0x8 Misc: 0x4352
0x280 0x8 Misc_PhysicalAddress: 0x4352
0x280 0x8 Misc_VirtualSize: 0x4352
0x284 0xC VirtualAddress: 0xC3000
0x288 0x10 SizeOfRawData: 0x5000
0x28C 0x14 PointerToRawData: 0x7B000
0x290 0x18 PointerToRelocations: 0x0
0x294 0x1C PointerToLinenumbers: 0x0
0x298 0x20 NumberOfRelocations: 0x0
0x29A 0x22 NumberOfLinenumbers: 0x0
0x29C 0x24 Characteristics: 0x40000040
Flags: IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Entropy: 4.624544 (Min=0.0, Max=8.0)
MD5 hash: 4ce3a508a9e61a1a9e66308d7385f250
SHA-1 hash: 4a6d3a86811aaee03f3e4f286de2090874b6b8f6
SHA-256 hash: 91273662934af31a9b255f6b712c8daad4f44ae7ebd694eec8a21e03f582a0f0
SHA-512 hash: 9007edff3c2f3fb2b05c7712334d903f166b3e5b9e940e2d0d13b451c88c7c439f8282141e361d1ea5f26764f873728193a1777a4424b77aeaf7f193d3d1fe31

----------Directories----------

[IMAGE_DIRECTORY_ENTRY_EXPORT]
0x158 0x0 VirtualAddress: 0x0
0x15C 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_IMPORT]
0x160 0x0 VirtualAddress: 0x9674
0x164 0x4 Size: 0x50
[IMAGE_DIRECTORY_ENTRY_RESOURCE]
0x168 0x0 VirtualAddress: 0xC3000
0x16C 0x4 Size: 0x4352
[IMAGE_DIRECTORY_ENTRY_EXCEPTION]
0x170 0x0 VirtualAddress: 0x0
0x174 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_SECURITY]
0x178 0x0 VirtualAddress: 0x0
0x17C 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_BASERELOC]
0x180 0x0 VirtualAddress: 0x0
0x184 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_DEBUG]
0x188 0x0 VirtualAddress: 0x0
0x18C 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_COPYRIGHT]
0x190 0x0 VirtualAddress: 0x0
0x194 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_GLOBALPTR]
0x198 0x0 VirtualAddress: 0x0
0x19C 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_TLS]
0x1A0 0x0 VirtualAddress: 0x0
0x1A4 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG]
0x1A8 0x0 VirtualAddress: 0x0
0x1AC 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT]
0x1B0 0x0 VirtualAddress: 0x0
0x1B4 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_IAT]
0x1B8 0x0 VirtualAddress: 0x7000
0x1BC 0x4 Size: 0xF4
[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]
0x1C0 0x0 VirtualAddress: 0x0
0x1C4 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]
0x1C8 0x0 VirtualAddress: 0x0
0x1CC 0x4 Size: 0x0
[IMAGE_DIRECTORY_ENTRY_RESERVED]
0x1D0 0x0 VirtualAddress: 0x0
0x1D4 0x4 Size: 0x0

----------Imported symbols----------

[IMAGE_IMPORT_DESCRIPTOR]
0x9674 0x0 OriginalFirstThunk: 0x96C4
0x9674 0x0 Characteristics: 0x96C4
0x9678 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x967C 0x8 ForwarderChain: 0x0
0x9680 0xC Name: 0x9886
0x9684 0x10 FirstThunk: 0x7000

KERNEL32.dll.VirtualFree Hint[856]
KERNEL32.dll.GetFileAttributesA Hint[328]
KERNEL32.dll.GetModuleHandleA Hint[359]
KERNEL32.dll.GetCurrentProcess Hint[303]
KERNEL32.dll.GetProcAddress Hint[393]
KERNEL32.dll.VirtualAlloc Hint[853]
KERNEL32.dll.TlsSetValue Hint[825]
KERNEL32.dll.VirtualLock Hint[858]
KERNEL32.dll.GetSystemTime Hint[426]
KERNEL32.dll.GetLastError Hint[346]
KERNEL32.dll.GetCurrentThread Hint[305]
KERNEL32.dll.LocalReAlloc Hint[571]
KERNEL32.dll.GetSystemInfo Hint[424]
KERNEL32.dll.VirtualProtect Hint[859]
KERNEL32.dll.GetLocaleInfoA Hint[349]
KERNEL32.dll.RtlUnwind Hint[689]
KERNEL32.dll.GetSystemTimeAsFileTime Hint[428]
KERNEL32.dll.GetCurrentProcessId Hint[304]
KERNEL32.dll.GetCurrentThreadId Hint[306]
KERNEL32.dll.GetStartupInfoA Hint[412]
KERNEL32.dll.GetCommandLineA Hint[253]
KERNEL32.dll.GetVersionExA Hint[456]
KERNEL32.dll.ExitProcess Hint[171]
KERNEL32.dll.TerminateProcess Hint[817]
KERNEL32.dll.WriteFile Hint[886]
KERNEL32.dll.GetStdHandle Hint[414]
KERNEL32.dll.GetModuleFileNameA Hint[357]
KERNEL32.dll.UnhandledExceptionFilter Hint[834]
KERNEL32.dll.FreeEnvironmentStringsA Hint[227]
KERNEL32.dll.GetEnvironmentStrings Hint[319]
KERNEL32.dll.FreeEnvironmentStringsW Hint[228]
KERNEL32.dll.WideCharToMultiByte Hint[873]
KERNEL32.dll.GetEnvironmentStringsW Hint[321]
KERNEL32.dll.SetHandleCount Hint[762]
KERNEL32.dll.GetFileType Hint[336]
KERNEL32.dll.HeapDestroy Hint[499]
KERNEL32.dll.HeapCreate Hint[497]
KERNEL32.dll.HeapFree Hint[501]
KERNEL32.dll.LoadLibraryA Hint[558]
KERNEL32.dll.GetACP Hint[235]
KERNEL32.dll.GetOEMCP Hint[380]
KERNEL32.dll.GetCPInfo Hint[241]
KERNEL32.dll.HeapAlloc Hint[495]
KERNEL32.dll.HeapReAlloc Hint[505]
KERNEL32.dll.GetStringTypeA Hint[415]
KERNEL32.dll.MultiByteToWideChar Hint[593]
KERNEL32.dll.GetStringTypeW Hint[418]
KERNEL32.dll.LCMapStringA Hint[544]
KERNEL32.dll.LCMapStringW Hint[545]
KERNEL32.dll.HeapSize Hint[507]
KERNEL32.dll.QueryPerformanceCounter Hint[638]
KERNEL32.dll.GetTickCount Hint[446]
KERNEL32.dll.VirtualQuery Hint[861]

[IMAGE_IMPORT_DESCRIPTOR]
0x9688 0x0 OriginalFirstThunk: 0x97A4
0x9688 0x0 Characteristics: 0x97A4
0x968C 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x9690 0x8 ForwarderChain: 0x0
0x9694 0xC Name: 0x98D4
0x9698 0x10 FirstThunk: 0x70E0

USER32.dll.GetClientRect Hint[255]
USER32.dll.LoadIconA Hint[443]
USER32.dll.GetSysColorBrush Hint[347]
USER32.dll.InSendMessage Hint[392]

[IMAGE_IMPORT_DESCRIPTOR]
0x969C 0x0 OriginalFirstThunk: 0x979C
0x969C 0x0 Characteristics: 0x979C
0x96A0 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x96A4 0x8 ForwarderChain: 0x0
0x96A8 0xC Name: 0x98F2
0x96AC 0x10 FirstThunk: 0x70D8

PSAPI.DLL.EmptyWorkingSet Hint[0]

----------Resource directory----------

[IMAGE_RESOURCE_DIRECTORY]
0x7B000 0x0 Characteristics: 0x0
0x7B004 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x7B008 0x8 MajorVersion: 0x0
0x7B00A 0xA MinorVersion: 0x0
0x7B00C 0xC NumberOfNamedEntries: 0x0
0x7B00E 0xE NumberOfIdEntries: 0x3
Id: [0x3] (RT_ICON)
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B010 0x0 Name: 0x3
0x7B014 0x4 OffsetToData: 0x80000028
[IMAGE_RESOURCE_DIRECTORY]
0x7B028 0x0 Characteristics: 0x0
0x7B02C 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x7B030 0x8 MajorVersion: 0x0
0x7B032 0xA MinorVersion: 0x0
0x7B034 0xC NumberOfNamedEntries: 0x0
0x7B036 0xE NumberOfIdEntries: 0x1
Id: [0x1]
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B038 0x0 Name: 0x1
0x7B03C 0x4 OffsetToData: 0x80000070
[IMAGE_RESOURCE_DIRECTORY]
0x7B070 0x0 Characteristics: 0x0
0x7B074 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x7B078 0x8 MajorVersion: 0x0
0x7B07A 0xA MinorVersion: 0x0
0x7B07C 0xC NumberOfNamedEntries: 0x0
0x7B07E 0xE NumberOfIdEntries: 0x1
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B080 0x0 Name: 0x409
0x7B084 0x4 OffsetToData: 0xB8
[IMAGE_RESOURCE_DATA_ENTRY]
0x7B0B8 0x0 OffsetToData: 0xC30E8
0x7B0BC 0x4 Size: 0x4228
0x7B0C0 0x8 CodePage: 0x0
0x7B0C4 0xC Reserved: 0x0

Id: [0x6] (RT_STRING)
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B018 0x0 Name: 0x6
0x7B01C 0x4 OffsetToData: 0x80000040
[IMAGE_RESOURCE_DIRECTORY]
0x7B040 0x0 Characteristics: 0x0
0x7B044 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x7B048 0x8 MajorVersion: 0x0
0x7B04A 0xA MinorVersion: 0x0
0x7B04C 0xC NumberOfNamedEntries: 0x0
0x7B04E 0xE NumberOfIdEntries: 0x1
Id: [0x7]
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B050 0x0 Name: 0x7
0x7B054 0x4 OffsetToData: 0x80000088
[IMAGE_RESOURCE_DIRECTORY]
0x7B088 0x0 Characteristics: 0x0
0x7B08C 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x7B090 0x8 MajorVersion: 0x0
0x7B092 0xA MinorVersion: 0x0
0x7B094 0xC NumberOfNamedEntries: 0x0
0x7B096 0xE NumberOfIdEntries: 0x1
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B098 0x0 Name: 0x419
0x7B09C 0x4 OffsetToData: 0xC8
[IMAGE_RESOURCE_DATA_ENTRY]
0x7B0C8 0x0 OffsetToData: 0xC7310
0x7B0CC 0x4 Size: 0x2E
0x7B0D0 0x8 CodePage: 0x0
0x7B0D4 0xC Reserved: 0x0

Id: [0xE] (RT_GROUP_ICON)
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B020 0x0 Name: 0xE
0x7B024 0x4 OffsetToData: 0x80000058
[IMAGE_RESOURCE_DIRECTORY]
0x7B058 0x0 Characteristics: 0x0
0x7B05C 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x7B060 0x8 MajorVersion: 0x0
0x7B062 0xA MinorVersion: 0x0
0x7B064 0xC NumberOfNamedEntries: 0x0
0x7B066 0xE NumberOfIdEntries: 0x1
Id: [0x107]
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B068 0x0 Name: 0x107
0x7B06C 0x4 OffsetToData: 0x800000A0
[IMAGE_RESOURCE_DIRECTORY]
0x7B0A0 0x0 Characteristics: 0x0
0x7B0A4 0x4 TimeDateStamp: 0x0 [Thu Jan 01 00:00:00 1970 UTC]
0x7B0A8 0x8 MajorVersion: 0x0
0x7B0AA 0xA MinorVersion: 0x0
0x7B0AC 0xC NumberOfNamedEntries: 0x0
0x7B0AE 0xE NumberOfIdEntries: 0x1
[IMAGE_RESOURCE_DIRECTORY_ENTRY]
0x7B0B0 0x0 Name: 0x409
0x7B0B4 0x4 OffsetToData: 0xD8
[IMAGE_RESOURCE_DATA_ENTRY]
0x7B0D8 0x0 OffsetToData: 0xC733E
0x7B0DC 0x4 Size: 0x14
0x7B0E0 0x8 CodePage: 0x0
0x7B0E4 0xC Reserved: 0x0