Malware Archive


Home | Objdump info | Perdr info | Strings info

MD5 : 1184d5aa33b41e695ea2660e35a95566
SHA1SUM : ac89172df9fe47574aed6a012b2c8b5135b0fb69

architecture: i386, flags 0x0000010a:
EXEC_P, HAS_DEBUG, D_PAGED
start address 0x0051b206

Characteristics 0x10f
relocations stripped
executable
line numbers stripped
symbols stripped
32 bit words

Time/Date Tue Apr 24 00:13:54 2007
Magic 010b (PE32)
MajorLinkerVersion 6
MinorLinkerVersion 0
SizeOfCode 00000000
SizeOfInitializedData 00018000
SizeOfUninitializedData 0011a000
AddressOfEntryPoint 000000000011b206
BaseOfCode 0000000000001000
BaseOfData 000000000011b000
ImageBase 0000000000400000
SectionAlignment 0000000000001000
FileAlignment 0000000000000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 0
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 00135000
SizeOfHeaders 00000400
CheckSum 0001ab25
Subsystem 00000002 (Windows GUI)
DllCharacteristics 00000000
SizeOfStackReserve 0000000000100000
SizeOfStackCommit 0000000000001000
SizeOfHeapReserve 0000000000100000
SizeOfHeapCommit 0000000000001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010

The Data Directory
Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 000000000011b0d0 00000064 Import Directory [parts of .idata]
Entry 2 0000000000000000 00000000 Resource Directory [.rsrc]
Entry 3 0000000000000000 00000000 Exception Directory [.pdata]
Entry 4 0000000000000000 00000000 Security Directory
Entry 5 0000000000000000 00000000 Base Relocation Directory [.reloc]
Entry 6 0000000000000000 00000000 Debug Directory
Entry 7 0000000000000000 00000000 Description Directory
Entry 8 0000000000000000 00000000 Special Directory
Entry 9 0000000000000000 00000000 Thread Storage Directory [.tls]
Entry a 0000000000000000 00000000 Load Configuration Directory
Entry b 0000000000000000 00000000 Bound Import Directory
Entry c 0000000000000000 00000000 Import Address Table Directory
Entry d 0000000000000000 00000000 Delay Import Directory
Entry e 0000000000000000 00000000 CLR Runtime Header
Entry f 0000000000000000 00000000 Reserved

There is an import table in .nsp1 at 0x51b0d0

The Import Tables (interpreted .nsp1 section contents)
vma: Hint Time Forward DLL First
Table Stamp Chain Name Thunk
0011b0d0 00000000 00000000 00000000 0011b134 0011b09c

DLL Name: KERNEL32.DLL

0011b0e4 00000000 00000000 00000000 0011b141 0011b0b8

DLL Name: MPR.DLL

0011b0f8 00000000 00000000 00000000 0011b149 0011b0c0

DLL Name: WS2_32.DLL

0011b10c 00000000 00000000 00000000 0011b154 0011b0c8

DLL Name: VERSION.DLL

0011b120 00000000 00000000 00000000 00000000 00000000

Sections:
Idx Name Size VMA LMA File off Algn
0 .nsp0 00000000 00401000 00401000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
1 .nsp1 00017de8 0051b000 0051b000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
2 .nsp2 00000000 00533000 00533000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
PeRdr by Frediano Ziglio. Build Dec 27 2007
Runtime Error: Invalid order of sections
KERNEL32.DLL
MPR.DLL
WS2_32.DLL
VERSION.DLL
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
WNetAddConnection2A
VerQueryValueA
`j@h
WQRS
[ZY_
VRVj
VQSRV
Z[Y^
YZ[Z
~,vU
b_Lz^
~ eVx
$Wue
$3Gp
fKAM
9M`U`
sNbUdD
T!|dI
w:?9
@@9A @J
U,.-.._
o rR
e $3
8i#?
Sn:d j
Fs"!(
fhF*
OT~m
yF)M
x+{{
qhbN7
Z(Ob
f\V
#1C@
q6Eb_
1U)p
h{PQ
+Z*W
jK1k
_[e-q.M
`0DR
gh&6xo[]U
=XTUGO
Q&&Q$j
|0JM
MT9>
7h(F
k2*j
>^C=
]A);
cC5i
WKZL9HS
5kj&x
(+?>m
JC_u
fqa#'
)X&*
)Z|D
^;dsO^
Qm[E
?'Kb-=j
}F>X
Iy1U
Xi@5G7
/\j%
1^\f
|P:G|
&8bM
93/_
oCN%x'Q
>A_Fx
Yqn8]Iw
P)QX
_fbK
JACwc2
8@q y=9v
M=d2
%K{ n
&M47me
!e,'
<*zts
gLCV
b7M2
;b;$
yzGT
%Irt
%v_8
N[)Q
!`W|
-y8bpF
pgVP
QtR0
VHlO
-"m)
8*p,
#C1B
8G j
Iw4r
1j?1Z
G]aJ
!aJ[
=mZp
VO0-w@
pKoX
>lLw
S'|NJfS
/R@b?St
6zCr
!hAb
\=to+\
i@!/
%o:N
\rEp
p)Ae
*(Cu/
eU2|{
DvfP
Efse
:VGm6K
UR(^
mm/"
3XP-W
`\Pjf
y{|U
CQ#X71K]
2ZJC
d/-T
E'al%
X0>JFv
$(V]P
b)78
>:c25
Ox:v
%7/p
<FCv
2\]A
f?#_
;ucZ
NEi5oZ9
J~$;
j/x_
p@m2
iR^/Q[3
bMC`l
Q3M)
?P5L
sW>T]xP{
m&t2
Iz3\X
:,G$
}j+8
8 AF
XPD/
,L@I
Lyoq5
H: +
?SP,
1hAS
`\lO
R0GKm
fwD(Q
{i%pT
?IZu*
Kd)o2B
WBt<
T&\9A
wecG
f _!~
:6k)L
,e5}
-+Xj
0;.|
a/K= '=
RLEu
6PTj
%k]N2>-U1>*
#Wj%"Ng
40b"W@
A~6?D
84r@
MYd:J
Gxj%7BD
;d_t
~-%2
*/R&Y
;XLl
6={n
oBlD}E
*zt{
'~r.*
"qww
DWC
6xRE9
f!Yu#G
"t~gK
~+dC
S c5y#
BOrL
eA`>e
Vg<oJ
??g>L
`kk9R
f5*+
Us!R0
3Las
pM;x
{JDvUu
|Qej
L;Z
1'DY
"]|fl
C7Sj
DW-i
~xRD
>wn<
p3V#Z
5_S)
2C'i5
=QyFT
pB\'
ROg*
;jSW
$Q@f
_HBP
oBE&
,G+_6
>75z@+
T{|
,lm2]
0<W7z
)Q? @
Jk|)
}h&A$
_QSLw
%F:{v
wJ9*v
o*5%
M_Sa
Zw@7
+j P
"3Xt
m8:,q
eA+g
AxC^
yt}C$
@}~R
5CKp
i3DL
!"'zJ
0vh&
9_8O
7D|?:
6 D2
#[9~
e(9?
l#=A;mk
'YR0aq
zA^A
M109m
|v#T
N YN
F{a&
p|Dt
4@Z'L
[ 7B
(}ky m
GrlI
qaIm
tWS4]oy
Pk"-
?u/hEL
1ZT3T
b~V4
-nSr
Y ~nVfB
D(Ha{
TV3s?
`Q]n>1
4P]oN
fD$+`
wMw
F,w%y#
KoW.
)0w#
vtG6
;EzS
zXUV
"6hU
##1W
<yGg
4|4-
IGtxy1
0N7x
J\B.zRGX
;k !
^e#X
T r9
@Q*>
6S9o
E`Ia
>v~I
ZD-]
)po[
e;zQd
VzB!
aIp5
-GXO
>f;*
a+7P
JCv"p
TCtV
dm}4
4pve[C
"36@
EuxqL
`P\<r
H\vM
8-wC
p:GG+?>
6?<R
?alDZi~
!xnS-
J2{$
.bRv
{\qi^%;
-{|3o
mtP{g
zOX,%9
sQ>R
)#}z
s>O5
Fc6!#
"h /
6VF I
v8 %Q
[xKo
~yMsK
LE&T
S4*M5T
2fYoZ
{K:iP-
3aZ[
[J -
T]U"
v%>B
P4a6
)t-IV
Tn$3
@IGq
c3 n
YC9w\
^/U o`
(y-8
rOX|
$}*?
yB|fI
h;-o
dp)#m
(D"b;/
Wf4y
k9kn
S4K"
>{>8
LQf+7`jaD
C]K!
5dU@)G%
&]Wep
Xz_W
%uO]?
vc\H
[E.W
@<Hp
S+? "+
h2=p
#/#{lOe
ggLs
]anhLB3
CCEn
LsJ5
"/[^
)7Df
r{NHc
xD!IO!F
-&'
PX.7g\D
'giK
I)^A
~2x\/
PMW:
50oJ'L
S)}e
WBW;
Er&{
WI 7'P
1sb*N
bo]u
3~34Mwjr
`:mJ#4J
,dk<l
{7|,
^YH4I
0:#Fp
T}Q
]~/:
I[UDqs
Yh~a
nbAzUs
\ezFvq
!L2I
OyqW
!Z.7
9b_!
Mqm]
;P{A[
xbQjL
h`x+
F*a:
d)w6
:%il
*#r&
-?K.
mE;O&
yb*n
EFuzV
2}Dy
s).TH\
hjMj/
(nSLNW
]N>v
{-yw
aZZK-
5d/
Br15
&NvM=
p s&
rOGR
F>CN
zv'j
\JCB
;z>Z
'W]B
sR"?5
KAE4
Tj!\:
-5iK
ZW&X
YX,o
i8I;
gfBd
bx'Sl
vP[6
*1^E-
/.h2
`x"L
Md\;
3,GOm
/:ci
;Wmg
2X5P
NbW<yN
14)S
.Rj_
U`D@
#?#g
GNXp
S^;S
Cvpd
UP|a"Q
T84l
rG09
-zGb
:U3V
I*4:|
;_HyI
f-+f9
nda7
Zj;B
bB~R<,
H af
3MjY
JX>(S&
3:-we7}:
B Z5Ez
A,2L
cD,`
/ "Z
E'/U
[QX$xk
J*\8(
Y;ff
pD0&h
S~>27U^
z"5n2
|O/|
Ad?'
hyq
T?F`Er
/Omn
0' um
4wf#
$:Z$
Ij$^o
ZOPY
gL:Z~f e
+#B!Vu
c{{6
QOP3
7C(wF
9g(P
+W,k
pRz]
apLG
MJ>a
^XI?
A>(:
ctQ7
fMm?$
Pl?0
Hz.9
k#3l
(z$J@
@D]p
B4wBx
TgYT
0#TiT
ih@r
2.~{
1* T^G2
f1,_
p(y{u
'G<l
7CSa
xr\?d
l~^5
B/]w
E<1K
(yNPa
;7,$
vwr/
Z)0
:0,s
8Gxy
{~#k
9YF<
s,iR
k=IEbX
I@jddv
\1<2
X]r`
,O&+C
`+C6,m
TGfy
d \X
f=3.xH{
,2x?
g[$H.9
[Kf<
7vs-
tm=V-
1}K/
HIPJ
gW_-
a~#6YFd
"<ql
PQAt
IEV#
6'`y
@?we
HUq2
"Zd.q_
u/Yx
;*pi?
bwy`
ROFK%
Op]f
o#`*S
*5?j
_P|u
r]6j]O
Ry"n
[4GH(
*(a;
I}2V
K>/*
LyHy
Mf8SA
^-{+
;D.:,<~
Em+J>
7x|)"
0/]
!I@zc
5.br
}_Me
Et)
F=N!
RBGCt
U68e
haFE
bPw-X
s~5==r
MU?Cf
6' %'
xN1o
E>3h@yKP
F*5"|5
,~]}*
jWRw
ZPt8
Z)!o`
^d];3
;]}O
v$vrK
BM"u
<'u;
`,SS
[+FQ
;;a4{
[{ytEz
z8K8
n5`$qWY@
Uuu0q
$B6B
Ct.O
h*Bq
uzYE
a$$@
Oi^V
f{x%
U:*s
n# x
G/9a
N;rw
h(7
2hig
dT`n,
x-Hu(
!}8W-
*cIt
Fe'C
F8%<
CXQ;
Q~b+>
W>Be
0p*A
6u~%
m114
%RQda/-?/
Ms"o
k=#x
:g!LMQ{_M^
XmRkN
W.,#
]<-5
x|)+
=>fSzdm
FkMn
*~'8}
ZzJ.
[L#6
=v:MU
ix{p
{30:
QH@L
l'TM
!:MY
Saf0l
|2Gz
7!i7
MHFH
z =n;MB
W]$MU
hH" dC
q8w2j
bz}eg#(
d?0 w
|%8+z
mpN.
}Aj<
>T7*
i#Mm
nL0@
k.T-
mX3.
<`8=
{#(R%
ub^O
Jt|/
3(w
kUs2
@(#xx
^9ye
"7wdk
kOd9}5
^e|(
iKt
`^Y|E '
}R+F2V
^Q=l
^PJv
~evE
}J a
tome
1g"(
^1.h
&PJPB
rnsWf6
IDP(Y
b'Yt
B'Id
^Y,C ^c
I=C{
jss]
Kbt1
:yeG
/D.[
snrj
5bi8
~4jwEK`
*:{z
9!Fb8
r1s5
6(3H
=">d
&gG.?
dp4/W
t]~#
rR{V
DMMO
?f#`
}^..
gd+G
O8eV
64 Z
gq;
PzIl
}U F
VT[Q
U&+"
_0'g
>q3".r:
fuZ"
\miiOr
2Y&Au
{;6}<fp
nj9}
fWTv
M%n(
d+M(&/.
kEn@C6
tEo,
>^p;`
^3p e
/k8}
v\hJ
P?TI
8iR!
])#A
7 9)
JPC?
,w`4WRs
LLwM2
tWnm
C&lZ
\X!z>
iR7Ql
vKt<v
$;R7
0$?E
[?O*
aGI6
-*M
h"A%
N,QE
{eDz
EYS*'
S9"eA
} Wu
q%;u
HdN3
1}Fd
n<6
nt54
=t;q
{XFh
up5<
{y,D`
(!%[
tbGE
59hO
{j`~
c&1+
Pys%9
p,Jf
joDE
aMX7?9
6-I1+
2p\Tt`$P
I|}FoM
f(7
(<iR
oJwA
Gl.]BN
_gwjh'<
3P dV
b8Iz^
OOpd)
)$[0
N[}V
6}?.jj
"NR2
=?B1
B\S3
5=U_
A&F,5
3/x_
Ndki
][C
a;nXd9
1ewh
/f(U
N5q}
&dHAY
AhDk
j?m}X
g:DhH
8P5#x
;#9mbA
ukbS
N=[';
VLa@
t_qE
+sb-+
P4,W
e.K_
Mg {
L@ q
|8&lb!
THcnh?N//=
IC\8
-p*8
!ywK
ZFnZ
&C\F
+Nq@
7t*wL{Dv
W0K\
O.FA
x|{-1
5[5,L
}iz^
{h{x
?^"(
[q^(
L?r%
K-D2
-Dr~
Sk,-
yi:q
YR@+;
PC,GZ
KTB#
*n9X
7/q'
h*j/
o/j\S
m>F"
dAX&z
u (,
k?v5
@Qrp
[1X<kV
I'M_
50li
(#~s
j)sR
|?6=
Na9
(s.Nt
i#xv1c
^C+h
YyYB
}hD*
%\$2
dpO>e
XZA#q
jY)X
BqtU
u=J
c]bj
R|HA
hd`(
z?OI
fG.~
K`.:
wxjqT
]iK[
S#DcMuP
.$EN
i\C
"&TX
L.au
Cs:?3
!8},-
H$lo
>PHG
B5;b
j]8%
~ROS
=<'z
=XX)
6(@`
+E6r
rX*k
%+V"
^Mi]
6,]W
+hu#T
2(Fj
'm9V
C![=r
~\H`
.Hp]j
\Sv-
dsN|
MIcg
MI1w
ToS,
R%,bj
OZRN
wMlc
/2hG.U
6'i(
4Yt-
j3dT
Zm\r[
%^nF
>nCj
'_]a
sZ8>
?:zV
!;UN
ygZV
= GWQ
("K=
'RS'R
5t29
5#EA
101G
H{ a
?Ir]D
w@)2BsP)x
X8a~
frhvd_RM#\`W`~
4AYB
4PgD
"RXU/
nT`>
Db|>=
8/uQ
v3Gz
w@K8
l8T/Pq>
}%U\;4d?
;&3^
~g<A
QF-u
\F'<
To!M
.wEp
(dSE
pcR/
49]P
v\+|
lnQ*
b7(,w
OCK}7
T<G=
`@'>
[/v-a
Y gC
]3BA
br@xx|
8q$D
sD)V
0h!EK
7TK5
2+sF
?@@+v
6aEL
2L)>
a\o>
]Ja>
2Q^>
|62i
x^g@C
4nnm
^~|cZ [
p*n3 ,
Sp0{)
V^iH4/
?r2O*~
crX=z_K
tL#&
>mr=
}uB_Dd
m$_I
!A>m
z_7~
1eK!?Q
Uyj/
zhI%*s
b%Ns
g(#Y
1x}Z
*G\e
wV^7
7Xy>
HX?I
@Qk|LX
43Pv
0%bek
1=~o
;MdX
Ky95w
+\uz
6W_.
6.5J
UnoB
=BM?
7/z?;
E*te
$i R
RaI*
W9aK
*Mq50
^[qM
D8jI
TuP',8
/bFZ
@<IWyg
!k/F
jG<I
k!7Ey
z._
u.H[iD
|+ j
{r:h
t][5
t`xOf
"b3?
8ABQf
w'cl
S$vn
*wGZ
CR$0
L(Y$f
n8Ct
PXhgg
U}`j
*VLd
DRQ<v~
=cR9i
HY"V
#>Z{q
6gI;
F3++
c"K2i
THR1.&2=w>
/*'$o
M6;=
pOxCc
UC$q
WOEU
_S-O
aBNw'
RhI})
r6Wwl
6[p!
Qi%x
+b&8
^QH;)
)Wep
"|#x
M+ :
*-wP
,,6vs
t- <m
=^T(
R9d4
s<4^
}^GP
C$fs
WA8=
V7.(
ON%fG
5^OJ
^.nU
FDTv
2NKu
Bi/9
]-Uln+
NJu'
DruK
>QQA
d3f~
$ry,~
W r\
1P2R
hZ.
pJ$*
(Bm%@&dZ"
0Ot;)
zfB,
yY7"n
9$yW
@J@W
liF=)
\B0)
px}{cR
+nzI
l%Awd
;{Ap
u2wDc
PmbQ
wp>/
*e0^
7A7a
s}Pa
i`!=
wp?_j
&~wGZ27
!LHC
Ug:h?2C
Ud D
i{bK
uL}d1
}NZu
Sey*
"`UD
SylfK"
$ZlJ
hH2`Y
RcX2
pg,N
uq-j
x3XaC
YONT(3v2
6D. d
?;Q'
dDs$
5;$*
C3=qL3
x}-#
Vyf-e
nG[+
z_1C
nK^2
WJRbE
Vv!Y
G~Jq
]z*v^
tU=
MufsF
CU\rr
<4eT[
k~ N
Ky3N
w+!I
a"@}
[8-L
We5D
2w7z
^_f)e
0OCW
.t58
_nB
ut+K
V)3]
75-dv
5a,@
l(EW
.CKH
bRPw
<QYE
Bw:3
zKiZ
YgUeC
y./4
;C8!c<T,
KLK[
jGM)X
x&~[*
BG>Q
+4M/
N%'s3
y7%i
c{SH{
6l :
P0"
q`KI
TAJj
K\L&
J+MoWM{
[d?}
HjaE
:5Dc
bsy)
jrcs
(@m7ox9
";"RnG
'3wT
@[9_\<*
n3~J
|f5L
U:mI
,[oH
:T&N
B]z/
W}cp^