Binary Code Analysis - File Md5: 6a64a5c7f36f04ddb904ea3031dafa82
File hash value: 6a64a5c7f36f04ddb904ea3031dafa82. This is a 32-bit EXE file, and the file size is 74 K. This page is mainly to analyze the binary code of the file, that is, PE file format. To understand the content here, you need to have a certain computer expertise. The content of this page is mainly provided to people who are engaged in the maintenance of computer security in the industry, in the hope of contributing to the cause of computer security.
If you are a regular computer user, and do not understand the content, you can click on the following file name, to view the solutions for various problems caused by the file.
You can also download the repair tool directly to fix your operating system.
Called external files and functions:
In general, malicious files will call these types of functions: functions to intercept data, network functions, functions to modify the registry information, access to the browser personal privacy Cookie, and directly bypass the system to read hard disk data (Hint: The files below may be called by malicious files, but these files themselves are not necessarily malicious files. They may be some normal system files)
This is my analysis results of this malicious file. If you have any questions, or have any problems that cannot be resolved, you can leave a message or email me.
• You can also use the following online detection function to check the file.
T21 can detect unknown files online, mainly using "behavior-based" judgment mechanism. It is very simple to use T21.
1. Click the "Upload File" button, select the file you want to detect, and then click "Submit".
2. The next step is to wait for the system to check, which may take a little time, so please be patient.
3. When the T21 scan engine finishes detection, the test results are immediately fed back, as shown below:
Other captured malicious files:
invalidatefntcache.exe - File Md5: 1dee675661c7024c6bc20f692170c188
oxpsconverter.exe - File Md5: c68b8f6eb9480d98db6020025f57b40d
oxpsconverter.exe - File Md5: 7c6b2db3a3b959d126bff82439d7c94a
taskhost.exe - File Md5: 9a8fedcd8c457f9a9544815f4d846846
pcalua.exe - File Md5: c417124d16a7d68a914dd042d5ce5e34
pcawrk.exe - File Md5: c27f3c27b4acc43467ee3d764d63fc79
- File Md5: fe9275c72bbda789e2dc9ea3bb8921a3
- File Md5: 7ccc530302b07e150782c6922eda5a24
- File Md5: b48fe7c35dbdb88a1481bd02fb9c6113
If you are a regular computer user, and do not understand the content, you can click on the following file name, to view the solutions for various problems caused by the file.
You can also download the repair tool directly to fix your operating system.
DOS Stub
...
...
.text SECTION #1
.data SECTION #2
.rsrc SECTION #3
.reloc SECTION #4
fjrafdp SECTION #5
DOS Header
Type Name Value Memo
WORD e_magic 0x00005A4D DOS Sign WORD e_cblp 0x00000090 Bytes on last page of file WORD e_cp 0x00000003 Pages in file WORD e_crlc 0x00000000 Relocations WORD e_cparhdr 0x00000004 Size of header in paragraphs WORD e_minalloc 0x00000000 Minimum extra paragraphs needed WORD e_maxalloc 0x0000FFFF Maximum extra paragraphs needed WORD e_ss 0x00000000 Initial (relative) SS value WORD e_sp 0x000000B8 Initial SP value WORD e_csum 0x00000000 Checksum WORD e_ip 0x00000000 Initial IP value WORD e_cs 0x00000000 Initial (relative) CS value WORD e_lfarlc 0x00000040 File address of relocation table WORD e_ovno 0x00000000 Overlay number WORD e_res[4] [0]=0x00000000
[1]=0x00000000
[2]=0x00000000
[3]=0x00000000 Reserved words WORD e_oemid 0x00000000 OEM identifier (for e_oeminfo) WORD e_oeminfo 0x00000000 OEM information; e_oemid specific WORD e_res2[10] [1]=0x00000000
[2]=0x00000000
[3]=0x00000000
[4]=0x00000000
[5]=0x00000000
[6]=0x00000000
[7]=0x00000000
[8]=0x00000000
[9]=0x00000000
[10]=0x00000000 Reserved words WORD e_lfanew 0x000000E8 PE File Header address
[1]=0x00000000
[2]=0x00000000
[3]=0x00000000
[2]=0x00000000
[3]=0x00000000
[4]=0x00000000
[5]=0x00000000
[6]=0x00000000
[7]=0x00000000
[8]=0x00000000
[9]=0x00000000
[10]=0x00000000
NT HEADER - NT File Signature
Type Name Value Memo
DWORD Signature 0x00004550 PE File Sign: "PE"
NT HEADER - FILE HEADER
Type Name Value Memo
WORD Machine 0x0000014C File Bit (32Bit Or 64 Bit) WORD NumberOfSections 0x00000005 Number Of Sections DWORD TimeDateStamp 0x4C3C6A69 File Create Time DWORD PointerToSymbolTable 0x00000000 Pointer To Symbol Table DWORD NumberOfSymbols 0x00000000 Number Of Symbols WORD SizeOfOptionalHeader 0x000000E0 Size Of Optional Header WORD Characteristics 0x00000102 File Type: (EXE or DLL)
NT HEADER - OPTIONAL HEADER
Type Name Value Memo
WORD Magic 0x0000010B Magic BYTE MajorLinkerVersion 0x00000009 Major Linker Version BYTE MinorLinkerVersion 0x00000000 Minor Linker Version DWORD SizeOfCode 0x0000A400 Size Of Code DWORD SizeOfInitializedData 0x00001C00 Size Of Initialized Data DWORD SizeOfUninitializedData 0x00000000 Size Of Uninitialized Data DWORD AddressOfEntryPoint 0x00003254 Address Of Entry Point DWORD BaseOfCode 0x00001000 Base Of Code DWORD BaseOfData 0x0000C000 Base Of Data DWORD ImageBase 0x01000000 Image Base DWORD SectionAlignment 0x00001000 Section Alignment DWORD FileAlignment 0x00000200 File Alignment WORD MajorOperatingSystemVersion 0x00000006 Major Operating System Version WORD MinorOperatingSystemVersion 0x00000001 Minor Operating System Version WORD MajorImageVersion 0x00000006 Major Image Version WORD MinorImageVersion 0x00000001 Minor Image Version WORD MajorSubsystemVersion 0x00000006 Major Sub system Version WORD MinorSubsystemVersion 0x00000001 Minor Sub system Version DWORD Win32VersionValue 0x00000000 Win32 Version Value DWORD SizeOfImage 0x00017000 Size Of Image DWORD SizeOfHeaders 0x00000400 Size Of Headers DWORD CheckSum 0x00000000 Check Sum WORD Subsystem 0x00000002 Sub system WORD DllCharacteristics 0x00008000 Dll Char acteristics DWORD SizeOfStackReserve 0x00040000 Size Of Stack Reserve DWORD SizeOfStackCommit 0x00004000 Size Of Stack Commit DWORD SizeOfHeapReserve 0x00100000 Size Of Heap Reserve DWORD SizeOfHeapCommit 0x00001000 Size Of Heap Commit DWORD LoaderFlags 0x00000000 Loader Flags DWORD NumberOfRvaAndSizes 0x00000010 Number Of Rva And Sizes
NT HEADER - OPTIONAL HEADER - Data Directory
Type Name Value Memo
DWORD DataDirectory[1].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[1].Size 0x00000000 Data Directory Size DWORD DataDirectory[2].VirtualAddress 0x0000A38C Data Directory Virtual Address DWORD DataDirectory[2].Size 0x000000DC Data Directory Size DWORD DataDirectory[3].VirtualAddress 0x0000D000 Data Directory Virtual Address DWORD DataDirectory[3].Size 0x00000530 Data Directory Size DWORD DataDirectory[4].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[4].Size 0x00000000 Data Directory Size DWORD DataDirectory[5].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[5].Size 0x00000000 Data Directory Size DWORD DataDirectory[6].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[6].Size 0x00000000 Data Directory Size DWORD DataDirectory[7].VirtualAddress 0x000012B0 Data Directory Virtual Address DWORD DataDirectory[7].Size 0x0000001C Data Directory Size DWORD DataDirectory[8].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[8].Size 0x00000000 Data Directory Size DWORD DataDirectory[9].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[9].Size 0x00000000 Data Directory Size DWORD DataDirectory[10].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[10].Size 0x00000000 Data Directory Size DWORD DataDirectory[11].VirtualAddress 0x00002E50 Data Directory Virtual Address DWORD DataDirectory[11].Size 0x00000040 Data Directory Size DWORD DataDirectory[12].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[12].Size 0x00000000 Data Directory Size DWORD DataDirectory[13].VirtualAddress 0x00001000 Data Directory Virtual Address DWORD DataDirectory[13].Size 0x0000027C Data Directory Size DWORD DataDirectory[14].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[14].Size 0x00000000 Data Directory Size DWORD DataDirectory[15].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[15].Size 0x00000000 Data Directory Size DWORD DataDirectory[16].VirtualAddress 0x00000000 Data Directory Virtual Address DWORD DataDirectory[16].Size 0x00000000 Data Directory Size
SECTION #1Type Name Value Memo BYTE Name .text Section Name DWORD VirtualSize 0x0000A2D6 Section Virtual Size DWORD VirtualAddress 0x00001000 Section Virtual Address DWORD SizeOfRawData 0x0000A400 Section Size Of Raw Data DWORD PointerToRawData 0x00000400 Section Pointer To Raw Data DWORD PointerToRelocations 0x00000000 Section Pointer To Relocations DWORD PointerToLinenumbers 0x00000000 Section Pointer To Linenumbers WORD NumberOfRelocations 0x00000000 Section Number Of Relocations WORD NumberOfLinenumbers 0x00000000 Section Number Of Linenumbers DWORD Characteristics 0xE0000020 Section Characteristics
SECTION #2Type Name Value Memo BYTE Name .data Section Name DWORD VirtualSize 0x000005C4 Section Virtual Size DWORD VirtualAddress 0x0000C000 Section Virtual Address DWORD SizeOfRawData 0x00000200 Section Size Of Raw Data DWORD PointerToRawData 0x0000A800 Section Pointer To Raw Data DWORD PointerToRelocations 0x00000000 Section Pointer To Relocations DWORD PointerToLinenumbers 0x00000000 Section Pointer To Linenumbers WORD NumberOfRelocations 0x00000000 Section Number Of Relocations WORD NumberOfLinenumbers 0x00000000 Section Number Of Linenumbers DWORD Characteristics 0xC0000040 Section Characteristics
SECTION #3Type Name Value Memo BYTE Name .rsrc Section Name DWORD VirtualSize 0x00000530 Section Virtual Size DWORD VirtualAddress 0x0000D000 Section Virtual Address DWORD SizeOfRawData 0x00000600 Section Size Of Raw Data DWORD PointerToRawData 0x0000AA00 Section Pointer To Raw Data DWORD PointerToRelocations 0x00000000 Section Pointer To Relocations DWORD PointerToLinenumbers 0x00000000 Section Pointer To Linenumbers WORD NumberOfRelocations 0x00000000 Section Number Of Relocations WORD NumberOfLinenumbers 0x00000000 Section Number Of Linenumbers DWORD Characteristics 0x40000040 Section Characteristics
SECTION #4Type Name Value Memo BYTE Name .reloc Section Name DWORD VirtualSize 0x00008000 Section Virtual Size DWORD VirtualAddress 0x0000E000 Section Virtual Address DWORD SizeOfRawData 0x00007A00 Section Size Of Raw Data DWORD PointerToRawData 0x0000B000 Section Pointer To Raw Data DWORD PointerToRelocations 0x00000000 Section Pointer To Relocations DWORD PointerToLinenumbers 0x00000000 Section Pointer To Linenumbers WORD NumberOfRelocations 0x00000000 Section Number Of Relocations WORD NumberOfLinenumbers 0x00000000 Section Number Of Linenumbers DWORD Characteristics 0xE0000060 Section Characteristics
SECTION #5Type Name Value Memo BYTE Name fjrafdp Section Name DWORD VirtualSize 0x00001000 Section Virtual Size DWORD VirtualAddress 0x00016000 Section Virtual Address DWORD SizeOfRawData 0x00000000 Section Size Of Raw Data DWORD PointerToRawData 0x00012A00 Section Pointer To Raw Data DWORD PointerToRelocations 0x00000000 Section Pointer To Relocations DWORD PointerToLinenumbers 0x00000000 Section Pointer To Linenumbers WORD NumberOfRelocations 0x00000000 Section Number Of Relocations WORD NumberOfLinenumbers 0x00000000 Section Number Of Linenumbers DWORD Characteristics 0xC0000000 Section Characteristics
Called external files and functions:
In general, malicious files will call these types of functions: functions to intercept data, network functions, functions to modify the registry information, access to the browser personal privacy Cookie, and directly bypass the system to read hard disk data (Hint: The files below may be called by malicious files, but these files themselves are not necessarily malicious files. They may be some normal system files)
Import File - msvcrt.dll_purecall free malloc calloc ??0exception@@QAE@XZ _callnewh ??1type_info@@UAE@XZ _cexit _exit _XcptFilter exit _wcmdln _initterm _amsg_exit __setusermatherr __p__commode __p__fmode _CxxThrowException ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ?what@exception@@UBEPBDXZ ??0exception@@QAE@ABQBD@Z memmove_s memcpy_s __CxxFrameHandler3 memset __set_app_type ?terminate@@YAXXZ _except_handler4_common _controlfp _unlock __dllonexit _lock _onexit __wgetmainargs
Import File - ole32.dllCoEnableCallCancellation CoCancelCall CoDisableCallCancellation CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize
Import File - OLEAUT32.dllFunction Address
0x00000006 Function Address
0x00000002
0x00000006
0x00000002
Import File - KERNEL32.dllInterlockedExchange Sleep InterlockedCompareExchange GetStartupInfoW SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetLastError WaitForSingleObject ResetEvent CloseHandle CreateEventW HeapFree HeapDestroy HeapCreate HeapReAlloc SetLastError HeapAlloc InitOnceExecuteOnce SetProcessShutdownParameters InterlockedIncrement DeleteAtom IsDebuggerPresent AcquireSRWLockExclusive ReleaseSRWLockExclusive SetEvent InterlockedDecrement GetModuleHandleW CreateThread GetTickCount64 InitializeSRWLock SetThreadPriority GetThreadPriority GetCurrentThread GetExitCodeThread DeleteTimerQueueTimer CreateTimerQueueTimer HeapSize GetProcessHeap LocalFree OutputDebugStringA
Import File - API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegGetValueW
Import File - API-MS-Win-Core-ProcessThreads-L1-1-0.dllOpenProcessToken
Import File - API-MS-Win-Security-Base-L1-1-0.dllGetSecurityDescriptorSacl MakeAbsoluteSD GetSecurityDescriptorControl AddAce InitializeSid CopySid InitializeAcl GetTokenInformation AllocateAndInitializeSid FreeSid GetSidLengthRequired GetSecurityDescriptorGroup GetLengthSid GetSecurityDescriptorDacl GetSidSubAuthority SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner GetAclInformation IsValidSid InitializeSecurityDescriptor GetSecurityDescriptorOwner
Import File - USER32.dllPostQuitMessage DefWindowProcW MsgWaitForMultipleObjects ShowWindow CreateWindowExW RegisterClassW TranslateMessage PostMessageW GetWindowThreadProcessId IsWindow EnumThreadWindows EnumWindows DispatchMessageW ShutdownBlockReasonDestroy LoadStringW ShutdownBlockReasonCreate DestroyWindow PeekMessageW UnregisterClassW UpdateWindow
Import File - ntdll.dllRtlUnhandledExceptionFilter EtwTraceMessage DbgPrintEx
Import File - RPCRT4.dllRpcAsyncInitializeHandle RpcBindingFree RpcBindingSetAuthInfoExW RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW NdrClientCall2 NdrAsyncClientCall RpcAsyncCompleteCall RpcAsyncCancelCall
This is my analysis results of this malicious file. If you have any questions, or have any problems that cannot be resolved, you can leave a message or email me.
• You can also use the following online detection function to check the file.
T21 can detect unknown files online, mainly using "behavior-based" judgment mechanism. It is very simple to use T21.
1. Click the "Upload File" button, select the file you want to detect, and then click "Submit".
2. The next step is to wait for the system to check, which may take a little time, so please be patient.
3. When the T21 scan engine finishes detection, the test results are immediately fed back, as shown below:
Other captured malicious files:
invalidatefntcache.exe - File Md5: 1dee675661c7024c6bc20f692170c188
oxpsconverter.exe - File Md5: c68b8f6eb9480d98db6020025f57b40d
oxpsconverter.exe - File Md5: 7c6b2db3a3b959d126bff82439d7c94a
taskhost.exe - File Md5: 9a8fedcd8c457f9a9544815f4d846846
pcalua.exe - File Md5: c417124d16a7d68a914dd042d5ce5e34
pcawrk.exe - File Md5: c27f3c27b4acc43467ee3d764d63fc79
- File Md5: fe9275c72bbda789e2dc9ea3bb8921a3
- File Md5: 7ccc530302b07e150782c6922eda5a24
- File Md5: b48fe7c35dbdb88a1481bd02fb9c6113
Copyright statement: The above data is obtained by my analysis, and without authorization, you may not copy or reprint it.
Leave a Reply
Your email address will not be published. Required fields are marked *
Your email address will not be published. Required fields are marked *
If you need help, please leave a message, try to match the picture, and I will reply as soon as possible to each question.
User Reply & Help
»[May 02, 2019]
Ahmed Ali Shah say: Cool. Android Fastboot Reset Tool is one of the best way to unlock android devices. I think it is th ......
Reply: Thank you for your attention. According to the monitoring, this executable file should be infected b …View >>>
Ahmed Ali Shah say: Cool. Android Fastboot Reset Tool is one of the best way to unlock android devices. I think it is th ......Reply: Thank you for your attention. According to the monitoring, this executable file should be infected b …View >>>
»[April 27, 2019]Sergei Zolotarev say: I am playing CDs on my computer or listening to MP3 music on my hard disk. But when I run Photoshop ......
Reply: This kind of fault may be caused by the computer configuration being too low. For example, the CPU f …View >>>
Sergei Zolotarev say: I am playing CDs on my computer or listening to MP3 music on my hard disk. But when I run Photoshop ......Reply: This kind of fault may be caused by the computer configuration being too low. For example, the CPU f …View >>>
»[April 09, 2019]Guest say: The CPU is a newly purchased boxed Celeron D 2.8GHz. The motherboard is a Mercedes 865PE. The temper ......
Reply: This happens because the objects detected by the two are different. AID32 and HWiNFO detect the temp …View >>>
Guest say: The CPU is a newly purchased boxed Celeron D 2.8GHz. The motherboard is a Mercedes 865PE. The temper ......Reply: This happens because the objects detected by the two are different. AID32 and HWiNFO detect the temp …View >>>
»[April 05, 2019]amlan say: When I played a song on my computer, I sometimes plugged in the earphones and found that the sound o ......
Reply: This situation can be caused by the following reasons:The impedance of the headset. Normally used he …View >>>
amlan say: When I played a song on my computer, I sometimes plugged in the earphones and found that the sound o ......Reply: This situation can be caused by the following reasons:The impedance of the headset. Normally used he …View >>>
»[March 26, 2019]Alok say: When the scanner is turned on, the "SCSI card not found" error message appears. What happened?
Reply: This is because the fuse is set on the SCSI card. When a bad circuit condition (voltage instability …View >>>
Alok say: When the scanner is turned on, the "SCSI card not found" error message appears. What happened?Reply: This is because the fuse is set on the SCSI card. When a bad circuit condition (voltage instability …View >>>
»[March 06, 2019]utkrasht say: My computer uses the Geforce2 MX400 graphics card, but it is not very smooth when playing some 3D ga ......
Reply: From the enumerated phenomenon, there may be problems with high-end video memory. In general applica …View >>>
utkrasht say: My computer uses the Geforce2 MX400 graphics card, but it is not very smooth when playing some 3D ga ......Reply: From the enumerated phenomenon, there may be problems with high-end video memory. In general applica …View >>>
Copyright © 2016-2020 mygoodtools.com All rights reserved.