Static Analysis

PE Compile Time

2011-07-06 16:31:15

PE Imphash

d2717931f1bce566ad992551315e43ad

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000012ac 0x00001400 5.68714764257
.data 0x00003000 0x00000010 0x00000200 0.143458825305
.rdata 0x00004000 0x00000500 0x00000600 2.8744921683
.bss 0x00005000 0x00000060 0x00000000 0.0
.idata 0x00006000 0x000005e8 0x00000600 4.50082572714
.rsrc 0x00007000 0x00010b90 0x00010c00 5.62882531898

Resources

Name Offset Size Language Sub-language File type
JPEG 0x00007184 0x0000f600 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_ICON 0x00016784 0x000010a8 LANG_ENGLISH SUBLANG_ENGLISH_US Device independent bitmap graphic, 32 x 64 x 32, image size 0
RT_DIALOG 0x0001782c 0x0000009c LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_GROUP_ICON 0x000178c8 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US data
RT_VERSION 0x000178dc 0x000002b4 LANG_ENGLISH SUBLANG_ENGLISH_US data

Imports

Library KERNEL32.dll:
• 0x40614c AddAtomA
• 0x406150 CloseHandle
• 0x406154 CopyFileW
• 0x406158 CreateFileW
• 0x40615c ExitProcess
• 0x406160 FindAtomA
• 0x406164 FindResourceW
• 0x406168 GetAtomNameA
• 0x40616c GetCommandLineA
• 0x406170 GetDateFormatW
• 0x406174 GetModuleFileNameW
• 0x406178 GetModuleHandleA
• 0x40617c GetProcAddress
• 0x406180 GetShortPathNameW
• 0x406184 GetStartupInfoA
• 0x406188 GetTempPathW
• 0x40618c GetTimeFormatW
• 0x406190 LoadResource
• 0x406194 OutputDebugStringW
• 0x406198 SetFilePointer
• 0x4061a0 SizeofResource
• 0x4061a4 VirtualProtect
• 0x4061a8 VirtualQuery
• 0x4061ac WriteFile
Library msvcrt.dll:
• 0x4061b8 __getmainargs
• 0x4061bc __p__environ
• 0x4061c0 __p__fmode
• 0x4061c4 __set_app_type
• 0x4061c8 _assert
• 0x4061cc _cexit
• 0x4061d0 _iob
• 0x4061d4 _onexit
• 0x4061d8 _setmode
• 0x4061dc abort
• 0x4061e0 atexit
• 0x4061e4 free
• 0x4061e8 malloc
• 0x4061ec memcpy
• 0x4061f0 signal
• 0x4061f4 wcscat
• 0x4061f8 wcscmp
• 0x4061fc wcslen
• 0x406200 wcsncat
• 0x406204 wcsncpy
Library SHELL32.DLL:
• 0x406210 ShellExecuteW
Library USER32.dll:
• 0x40621c DialogBoxParamW
• 0x406220 EndDialog
• 0x406224 MessageBoxW
!This program cannot be run in DOS mode.
P`.data
.rdata
`@.bss
.idata
libgcj_s.dll
_Jv_RegisterClasses
../../runtime/pseudo-reloc.c
VirtualQuery (addr, &b, sizeof(b))
../../../../gcc-4.4.1/libgcc/../gcc/config/i386/cygming-shared-data.c
0 && "Couldn't retrieve name of GCClib shared data atom"
ret->size == sizeof(__cygming_shared) && "GCClib shared data size mismatch"
0 && "Couldn't add GCClib shared data atom"
-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32
AddAtomA
CloseHandle
CopyFileW
CreateFileW
ExitProcess
FindAtomA
FindResourceW
GetAtomNameA
GetCommandLineA
GetDateFormatW
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetShortPathNameW
GetStartupInfoA
GetTempPathW
GetTimeFormatW
LoadResource
OutputDebugStringW
SetFilePointer
SetUnhandledExceptionFilter
SizeofResource
VirtualProtect
VirtualQuery
WriteFile
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_onexit
_setmode
atexit
malloc
memcpy
signal
wcscat
wcscmp
wcslen
wcsncat
wcsncpy
ShellExecuteW
DialogBoxParamW
EndDialog
MessageBoxW
KERNEL32.dll
msvcrt.dll
SHELL32.DLL
USER32.dll
!This program cannot be run in DOS mode.
P`.data
.rdata
`@.bss
.idata
libgcj_s.dll
_Jv_RegisterClasses
../../runtime/pseudo-reloc.c
VirtualQuery (addr, &b, sizeof(b))
../../../../gcc-4.4.1/libgcc/../gcc/config/i386/cygming-shared-data.c
0 && "Couldn't retrieve name of GCClib shared data atom"
ret->size == sizeof(__cygming_shared) && "GCClib shared data size mismatch"
0 && "Couldn't add GCClib shared data atom"
-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AddAtomA
CloseHandle
CopyFileW
CreateFileW
DeleteFileW
ExitProcess
FindAtomA
FindResourceW
GetAtomNameA
GetDateFormatW
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetShortPathNameW
GetTempPathW
GetTimeFormatW
LoadResource
OutputDebugStringW
SetFileAttributesW
SetFilePointer
SetUnhandledExceptionFilter
SizeofResource
VirtualProtect
VirtualQuery
WriteFile
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_onexit
_setmode
atexit
malloc
memcpy
signal
wcscat
wcslen
wcsncat
wcsncpy
ShellExecuteW
ADVAPI32.DLL
KERNEL32.dll
msvcrt.dll
SHELL32.DLL
!This program cannot be run in DOS mode.
P`.data
.rdata
`@.bss
.edata
0@.idata
.reloc
}$;] t-
@DCUNG
libgcj_s.dll
_Jv_RegisterClasses
AcsHlpAttemptConnection
AcsHlpNbConnection
AcsHlpNoteNewConnection
WSAttemptAutodialAddr
WSAttemptAutodialName
WSNoteSuccessfulHostentLookup
istd::exception
std::bad_exception
__gnu_cxx::__concurrence_lock_error
__gnu_cxx::__concurrence_unlock_error
pure virtual method called
../../runtime/pseudo-reloc.c
VirtualQuery (addr, &b, sizeof(b))
../../../../gcc-4.4.1/libgcc/../gcc/config/i386/cygming-shared-data.c
0 && "Couldn't retrieve name of GCClib shared data atom"
ret->size == sizeof(__cygming_shared) && "GCClib shared data size mismatch"
0 && "Couldn't add GCClib shared data atom"
-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32
N10__cxxabiv115__forced_unwindE
N10__cxxabiv117__class_type_infoE
N10__cxxabiv119__foreign_exceptionE
N10__cxxabiv120__si_class_type_infoE
N9__gnu_cxx24__concurrence_lock_errorE
N9__gnu_cxx26__concurrence_unlock_errorE
St13bad_exception
St9exception
St9type_info
rasadhlp.dll
AcsHlpAttemptConnection
AcsHlpNbConnection
AcsHlpNoteNewConnection
WSAttemptAutodialAddr
WSAttemptAutodialName
WSNoteSuccessfulHostentLookup
CoInitialize
CoUninitialize
ObjectFromLresult
SysAllocString
SysFreeString
AddAtomA
CloseHandle
CreateSemaphoreA
CreateThread
DisableThreadLibraryCalls
FindAtomA
GetAtomNameA
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
ReleaseSemaphore
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
_write
__dllonexit
_assert
_errno
fflush
malloc
memcpy
strcmp
wcscmp
wcslen
wcsncat
DispatchMessageW
EnumChildWindows
FindWindowExW
FindWindowW
GetClassNameW
GetCursorPos
GetMessageW
KillTimer
RegisterWindowMessageW
SendMessageTimeoutW
SetTimer
TranslateMessage
WindowFromPoint
OLE32.dll
Oleacc.dll
OLEAUT32.DLL
KERNEL32.dll
msvcrt.dll
msvcrt.dll
USER32.dll
0=0E0i0s0
2!212P2t2
3*3I3e3l3y3
5;5E5X5
707A7w7
9<<C<P<F=a=i=q=
3(383H3X3h3t3
8;8c8}8
8;9T9`9
9-:4:A:U:]:y:
<#<9<@<M<b<k<
=(=G=O=W=
>(>.>9>[>c>k>
?k?p?{?
0:0B0J0
0G1M1X1r1
666;6D6R6Z6d6n6w6
8,8H8T8g8
>)?R?i?
6&6.666>6F6N6V6^6f6n6v6~6
7&7.767>7~7
@:D:H:L:P:T:X:\:`:d:h:l:p:
?$?(?,?0?4?8?<?@?D?H?d?h?l?p?|?
0*1(0&
Alimama.com Corporation Root CA0
101231160000Z
121231160000Z0*1(0&
Alimama.com Corporation Root CA0
,0*1(0&
Alimama.com Corporation Root CA
.E/!_aW&c*0
VeriSign, Inc.1+0)
"VeriSign Time Stamping Services CA0
070615000000Z
120614235959Z0\1
VeriSign, Inc.1402
+VeriSign Time Stamping Services Signer - G20
6^bMRQ4q
JcEG.k
http://ocsp.verisign.com0
"http://crl.verisign.com/tss-ca.crl0
TSA1-20
Western Cape1
Durbanville1
Thawte1
Thawte Certification10
Thawte Timestamping CA0
031204000000Z
131203235959Z0S1
VeriSign, Inc.1+0)
"VeriSign Time Stamping Services CA0
http://ocsp.verisign.com0
0http://crl.verisign.com/ThawteTimestampingCA.crl0
TSA2048-1-530
?7!Op1
0>0*1(0&
Alimama.com Corporation Root CA
l7/W
VeriSign, Inc.1+0)
"VeriSign Time Stamping Services CA
110706131615Z0#
UG<{-sUb
!This program cannot be run in DOS mode.
P`.data
.rdata
`@.bss
.idata
0*1(0&
Alimama.com Corporation Root CA0
101231160000Z
121231160000Z0*1(0&
Alimama.com Corporation Root CA0
,0*1(0&
Alimama.com Corporation Root CA
.E/!_aW&c*
libgcj_s.dll
_Jv_RegisterClasses
../../runtime/pseudo-reloc.c
VirtualQuery (addr, &b, sizeof(b))
../../../../gcc-4.4.1/libgcc/../gcc/config/i386/cygming-shared-data.c
0 && "Couldn't retrieve name of GCClib shared data atom"
ret->size == sizeof(__cygming_shared) && "GCClib shared data size mismatch"
0 && "Couldn't add GCClib shared data atom"
-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32
waveOutGetVolume
waveOutSetVolume
AddAtomA
CloseHandle
CreateFileW
DeleteFileW
ExitProcess
FindAtomA
GetAtomNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetShortPathNameW
GetTempPathW
OutputDebugStringW
SetUnhandledExceptionFilter
VirtualProtect
VirtualQuery
WriteFile
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_onexit
_setmode
atexit
malloc
memcpy
signal
wcscat
wcslen
wcsncat
ShellExecuteW
DispatchMessageW
FindWindowExW
FindWindowW
GetMessageW
GetWindowLongW
KillTimer
PostMessageW
SetTimer
TranslateMessage
keybd_event
WINMM.DLL
KERNEL32.dll
msvcrt.dll
SHELL32.DLL
USER32.dll
""r"'"r"!"
r""""""
""""""r"""""" p
r"""""r p
""""""ww"x
'""r"r'"'""r
"'""r"r
wwwwwwwwwwwwwp
222sIII
1112000f
0x77f585c0 referenced memory at 0x00000000. Memory could not be written.
cmd.exe
/c del /A
MAINEXE.exe
23:24:18 PM:10:25..MySelf...0123456789abcdef....
z1TBK_0706.exe
H?aUwtlwfr%KnqjxaNsyjwsjy%J}uqtwjwawfxfimqu3iqq
myyuaxmjqqatujsahtrrfsi
awfxfimqu3iqq
cmd.exe
/c del /A
AddCer.exe
0123456789ABCDEF...MainExe...0123456789abcdef....
_6wfxfimqu3oul
http://www.taobao.com/go/chn/tbk_channel/channelcode.php?pid=mm_12285662_0_0&eventid=101329
http://www.taobao.com/
IEFrame
Internet Explorer_Server
WM_HTML_GETOBJECT
interactive
complete
\rasadhlp.dll
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
Microsoft Corporation
FileDescription
Remote Access AutoDial Helper
FileVersion
6, 1, 7600, 16388
InternalName
rasadhlp.dll
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
rasadhlp.dll
ProductName
Microsoft Windows Operating System
ProductVersion
6.1.7600.16388
VarFileInfo
Translation
<<<Obsolete>>
cmd.exe
/c del /A
z1yuny4n.cer
rundll32.exe
0123456789ABCDEF...AddCer...0123456789abcdef....
cryptext.dll,CryptExtAddCER
#32770
Button
(&N) >
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
Tencent
FileDescription
QQRecycle
FileVersion
1, 61, 2103, 0
InternalName
QQRecycle
LegalCopyright
Copyright 2010 Tencent. All Rights Reserved
OriginalFilename
QQRecycle.exe
ProductName
QQ2011
ProductVersion
1.61.2103.0
VarFileInfo
Translation
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
Tencent
FileDescription
QQRecycle
FileVersion
1, 61, 2011, 0
InternalName
QQRecycle
LegalCopyright
Copyright 2010 Tencent. All Rights Reserved
OriginalFilename
QQRecycle.exe
ProductName
QQ2011
ProductVersion
1.61.2011.0
VarFileInfo
Translation
Tahoma
BUTTON
BUTTON
VS_VERSION_INFO
StringFileInfo
080404B0
CompanyName
FileDescription
FileVersion
1, 0, 0, 0
InternalName
LegalCopyright
CopyRigth 2011
LegalTrademarks
OriginalFilename
HPL_TRIAL.exe
ProductName
ProductVersion
1, 0, 0, 0
VarFileInfo
Translation
Antivirus Signature
Bkav Clean
Lionic Trojan.Win32.Dorifel.4!c
Elastic malicious (high confidence)
ClamAV Win.Trojan.Dorifel-174
CMC Clean
CAT-QuickHeal Clean
Skyhigh Clean
ALYac Gen:Variant.Babar.586509
Cylance Unsafe
Zillya Dropper.Dorifel.Win32.839
Sangfor Clean
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanDropper:Win32/Comispro.35e9e5e6
K7GW Clean
K7AntiVirus Clean
huorong Trojan/Agent.ho
Baidu Clean
VirIT Clean
Paloalto Clean
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.QQH
APEX Malicious
Avast Win32:Malware-gen
Cynet Malicious (score: 99)
Kaspersky UDS:Trojan.Win32.Agent.ilaf
BitDefender Gen:Variant.Babar.586509
NANO-Antivirus Trojan.Win32.Dorifel.rlbvp
ViRobot Clean
MicroWorld-eScan Gen:Variant.Babar.586509
Tencent Malware.Win32.Gencirc.11d3a6e0
Sophos Mal/Generic-S
F-Secure Trojan.TR/Comispro.J.1
DrWeb Trojan.MulDrop8.57425
VIPRE Gen:Variant.Babar.586509
TrendMicro Clean
McAfeeD ti!91AE3791DF3C
Trapmine Clean
CTX exe.trojan.dorifel
Emsisoft Gen:Variant.Babar.586509 (B)
Ikarus Backdoor.Win32.Rbot
FireEye Generic.mg.597086e812a9c46f
Jiangmin Trojan/JboxGeneric.mi
Webroot W32.Rogue.Gen
Varist Clean
Avira TR/Comispro.J.1
Fortinet W32/Dorifel.BSU!tr
Antiy-AVL Trojan[Dropper]/Win32.Dorifel
Kingsoft malware.kb.a.963
Gridinsoft Trojan.Win32.Agent.oa!s1
Xcitium Clean
Arcabit Trojan.Babar.D8F30D
SUPERAntiSpyware Clean
ZoneAlarm Clean
Microsoft Trojan:Win32/Phonzy.B!ml
Google Detected
AhnLab-V3 Clean
Acronis Clean
McAfee GenericRXWQ-WK!597086E812A9
TACHYON Clean
VBA32 TrojanDropper.Dorifel
Malwarebytes Generic.Malware/Suspicious
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Malware.Unwaders!8.FFE4 (TFE:5:n12OqTGrsu)
Yandex Trojan.GenAsa!KCoV07Tto4I
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.1728101.susgen
GData Gen:Variant.Babar.586509
AVG Win32:Malware-gen
DeepInstinct MALICIOUS
alibabacloud Trojan[dropper]:Win/Comispro.e4aec4ad
IRMA Signature
Trend Micro SProtect (Linux) Clean
Avast Core Security (Linux) Win32:Malware-gen
C4S ClamAV (Linux) Win.Trojan.Dorifel-174
Trellix (Linux) Clean
Sophos Anti-Virus (Linux) Mal/Generic-S
Bitdefender Antivirus (Linux) Gen:Variant.Babar.586509
G Data Antivirus (Windows) Virus: Gen:Variant.Babar.586509 (Engine A)
WithSecure (Linux) Trojan.TR/Comispro.J.1
ESET Security (Windows) a variant of Win32/TrojanDropper.Agent.QQH trojan
DrWeb Antivirus (Linux) Trojan.MulDrop8.57425
ClamAV (Linux) Win.Trojan.Dorifel-174
eScan Antivirus (Linux) Gen:Variant.Babar.586509(DB)
Kaspersky Standard (Windows) Trojan.Win32.Agent.ilaf
Emsisoft Commandline Scanner (Windows) Gen:Variant.Babar.586509 (B)
Cuckoo

We're processing your submission... This could take a few seconds.