Malware Archive


Home | Objdump info | Perdr info | Strings info

MD5 : 361d2de75860293ff2fae44f544ddb8c
SHA1SUM : c50604ba9a49974f743509349aabf275a0d810df

architecture: i386, flags 0x00000102:
EXEC_P, D_PAGED
start address 0x00423253

Characteristics 0x30f
relocations stripped
executable
line numbers stripped
symbols stripped
32 bit words
debugging information removed

Time/Date Sun Aug 19 01:14:41 2007
Magic 010b (PE32)
MajorLinkerVersion 6
MinorLinkerVersion 0
SizeOfCode 00000000
SizeOfInitializedData 0001fc00
SizeOfUninitializedData 00000000
AddressOfEntryPoint 0000000000023253
BaseOfCode 0000000000021000
BaseOfData 0000000000017000
ImageBase 0000000000400000
SectionAlignment 0000000000001000
FileAlignment 0000000000000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 0
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 00042000
SizeOfHeaders 00000400
CheckSum 00000000
Subsystem 00000002 (Windows GUI)
DllCharacteristics 00000000
SizeOfStackReserve 0000000000100000
SizeOfStackCommit 0000000000001000
SizeOfHeapReserve 0000000000100000
SizeOfHeapCommit 0000000000001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010

The Data Directory
Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 0000000000031c90 00000064 Import Directory [parts of .idata]
Entry 2 0000000000000000 00000000 Resource Directory [.rsrc]
Entry 3 0000000000000000 00000000 Exception Directory [.pdata]
Entry 4 0000000000000000 00000000 Security Directory
Entry 5 0000000000000000 00000000 Base Relocation Directory [.reloc]
Entry 6 0000000000000000 00000000 Debug Directory
Entry 7 0000000000000000 00000000 Description Directory
Entry 8 0000000000000000 00000000 Special Directory
Entry 9 0000000000000000 00000000 Thread Storage Directory [.tls]
Entry a 0000000000000000 00000000 Load Configuration Directory
Entry b 0000000000000000 00000000 Bound Import Directory
Entry c 0000000000031000 00000094 Import Address Table Directory
Entry d 0000000000000000 00000000 Delay Import Directory
Entry e 0000000000000000 00000000 CLR Runtime Header
Entry f 0000000000000000 00000000 Reserved

There is an import table in 5 at 0x431c90

The Import Tables (interpreted 5 section contents)
vma: Hint Time Forward DLL First
Table Stamp Chain Name Thunk

Sections:
Idx Name Size VMA LMA File off Algn
0 0 0000d800 00401000 00401000 00000400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
1 1 00000800 00417000 00417000 0000dc00 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
2 2 00003800 00418000 00418000 0000e400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
3 3 00000400 00420000 00420000 00011c00 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
4 4 0000b200 00421000 00421000 00012000 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
5 5 00001038 00431000 00431000 0001d200 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
6 6 00004200 00433000 00433000 0001e400 2**2
CONTENTS, ALLOC, LOAD, CODE, DATA
PeRdr by Frediano Ziglio. Build Dec 27 2007
Runtime Error: Unable to read from file
++++++++++++++++++++++++ FILE HEADER INFORMATION +++++++++++++++++++++++++

TimeStamp: 46C77D61 Sun Aug 19 01:14:41 2007
Subsystem: 2 (Windows GUI)
Image Base: 00400000 Size: 00042000
Code Base: 00021000 Size: 00000000
Data Base: 00017000 Size: 0001FC00
Entry Point: 00023253 (file offset 00014253)

++++++++++++++++++++++++++++++++ SECTIONS ++++++++++++++++++++++++++++++++

1: 0 RVA: 00001000 Offset: 00000400 Size: 0000D800 Flags: E0000040 (DERW)
2: 1 RVA: 00017000 Offset: 0000DC00 Size: 00000800 Flags: E0000040 (DERW)
3: 2 RVA: 00018000 Offset: 0000E400 Size: 00003800 Flags: E0000040 (DERW)
4: 3 RVA: 00020000 Offset: 00011C00 Size: 00000400 Flags: E0000040 (DERW)
5: 4 RVA: 00021000 Offset: 00012000 Size: 0000B200 Flags: E0000060 (CDERW)
6: 5 RVA: 00031000 Offset: 0001D200 Size: 00001200 Flags: E0000040 (DERW)
7: 6 RVA: 00033000 Offset: 0001E400 Size: 00004200 Flags: E0000060 (CDERW)

=< K
5aW
Ce\t
QQj;
Lr52
D00N7
AU1#Cz
NcR`
KxhxQ
q>rA
.i'tA nCp
U^f6*?
=,Zn%
)h1Y
vujh
#1gP
a;\(
r.fMgst
wRkoA
hx(Q
JWl*
&;=Q
Y3q%a
4 V;$
G@_=
t@xs
!=-`
1#_k W
}%Pl#
n=ZR#I
pL.y<a[7
q7I'
7qE]j4r
v<r'
HF){-
\a7V
!~^xQq
>!u:
Fqas
i#oy
EEoG
uWYE=
MAI`
8%%g
K2M^
i761
X]ei)h
QRewz
]8O8Uc
tf66
fwTyQ
csxy'
pL'X
o`cv
LF^R
'u{*
b{2k
SU<w
#_$M
pnPJ
obZH]
\C7H
$-.xi
[ `,
CL0/=
Cy /
Zdjl
]54.
ct%!89
"NDg
&Y bC5
UTd e
7;W(
AfG>1
@kt-
T(#Zt#T
+5dA
(oiX
Sw[n
YI!;
f4rA\
K&>b
dMb0
b p.2
/'q=
G1Qg
=*([
>kX&
iaG^P
fwx\
=w\8
cDJ|
g_g]
JDBACDX
Jt->
`ekP
etQw
;7Q8W~F
=OA
|5c@`
'b_|
>}jQG
w-.h$
+X+v
0Q7Po9iu9{
f oe2s
I[s1z
ss!R6
FpsT@
w\D+$)|
LWKY1
%jMQ
$aDY
tVu"l
UIEBg
|>m^/y
}IHSX
%Giq
-/7=
(V9L
\rYE&
m/P{R
K=(V
[SKQ
nvZBAI
Qf9u
Qx$^p
,TnOu
Ur=KCz
]t 5
JTSc
~*+w
`&Gi
:^eU
#=5L
CF+kf]
WN?k6
+R:<
i=K:
z(M",
{tS)
nPYE
NQ1Ny
(1SY
//L<
[ ^,
&_Mt
#2]tS
x)N,_
r-oN
CG[O
1cu~S
gvMA
V/~N
Q|Z>
RM,%
By1+z
Bc~y`
>:]v
1vI<
&]&M
+QdD
]rZ$
Ief}
9`}-0(MI
s9iA
\<}Y
pQAv
Tx_O
b1d/
d(A;
z~"@
1fzPV.
hxqN
Go2H`
%guk
-l} i~
&\tB
D 3cU
&T.?
J:'E-6
|s8c
8^o1
b`raT
it1R
J:gV
7i$D
f.n;
Jr``q0
[@w*P
(1r&
U4aP
zG,
|,U]'/K
uFfg/
eiN(
&:}F
V[iF7
`eskg
4_h!
cR1$
"D'd
:`!M$
wMK&B
SEz=
:7y^,B%
t!=o
PbF
P rg
1St\
t1o7
0Q5nv
Z:#f
<(Xa
{AX.
]OGK
1JO|
`$1-
(bv_
p}$M
b"oi7^`P>
S:K.#
W.}6
;KUJ
<|]BB
(X6S_X]
^Yhy
XTp1
Vr }
yTHR)
D1['
1A_7?
|IVm
cmsE
k]Bn
)UKWm
kEt0
Z4_F
/<`2
8i%=V
<V6q/
szlSo
/K~:=
J}6?
wM[@
C% \U
GY-#
&jUs
4U<;
EONxsPU
7Uq1
anXy!
jpw_
>G1wG`
>iz)x?^
BuWp}
]j7hc
1A/mB
PnBNy
~y/H
_I`p
h{`zX
|2]]^
+r4\
q:!2-S
$GC)
~_II(
qf:W
-^]4m
$RAsr
a3*'$
@Tqt ~
F\jY
4aRG
<@DYD~
dx3P
E{F{
#<N>
(f fh
Y%kq
K#Gs
'{1Z$P
Tj~)L[
]U@V]R
xcno
^g89
j%&uq
%RS?c
^xn9E_y
aH\N.
x<zp=
+e 1
g zJL
)tC06
=jIx}*
1y^u
7 V)
'oS1"}'
DG=k%
?,Gl7$
]SCo?
z"V!
jJ5^"
G|?tLy
&s^4
w"vv
)mw|
;{?5
BN{
kTq~k(
v3'J`+F
=Rrp
cLHS
>_kg
)Qk{"
lIs*Iw1
.ropa%
3L[`
df q
ryKn
aJ1&
e0C[
;JJWpT(w
]Ypx3
6+%5v&
6{-Z
Dkesi+
ofN>
)Tn{apT
{$vn
wTid
@9AU:
@AhX
I t|]&
K_kO
@!=s
=zMNDt4
%9TB
dG?]?
!}sr'
3p%]
L=P],9
`PW>
{+OT
#@7M
:D%C
IS>2
5t{]
P2s(
@09xJ
e#.P&a
o,;f(
ameh0
vMy;
VZ'5]
SxKp
}ssS
{;#e
rZtq
C1bU
OaJLWN
*|DI{
9Jw6
*C*J
#J,%
j!Y|
]x/~
+]Ih
9w(]
)^v!f
gs|*
)='w|}X
BfZ3-
?;v%\
4cF(?
*.[L
%;Rm
l>!
>Qc\
=F%6
@^pK
2D)u
}e*/
9N-k
s${r=
u=D^s
9o&#
a.$L
\ Zk
|9|g
fMZTv
n w>
I%b-
pDM4
1~dO
C<_?o
75nNe
uBVR
iYx+z_
){Ur
m-0E
Gjp)e
k%5V
+wil
*+hr
,Hn5
8"x
n@ J
'4{4
N~i>Z
Z+4h
qR#,B
mwW@d
)!gm
rTj3
#QFv
Rl5~
@.yN
sSXIz
n"p-
_Heb
^-r!
kO{w
f>4>
$xs+
A+p
[g >H
e1*:.
mor8
?}oE
R9^3
U]#U
D]2
{0_UY
f>Lgi7 N
"=a,
zT|_<
WfkZ%
l),L
)l[~!)/V
xyY|
;oy4
Dl7#
}|TU
B2%BKz;
d{Ub
(7_"
x'CF `
boSh
Ir*h
q**Hc1w
zr`P(
GLyU
kMv
?}i<
;Qg~D
'-Q8
a6:*
Ufs&
wbNX
+Qr9 @
aD4}
>T}]
Z|:l
Qi_xC
|+%H
u~ux
Pi$*
/: w
t_kd"]
N"%=
]Jl}qa
p sn
2I)-$
iJGG
.32$
]ShVL.!
9kJ
%qAeQv
fQuZ
j1vxt
XI.;
WU.$n
R)j
{nP';0
<cDy^
Y/I&K5
<RUK#
t;:Ba
M\ql
eV)y
+|Xg
ok<|
->v5
PW]FL
%12;
ttT,7N&
8&k"
\p{ugDBh
]Fb1
m/Y6
UJHF
}p%Ab
QAoq
W/buk
-:`&9
bGg)O
br2t
<y5h
dB:yr
!vM?
5owP
nBz8
JXA
Oa4s
KK?!@P
: B
"Z+V
N{0J
H=wwKP
mbsB
'[ud
~&9s
m@nE
ui_("o
8M4r
mTos
:2i}!
Q&8<
m]QW
,)m2
k*Ra
v&fR
y!w(
>{z0a
2X%
]p`Y
q8%fO
T`*^!
McGK/
jJx
?[rkh
b_1O
pmTj
m`Uh
'JGCh
T>PO
OG]8e
VGU^
b)ON
@-s!s
9,$#
`MRi
||Dgn
Rd}l
'|d9
J>wz
.[cKQ
%XsWG
e``,I
6aT'%w
JY+l2
}Cp%w
S&:_
gXQy
hD=5N
TSe+
0G/q)
j@%z7
/$4]
`D7
v0*S
Hmf`
VZ&t8
;8Kh
h]~1f
~xE$
<q #
Tt"b<b
3~|Y
P"[Nrw
[ZgY
Ec\SC
TgQ;
6L/7d
Ru:4
m,Ylk
[w,v
!NNV
ag%Us
[EJY
_{:Na
<=Ql
c5-se
5L<5v\E
mYvf
EdyH
0!& 3
;2nj)F
%!=nmY/
.mS-
C*IYx
A cq
"n=3
y4%7u
#W8E
o(=Pqo
IBx8
<v~CJ
"S1"
1KrJ
@{}H
V?l75
g>|7
xr]XF
knE(Rx
T7 C
~!A;/
IJ)C
GG*i
5eFw
wd+H7(
#}qX
>5bW
rx+O
W@7H
fxWw
)Dg*
,ubhv
BtX@V
Yj()
3~dj
?]^b
pN$/f
433;}
Dsjz<
lLHJ
WlUJ
9B3E
Mp_9
~BdJ
fLcdFN
w0-@
>c| Lt
g2dh
1GAh
Wlh.
SI@^IQ
-3dY+
1J[a\X}/?q
84)j
;7e[ $
U^$-
X"s(
]<4h
eB^Q
oB$7
=xqoC
hZX!0Q
X=ES
S1'2j
2Fmd
6?Ru@
eXQx
|xVj
6)k2
d+Lyc(
Gdx$[DIgQ
-!6T
WtTS~%
Nx{`
?r|IL
?ZHh
X5<1:
/Hjc
+XS=y-
rv&7
q"Ha
uVSW
{.5;
v}qo
F\eM
;W!=
Q4ak
E)#&
d&Nl
W "Ax
p~\#
W+n6D
BCWJk
xc{H>0^1
~st=
,$qzzdp.
Jas&
nlSj
`hDV
N0-M
H+*@
33PB
Yv2<`
35e<
pzT^A
@hy~
-S?oC
wfZ-
:^(^
BETw
,`iC
NWLO
`L[*
4_4l%
)tBD
4z29mq
L'2ew
|!u/5
+u
*'I+
Ff#|
k`yQ.
1dt~
z:u2
cP,j
`4)h
air\s
(1u1
wVDC
CT=
M9:+"%6
NNFG
rV%rw
=18h
TmQL%
}jkL
7Q\L
(v>;
()g.
$8t
:TqV
({zt
|Ees
WV&dI
,o`5
aH!b
&MwO
WCkK8
*.d;
/tE(e
EsDyX
].Rx
nTd\u
[&,l
!k2%
e;l9
'i<W
=)!6n
\^Y:E
k37[
cPS"CK
`@~1:
[Y=@
'kF+
qTLu5cX
r4-o
E(@.
9`p+m%
Zc M
zNfU
H,a9
%|+jz
$@7%
mUS)!
5BYi
M^$<
QYC<JiL
F_l<
A-&5-
A}#Z
x~t(@
DfzSLG/
z@fP
cM6M~
AX5z
|',Zv&Kc
FTu!
){Y<
Bor~
PC`.
r'8wCv4H
3'vc
B~Q%Y
uFdG
j)I9
>}&[5M
#;w_6
c-!Ueo
PB~7
n?a56
Ao%5
GY.B{
TXr/
7W 5^
-Y[-e~
6YDQ
D]cE
MU?p
uTHC
=5jp
| 0I
fMs
C>>j2
`UmRh
EeoB
{6uy
l"~B
N>GT
aD%@Y
j#uhAl
LR7u?X
ve~t
NA%9
Q_qYE|
?Kv-m
/qrJt
4Zq4
W}z<
8zh&
Hg1;
38?]
itgA
|oXH=r
Sj\v
4="E
+rQd
n "0a
'tF[
^deD
r0Or
K"wMM
{m]$
#!,U>A
I'tB{
e%=@=
zj5$
w@NJa
~kg~i
e.WBu
im3q
QqPk
Fp=l
-\St
ivts
'?j
j$aPf
_Sbpay
0U[(
Np h
xYgI
S o*&4
W^jQ|
:b8C
71G/
HE6:
`&YI
R1.8
[G;6zO
gh_q
5.(?
s85;;f
lK4=
R!kr
V<v]
}uoC