Static Analysis

PE Compile Time

1992-06-20 01:22:17

PE Imphash

aae0990bf8ae1af65a22e31d4163da6c

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00017000 0x00017000 4.77434733881
UPX1 0x00018000 0x00008000 0x00008000 5.89769806717
.rsrc 0x00020000 0x00012000 0x00012000 0.434890969222

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00020154 0x000002e8 LANG_SPANISH SUBLANG_SPANISH_MODERN Device independent bitmap graphic, 32 x 64 x 4, image size 512
RT_RCDATA 0x00012448 0x000000a8 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_RCDATA 0x00012448 0x000000a8 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_GROUP_ICON 0x00020440 0x00000014 LANG_SPANISH SUBLANG_SPANISH_MODERN data

Imports

Library KERNEL32.DLL:
• 0x40e1c0 WriteFile
• 0x40e1c4 WaitForSingleObject
• 0x40e1c8 Sleep
• 0x40e1cc ReadFile
• 0x40e1d0 LoadLibraryA
• 0x40e1d8 GetVersionExA
• 0x40e1dc GetTempPathA
• 0x40e1e0 GetSystemDirectoryA
• 0x40e1e4 GetProcAddress
• 0x40e1e8 GetModuleHandleA
• 0x40e1ec GetModuleFileNameA
• 0x40e1f0 GetLastError
• 0x40e1f4 GetFileAttributesA
• 0x40e1fc FindNextFileA
• 0x40e200 FindFirstFileA
• 0x40e204 FindClose
• 0x40e210 ExitProcess
• 0x40e214 DeleteFileA
• 0x40e218 CreateThread
• 0x40e21c CreateMutexA
• 0x40e220 CreateFileA
• 0x40e224 CreateDirectoryA
• 0x40e228 CopyFileA
• 0x40e22c CloseHandle
Library KERNEL32.DLL:
• 0x40e1a8 TlsSetValue
• 0x40e1ac TlsGetValue
• 0x40e1b0 LocalAlloc
• 0x40e1b4 GetModuleHandleA
Library KERNEL32.DLL:
• 0x40e100 VirtualFree
• 0x40e104 VirtualAlloc
• 0x40e108 LocalFree
• 0x40e10c LocalAlloc
• 0x40e110 GetTickCount
• 0x40e118 GetVersion
• 0x40e11c GetCurrentThreadId
• 0x40e120 WideCharToMultiByte
• 0x40e124 MultiByteToWideChar
• 0x40e128 GetThreadLocale
• 0x40e12c GetStartupInfoA
• 0x40e130 GetModuleFileNameA
• 0x40e134 GetLocaleInfoA
• 0x40e138 GetLastError
• 0x40e13c GetCommandLineA
• 0x40e140 FreeLibrary
• 0x40e144 ExitProcess
• 0x40e148 CreateThread
• 0x40e14c WriteFile
• 0x40e154 SetFilePointer
• 0x40e158 SetEndOfFile
• 0x40e15c RtlUnwind
• 0x40e160 ReadFile
• 0x40e164 RaiseException
• 0x40e168 GetStdHandle
• 0x40e16c GetFileSize
• 0x40e170 GetFileType
• 0x40e174 CreateFileA
• 0x40e178 CloseHandle
Library advapi32.dll:
• 0x40e190 RegQueryValueExA
• 0x40e194 RegOpenKeyExA
• 0x40e198 RegCloseKey
Library mpr.dll:
• 0x40e238 WNetAddConnection2A
Library oleaut32.dll:
• 0x40e1a0 SysFreeString
Library shell32.dll:
• 0x40e270 ShellExecuteA
Library URLMON.DLL:
• 0x40e280 URLDownloadToFileA
Library user32.dll:
• 0x40e180 GetKeyboardType
• 0x40e184 MessageBoxA
• 0x40e188 CharNextA
Library wininet.dll:
Library wsock32.dll:
• 0x40e240 WSACleanup
• 0x40e244 WSAStartup
• 0x40e248 gethostbyname
• 0x40e24c socket
• 0x40e250 send
• 0x40e254 recv
• 0x40e258 inet_ntoa
• 0x40e25c inet_addr
• 0x40e260 htons
• 0x40e264 connect
• 0x40e268 closesocket
StringX
TObject
q{+]i3;
8S(@N?d
-=]3WS
;=Gu,)
StringX
TObject
YZ]_^[
YZ]_^[
_^[YY]
YZ]_^[
C<"u1S
Q<"u8S
Ht Ht.
~KxI[)
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
tVSVWU
_^[YY]
TBisBot
PRIVMSG
PRIVMSG
u*h4i@
u*h4i@
u8htm@
urh4i@
u5h4i@
u7h4i@
u*h4i@
PING :
PRIVMSG
PRIVMSG
:Logare corecta - Nivel:MASTER
dfisier
:Descarc Fisierul...
:Descarcare completa
:Fisier Executat
QUIT :Updating...
logout
silent
:Comanda Invalida
(Net:
(Sistem:
(Director Windows:
(Director Curent:
(netbios_infected:
(netbios_tries:
(netbios_failed:
(netbios_accessdenied:
(netbios_invalidpass:
(netbios_logonfailure:
(mydoom_infected:
(mydoom_tries:
(mydoom_failed:
(scan_infectedfiles:
(scan_infecteddirs:
(scan_copied:
File(%cur%\
File(%win%\
File(%sys%\
File(%tmp%\
File(\
restart
QUIT :Restartez la cerere ...
QUIT :Quiting
rndnick
:Uite ca am iesit
ascunde
%rnddir%
%sys%\
%win%\
%cur%\
%tmp%\
%rand%
:Ascuns ca (
:Imposibil sa ascund ca (
%rnddir%\%rand%.exe
:Ascund ca (
:Added Random Garbage To (
:Failed To Add Random Garbage To (
registry
system.ini
explorer.exe
:Adaugata copie in REGISTRY
spread
QQQQQS
.com "win2k" :
xtrworm
TFileName
TSearchRecX
QQQQQS3
win32dc
win32dc\
trainer
serial
BattleField 1942
Doom 3
Sims 2
FlatOut
Counter-Strike
Silent Hill 4
Half-Life 2
UT2004
Quake3
tDHtvH
DCPlusPlus.xml
<Description type="string">
<Description type="string">XTR</Description>
</Description>
<Share>
<Directory>
win32dc
</Directory>
dcplusplus.xml
upload
download
Ht!Ht,
QQQQQSV
abcdefghijklmnopqrstuvwxyz
Unknown
Dial-up
TMyDoom
PRIVMSG
:MyDoom Infectat
TNetBIOS
\Documents and Settings\All Users\Start Menu\Programs\Startup\
\WINDOWS\Start Menu\Programs\Startup\
\WINNT\Profiles\All Users\Start Menu\Programs\Startup\
Administrator
PRIVMSG
:netbios_infected
netapi32.dll
NetRemoteTOD
NetScheduleJobAdd
NetShareEnum
NetApiBufferFree
NetBIOSThread2
%rnddir%\%rand%.com
%rnddir%
%rand%
%sys%\
%win%\
%cur%\
%tmp%\
us.undernet.org
XTRMASTER
fuck21
356746
Runtime error at 00000000
0123456789ABCDEF
Biscan
3Messages
System
SysInit
KWindows
UTypes
?WinInet
*ShellAPI
WinSock
apFunc
!uMyDoom
uNetBIOS
apInfect
&pWebServer
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
HSRIII$
HSRIII$
HSRIII$
HSRIII$
HSRIII$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
SWj [h
SWj [h
SWj [h
SWj [h
SWj [h
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj [h
SWj [h
SWj [h
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
HXSO_O
HXSO_O
HXSO_O
HXSO_O
HXSO_O
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
HSRIIX
HSRIIX
HSRIIX
HSRIIX
HSRIIX
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
PPPPPPPP
PPPPPPPP
PPPPPPPP
PPPPPPPP
PPPPPPPP
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SRIII$
SRIII$
SRIII$
SRIII$
SRIII$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?I$
_SO_O?I$
_SO_O?I$
_SO_O?I$
_SO_O?I$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
j`h`GA
j`h`GA
j`h`GA
j`h`GA
j`h`GA
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
_SO_O?a
HXSO_O
HXSO_O
HXSO_O
HXSO_O
HXSO_O
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
HSRIISI
HSRIISI
HSRIISI
HSRIISI
HSRIISI
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj [h
SWj [h
SWj [h
SWj [h
SWj [h
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
_SO_OI$
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
HSRIISI
HSRIISI
HSRIISI
HSRIISI
HSRIISI
SWj [h
SWj [h
SWj [h
SWj [h
SWj [h
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
_SO_Oa
_SO_Oa
_SO_Oa
_SO_Oa
_SO_Oa
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
SWj [h
SWj [h
SWj [h
SWj [h
SWj [h
_SO_Oa
_SO_Oa
_SO_Oa
_SO_Oa
_SO_Oa
SWj _3
SWj _3
SWj _3
SWj _3
SWj _3
WritePrivateProfileStringA
WriteFile
WaitForSingleObject
ReadFile
LoadLibraryA
GetWindowsDirectoryA
GetVersionExA
GetTempPathA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetFileAttributesA
GetCurrentDirectoryA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitProcess
DeleteFileA
CreateThread
CreateMutexA
CreateFileA
CreateDirectoryA
CopyFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
WNetCancelConnectionA
WNetAddConnection2A
SysFreeString
ShellExecuteA
URLDownloadToFileA
GetKeyboardType
MessageBoxA
CharNextA
InternetGetConnectedState
WSACleanup
WSAStartup
gethostbyname
socket
inet_ntoa
inet_addr
connect
closesocket
.idata
.rdata
P.reloc
P.rsrc
P.text2
W}#"RdA
QCpw11
Library>Get0
bu`s!sPE
d.)p=c
E)Of7RtlJ
O<n[.6
5;cn/A
(NmxIav
I ghobynaC
XPTPSW
Gggfv@
&vvggd
wwgbvt
1wwwr"gf@
1wwwr"vv@
wr""gf@
wr""&f@
ww"w""@
wr'""@
advapi32.dll
KERNEL32.DLL
mpr.dll
oleaut32.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
wsock32.dll
RegCloseKey
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
WNetAddConnection2A
SysFreeString
ShellExecuteA
URLDownloadToFileA
CharNextA
InternetGetConnectedState
KERNEL32.DLL
KERNEL32.DLL
KERNEL32.DLL
advapi32.dll
mpr.dll
oleaut32.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
wsock32.dll
WritePrivateProfileStringA
WriteFile
WaitForSingleObject
ReadFile
LoadLibraryA
GetWindowsDirectoryA
GetVersionExA
GetTempPathA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetFileAttributesA
GetCurrentDirectoryA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitProcess
DeleteFileA
CreateThread
CreateMutexA
CreateFileA
CreateDirectoryA
CopyFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
WNetCancelConnectionA
WNetAddConnection2A
SysFreeString
ShellExecuteA
URLDownloadToFileA
GetKeyboardType
MessageBoxA
CharNextA
InternetGetConnectedState
WSACleanup
WSAStartup
gethostbyname
socket
inet_ntoa
inet_addr
connect
closesocket
;QcO&N
CO}hn$
12sHZ:c
liN;_k3|
bz[1R;
qHZ{0
3DRYb
{8trT2
FWXFSY
JcJQ`VH
Us ?{Z
8I\s{-
e-dtCy^
GPKPI
#;#p`K
QEvIj.,
;Ia?rN
Z\b4*H
9O>2Kn
`g&.TI$
??uim]
^l-$fB
Wde-2~
&tXq\b'/(
%c+}={
DJoau%9
$[ 2'7J
=;*i`
Do"C!6
aGr$n9
]$l5sH}o2
pnQ$cU
T4/\R W
+oq6|Pp
:c^Iel
Mc&J_
`++S-i
p5eoDyc
6,jf^n
0$.\L`
"@yb0
,\?$d~L]
Hvcq=/}V
y&XeSN
q;Lygq];
]RhE7.t
gvo g&T
!m(#;*
k?/ kxC
yF;jh>
W+M.DG
-Af3$j
P,T-1E1_S
x!mc%FN<!O
CzmK&y-
~(Vj<2
Ejia+>]
4d]TG
]N&^kNH
y@"|3h
6kcG!LFb
|aS1?W=H
xl@Xv|#hc
O]`:Mg
r}4%uJ
>wbx+$(
01$cVoo
ss tVQx
&4c!Y9
p9*@|1|^
&3f@Vo
stmzX'
+kvh&6\}
J8HQWF
a2aj}d
0tGs!`
V,?Bgg.
"G3/SA
di8)up
3Z<%;{^U!
_w0r`,
x~c.Ur
<a#q%
_G%k@1
=$t4[G
r$=t=~
CuHus+
vr!Oa~
r!ifOIE)
*Ud?C
TNnNR!
L c;EQ
i]W&-JR
?R)-m
3I#D/_
Vqn-'dQI
6sC$1
'~Eu 2+)
xzD_00b}
]Op7:5
(1]oqP
{%P^"X
\yxF{$
F4'YP3
|=/]0mB
r#3\xTg
tb{Uls
IdXV5W
^I1M%]
f$^!^I
,Sbo(
3~7UUk7
?;WU_[
\S%hg;
hlZPz-
(w;pUP
A +JzC
O./~B*Lu
W(MF@Q
I+DEPN
D:E.$z
#1`I+;
S,*L"
DbGehS(
<UnMeK
e41.$,2
jNBN?D
$uSWQe
1P" /6nR
Nj0A=)Y
zc%]JYi
~US/MGP
P[2cZc
-?a{&t
OL'fgaP{
F2ZCx*
W{3WN2&
8H7nj$
{=}3{[$
];)eL"
v2P%
_!0Z&~m
?Z2y&+
+FZ$FM
'3#ZAJS
]suMtu
E(fFS%
NyVS p
.EK"R}s
mhh[+d
pK1esR
g]VQ\WZ3
SQ)#4G
A-)B"(rx
.QkFs4w
u]wc&K
:Q`>!Q+
MN9x'-$
`ygRWv2
y`s~~!
s= H"E
)H#<,
?tWq3H
yo'6!P
*ht=/6
|_gs5E
~'VYS>
r.I;T`9
2z0))h~
V"}.uS
a JcV}
@<Q{3Y
;IgbD7
p3pVtU
Bu0.qywB
w?kikP
x@6J%hp?
JSO%Mb
.$xjL4
~,ac^z
KlnM.R
OeAh$x
^bmL7{
kU7T_D
lg~,wl
YGRKF
ZDA^DL
Rpk'Hd4
-_s$g
"0A>1M)
ER qQy
Yhyc !FZ
#QS!QZ
$dek<`C
X?U6 "
-iVhl|
WII@7v}g
kh`<sY,
<,[sc$
-)Q[6W
U2CqN,^
`P`T=m
LgY^?N
1zGz!}
ktIV@L
PS~Lp\o
0l$.>;
DVCLAL
PACKAGEINFO
MAINICON
DVCLAL
PACKAGEINFO
MAINICON
No antivirus signatures available.
IRMA Signature
Trend Micro SProtect (Linux) Clean
Avast Core Security (Linux) Win32:MalwareX-gen [Bot]
C4S ClamAV (Linux) Win.Malware.Delf-6717516-0
Trellix (Linux) Exploit-Mydoom virus
Sophos Anti-Virus (Linux) Clean
Bitdefender Antivirus (Linux) Trojan.GenericKD.77058550
G Data Antivirus (Windows) Virus: Trojan.GenericKD.77058550 (Engine A), Win32.Worm.MyDoom.B (Engine B)
WithSecure (Linux) Worm.WORM/Rbot.Gen
ESET Security (Windows) a variant of Win32/IRCBot.AZV trojan
DrWeb Antivirus (Linux) Win32.HLLW.Siggen.10562
ClamAV (Linux) Win.Malware.Delf-6717516-0
eScan Antivirus (Linux) Trojan.GenericKD.77058550(DB)
Kaspersky Standard (Windows) Backdoor.Win32.Delf.ars
Emsisoft Commandline Scanner (Windows) Trojan.GenericKD.77058550 (B)
Cuckoo

We're processing your submission... This could take a few seconds.