Malware Archive


Home | Objdump info | Perdr info | Strings info

MD5 : 28a7488349bbd715790f3ba269f0c7a5
SHA1SUM : 695f40cee85715648f9465d3d8e12c0312febda3

architecture: i386, flags 0x0000010a:
EXEC_P, HAS_DEBUG, D_PAGED
start address 0x0047fee2

Characteristics 0x10f
relocations stripped
executable
line numbers stripped
symbols stripped
32 bit words

Time/Date Fri Dec 7 19:20:42 2007
Magic 010b (PE32)
MajorLinkerVersion 6
MinorLinkerVersion 0
SizeOfCode 00000000
SizeOfInitializedData 00010000
SizeOfUninitializedData 0004e000
AddressOfEntryPoint 000000000007fee2
BaseOfCode 0000000000001000
BaseOfData 000000000004f000
ImageBase 0000000000400000
SectionAlignment 0000000000001000
FileAlignment 0000000000000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 0
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 00081000
SizeOfHeaders 00000400
CheckSum 0001a225
Subsystem 00000002 (Windows GUI)
DllCharacteristics 00000000
SizeOfStackReserve 0000000000100000
SizeOfStackCommit 0000000000001000
SizeOfHeapReserve 0000000000100000
SizeOfHeapCommit 0000000000001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010

The Data Directory
Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 0000000000070018 0000003c Import Directory [parts of .idata]
Entry 2 0000000000000000 00000000 Resource Directory [.rsrc]
Entry 3 0000000000000000 00000000 Exception Directory [.pdata]
Entry 4 0000000000000000 00000000 Security Directory
Entry 5 0000000000000000 00000000 Base Relocation Directory [.reloc]
Entry 6 0000000000000000 00000000 Debug Directory
Entry 7 0000000000000000 00000000 Description Directory
Entry 8 0000000000000000 00000000 Special Directory
Entry 9 0000000000000000 00000000 Thread Storage Directory [.tls]
Entry a 0000000000000000 00000000 Load Configuration Directory
Entry b 0000000000000000 00000000 Bound Import Directory
Entry c 0000000000000000 00000000 Import Address Table Directory
Entry d 0000000000000000 00000000 Delay Import Directory
Entry e 0000000000000000 00000000 CLR Runtime Header
Entry f 0000000000000000 00000000 Reserved

There is an import table in .dd4 at 0x470018

The Import Tables (interpreted .dd4 section contents)
vma: Hint Time Forward DLL First
Table Stamp Chain Name Thunk
00070018 00070000 00000000 00000000 00070054 00070000

DLL Name: KERNEL32.DLL
vma: Hint/Ord Member-Name Bound-To
70061 0 GetProcAddress
70072 0 GetModuleHandleA
70085 0 VirtualAlloc
70094 0 VirtualProtect
700a5 0 VirtualFree

0007002c 00070030 80000017 00000000 000700b3 00070030

DLL Name: WS2_32.dll
vma: Hint/Ord Member-Name Bound-To
80000017 23 <none>

00070040 00000000 00000000 00000000 00000000 00000000

Sections:
Idx Name Size VMA LMA File off Algn
0 .dd4 00000000 00401000 00401000 00000400 2**2
CONTENTS, CODE
1 .dd4 000108f4 00470000 00470000 00000400 2**2
CONTENTS, CODE
PeRdr by Frediano Ziglio. Build Dec 27 2007
++++++++++++++++++++++++ FILE HEADER INFORMATION +++++++++++++++++++++++++

TimeStamp: 47598EFA Fri Dec 7 19:20:42 2007
Subsystem: 2 (Windows GUI)
Image Base: 00400000 Size: 00081000
Code Base: 00001000 Size: 00000000
Data Base: 0004F000 Size: 00010000 (plus 0004E000 uninitialized)
Entry Point: 0007FEE2 (file offset 000102E2)

++++++++++++++++++++++++++++++++ SECTIONS ++++++++++++++++++++++++++++++++

1: .dd4 RVA: 00001000 Offset: 00000400 Size: 00000000 Flags: E0000000 (ERW)
2: .dd4 RVA: 00070000 Offset: 00000400 Size: 000108F4 Flags: E0000000 (ERW)

++++++++++++++++++++++++++++++++ IMPORTS +++++++++++++++++++++++++++++++++

DLL: KERNEL32.DLL
Addr: 00070000 hint: 0(0000) Name: GetProcAddress
Addr: 00070004 hint: 0(0000) Name: GetModuleHandleA
Addr: 00070008 hint: 0(0000) Name: VirtualAlloc
Addr: 0007000C hint: 0(0000) Name: VirtualProtect
Addr: 00070010 hint: 0(0000) Name: VirtualFree

DLL: WS2_32.dll
Addr: 00070030 Ord#: 23(0017) Name: socket

!This program cannot be run in DOS mode.
ORichG
.dd4
.dd4
.nsp2
KERNEL32.DLL
GetProcAddress
GetModuleHandleA
VirtualAlloc
VirtualProtect
VirtualFree
WS2_32.dll
j`jx
t|{UA
I}]E
#A/nB
#6e6
wUPz
o.ge
?Gk9
U;^K~
H_C"kQ 3-C
m$:lS{
uvV'
rc/"x
Pay!C
(FBfq
18[KGX$
DFG~
M0q,
^A?z
vHY_Hu
&im
hvsG
(e-[
&ooM
>b)g
r:La
Z]M,
+6(+|
z:Il
~%aX'I
#m%^
R$?(
/2HO
YxOvl
e./E
g4=+
,C7q
,^|N
w#bv
`3t
WInHa
LDuZ
"EE3
,P[?
,y~2
_eIp
Kp&e::3
cdXlJa
}G/g
%r]P7
md)T4
YVmo
YS0q
U1hR
.Avc:
2|+
Qef/aEh
_Y'<
|nZN
<P52
0kvc
wULD@
H::$X
in_M
(c_4
7_Og)
O.|.3X=H$j
JcnD"
8Wz^
T-A5
tj*n
cnw_f
{z#G`DD
+V_~EK
@wlR[
_a'h
UVx|d
$U6J5
0Q8OZJ
{$P^
_Z+
O.:C%
"v+
SKwY
xs^GTK
_(8;
Uo/,
#: &
'JIg
2(D!
rh]Q
,l2H
+&gKD
wRd8
%?[c
xDKJ
=H27
3^$}t0
$Hh^
?YLe[
'8^ OE
A06`5!
HE%{
UN3`
Wf7*
SKy0\
(67c
t>hN
`f^0
+o~i
GPxe
E6C;
?vxW
[;=/
?fw8
l3M]$
2!E_
}_Ns
H=!g
@PBy
CzAJE
<Zcw]}
hgo@E
2e4%K
WB)v
9<!DNR
z6Pi
5.WX
LU41r
]L01
G*-:
2G[s]
ZbB!.
dW3B
eK4z
}_$>
>Q:K
jQ5p
Vf:C
"|n9
:|3<
: b+-y(
5%|K_
}Ujt
Hap<
hcB/S&
tEi\L
zl"SyJ
+Z#{
qnSM:!
B>\\
KQ`C
03w\
qjdK
gS3<
-R=F&B
)Lnx
]Abr
0j+ge
;UX?U
lQYn;=
R^#\<
Yk@|g!$~
meg~
ttw7
(j{B
FhIF#P
,scf
p_R*
'{4/
fc~k
zRyn
XHSO
]A"i4]
vHdW
6.<fK#
j!]6V
Hu@R
e_
UY-Q(l
JB4J/dx/i
'!YW
59[
w`W.
RoAxJ?
bQND
Q%X"
]Z`;
&uUT
&#mI
Roe3g
/X=i
H>XM
Fa]@4
Z0M
iTQPr
'j!?
QD<I
y5v2
m[;,fb&
O.ib
"8">
SW5!!R
WB h
._cD
bfAl9
zTB/CLT
%y+MOl
pSV
o^%e
T3uY
\y4]
s&al
@>1x
rn&1Wq
#GjW
\G'u n
,:wa
ZHrz]T
MrS~
xf-r
SdD]
#q4K
W;/("JO
7:>{z
z`0@
,4{f|
$,2DFj^\&9
$=S:
OJ!3
:xS,
`#D}]
OCdK
%"y$
W=H/
5eQJs
6=QbM
.]Aa
bZ9rAV,5
VZ.JJ
i!jz
DDbJ
@*4I:
<<7M
jcg?
6PsKR[
Pi-fzO
LDs=\F
b\>rA
Jts8
K'Xo
O;dd
\H{2
/]#I
~+}kF
Zm@0,
YJ~
dc5/
mvE,
hu@H
<"elB
:K%
OuovD
Oj]%
QMoL
` *i13
Y$=M
0\sO
-k~
*u"AmF1
w'8z
tb$(
i>TV
Fv5[p
b@R^'
D0I>
",Cl6
VEh@-Y
z'/@
7`j3
9MJy
4R3k
#vomw
sm2m
!il;)
zKkg
NcU`
('Tu
s8Ru
&2rk
c$ ?
"[~d
@J.[
?K(B
Ys}3
#7_h
/TE(y=8
y:=9
{"'h
TBD-
wy*Q
Gt^0q9
#N;(
rO'b
2U80
D41\
;]>tu
b#OT
>V}]
[&G{s
v@xjY
o+1Y
\E;?
`W1k
Di%GF$
rnW5#
@S+Z
Aih7
z<c*~
C[V[
Xxj(
"HpK k
Z6#Dnq
+h~U
\d~E/@
xTUN
#4VUFN
a4{+</
RdZ!
ChfM
]P8`m=
Pvt7
[)2(
\!Hci
3F^d
f&x=
67*
-C>;
iM/y
g[K[
Q~4gN
_dm,}
SRGl
i!,%
^KCns
XHQGU
0D+,2
h J2
U<~J
ufTr
qv% 91
UgK
?K/1
Xaq*
)=}s
Z8#WC
$~3iZ
`Ra)p
Iw6wV
dd5~T
U\/VK
~RyW
fAnE
,,#r
6.|!
[XBn
.xG>'Y
_0-h
M\V3
EFE{
RU<=]n
Sb4q
8vk}
P`1\j
$Q08
1=ZV
omK&
%f#_
SD-_
o \&-
%/TT
{}Yhl
Y?78
+6&yF
I.e1
d=Pu
?qk/
H1.1
HX jz
F\Ndc
1a9:
mFf
1[!;I
U|Y+
JQ=*i
G"';
;J?n
=p(Z
m;_%#?
MP8Y
K=wc
3\5b
?L+"
p<An
H)[z
|ZbCT
F(9.
Vy~]H
dgdXMH
v}lb:
\JcS
Qo'pC
@Fpph
7x?z;
$4;|
hV%f
G+FW
<} 8
I(qrV
j8'%
/xz]\
%#ni0{
u:NR4
,4dFFxq
s)?W
EM!+7
kbdG
vN{wa
&gq}a
@o*]
9"(y
>w>rE:+
,`;i
*SUg
hJ2{
z-j]
uHv=5
i&x{
drAUV@
!eYb:@
IX}j}
6R7M
M52$
{lwbI
l&Eav
MjQ^
VnP[C\
Cs=y
eFuN
|_sK
j-]o
X}L<
2055R
>;yQ
H]YQ9
:]k.
nS$aDHy
spm}Si
it[i
EMXA}w
>;@A
s?'\<
9'<>K
1W@9
y! C
n'8\`
#~JGBs!
\uNFY08
bq46#
a_FTLk3
lk4d
-B^]
&Sm??
c{)"Y>i
xEkTT
E.qt
wc!gJ
[9+4
%37?
mvk}p
^QI_*
UG^,
kEAw
R/z{(
Nth~;&$ZH
s*gyk
IX KE
YLT@
8h8#
taU3
N#+H
S@Wp.
bHY\
ik.UMm
ErB)
]v{d'
2t:I;,+
Cz/S4"
?{V9
]*&:i
.X,&s
,ki8zs
'whQl
]$*N
qIy@Z
(*Ar
FW(9&O(
&>(Z
iJER
#<!x6
)Wi(
30@2
*D"?P`
!@Sl
Z]?hns5
)Ta}
Vx.,
#e7#!
w 4
$\hZ8?|
Pc`^
=O2um
4P69
EAfOL
T!D{
D@Fe
&+IP
8%D!
Jx|1
WFM.
Fg/%J
4{]F
C2!#
I$'~
fo0"-t
p uu
!E[L.
yLHY
_Y44
6g-8
BXQZX
Z<X#
"p.-
'8_G
@6<l
1I'G
n'wI#)
h`pW
xpmnzY.
~#sa.
/1}
:]$@
*{TL
o4;(K
X!`qZ
8-&;
w5=FG
]9s[
^ZKM
){!j
i~g~
@R/5
?no6l
"7w2
X?o{
BG7S
[g/^
sm!mO8
L)6[j
[uJk
^ES\*|
G#KD
Gy#r*
?gN*L
FQm
u@8;
ntDA6=w
sQ=E,
u(e*
J6%P
3yX_[,~
17S)
_$Na
+t5e
@zZ_
f8j;
IERT
4fK?'
dt$5qw
JYgk
ieZ?
!J|7
<Z6<
2"j"u'
e'n~
D6o@=^
;<vu
!:eu
LB."v
N?>v
KrIdLg
KZ9&
r|^ca(
>JS
r0{N
h:xO
t wX
d(Wu
N6Nn<
(/#*fq~
RG.B
z?i]
0"-U
]!=m
W~&D
dn)E
ANyO
PR0e
iGf
mHsKM
+#z>F
Qt'wf
d[-^o
dk)~
q}|X
AUk:
:Dpk
~ 6tT
q(Zu
[314
I~#Y
p<Nh
9cFj
oLmC
.*Uv
TNdB
MJW!
DBT
)+} =8
?%!L
(-b|
m9|A
++9`
CxHvw
?>.T
@o{=
'~8[OF&r
RAD
1xf@
42%A
P6TA
<g%o_
E:>w
cxEE;
_yefR
3ce<le
ky:ySly
~_ae
\+1
^qGS
A+^T
k^HdE
C*P?SP
Wf;a
hF.ee
>%*D
S9'>
l@-Lp
|Q`l
q[h##
8"1n
r@du
_a*Jx
!"&N
d$66d,
*7{'
e-"Q
vH5N
VGe^
s G<
:ht@
=hv4K
]$4}9
r7k^
T 7K|
jE)G
?~' 'c
XoU2
uw "
(}uH%zu
&=x*
eNiNC
%n|X
mKi|
#%L5
T08#
ekT7
F\>X
z%Mt
;PK#fK&k
cEkF
);rd.
fAUe
=8fpq
-c 1`
ZzQT
y%Ce7)
/ut/&
,Sw-
#Y_P
NJ,%K
nAjZ
IqC~
yf/,
d0Q>
H>.fI
,6`g
EWvJ
,,QXT
b+\i
1Gn"
_ LW
Nk~BMI
LKFC{?@
suV62
~FA]
Y&w%Vz
peXo
x aj
gkU_
Wj/?Vg
{lz(bj
t+B :2
}v<e
f:GN
9w<"V?
]V>BK
0sr*
q#GN@
ReDEu
l{|y
;D1lm
j[.`M
|\[w
:?D9
i|b-8
w}S6=2N
l`*y
]URA
[N-}
v\|k
T2scm
Pl&<
9X2Q
]bcQ
CuuF9
{VWd
2cM #i
TPeB
CEG1X
'6!f
Yvb]
)e5<
#@ c
_;qa4
=CU,
l S`
[;[=
^~6u
u /9
\OCHtJy
P>f;
/_A>3
55$[F
l~)I
3-(s&
72`M$
&#f"
U(uSr
8MxDRZ
vZ]cf)m
7T%%
V>*^ne
^dr/tm.
c;q]
rOT~
,!Dl.
?Id"
W%Z5nc
8'65
. 1}
-Wbe
AN(_
cluC
bn1x
)h?BLR
C0yf
#ulE
al24u}
h"%$
+z:ht
PF(8
dTSO
m/$Wr
2Gcj
^ +T-*
$@Tv
G_XNM
0 De
-#4M
1i7L
WQQ.
`\su
.Fkr
n#oy
kmBl2
@10@
ZuysC X
IVK$
X+T"
bR18
l& us
`H"n
]96"l94>u
^UYb
<oc.
SfQf
fYRB2
Z[CfP
aUO)
Da0~
'r~xNop
0z(l`
{'{A
DaPumHy
2Y{}M
Yh'M
{YPa!
Id?B
_{QtU