PE Compile Time

2012-07-19 22:00:28

PE Imphash

bd227ba966c127e93fe82f25f211eaca

PEiD Signatures

eXPressor v1.3 -> CGSoftLabs

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.data 0x00001000 0x00011000 0x00004dcf 7.99244881899
.ex_cod 0x00012000 0x000017e4 0x000017d0 6.17150424839
.ex_rsc 0x00014000 0x000029f4 0x000029f4 4.89795355677
.nwroh 0x00017000 0x00000100 0x00000200 3.77949376543

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000140f0 0x000025a8 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED Device independent bitmap graphic, 48 x 96 x 32, image size 9216
RT_GROUP_ICON 0x00016698 0x00000014 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_VERSION 0x000166ac 0x00000348 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data

Imports

Library KERNEL32.dll:
0x131624ac VirtualFree
0x131624b0 VirtualAlloc
0x131624b4 GetProcAddress
0x131624b8 ExitProcess
0x131624bc LoadLibraryExA
0x131624c0 GetModuleHandleA
0x131624c4 VirtualProtect
0x131624c8 GetModuleFileNameA
0x131624cc HeapAlloc
0x131624d0 GetProcessHeap
0x131624d4 HeapFree
Library USER32.dll:
0x131624dc wsprintfA
0x131624e0 MessageBoxA

!269741002697410026974100
.ex_cod
.ex_rsc
@.nwroh
-I\tI"z`,
wnK~Vk
'voxB\
C~xV='
$p:CF,
vk4"4^?
&|AdZq;
g+QN`U;Q
G#D>RE
Y'K9Td
'(Elt
$w6Y
0j[K>DZ
.v@l?XH
dNrGWg
UAK~%
g/b9].T
k(8d%JyR
3:3&d [
+F8pK^3
DqejtF
?=9A@m7
^1A!59
qeB)VH
KaaC\+
}']N:`:g
2QZLMB
|0'V1S\
B@XtV#
+0ll3m
gTY2,~
A@EqvuzA
r,x#kz
7rLF-Tu
k^8UZyI
!EHf!!
!#;PcE(
OM,4$A
$W7SoXv
h51Leq3
|>Z|3B
1gy&&
C-T/U%
R6~y0*
This program was packed with a demo version of eXPressor
A required .DLL file, %hs, was not found.
Error Starting Program
The %hs file is
linked to missing export %hs:0x%04x.
The %hs file is
linked to missing export %hs:%hs.
Error Starting Program
*pdw = 0x%08x
Error bad relocation pointer:
*pw = 0x%04x *pdw = 0x%08x
Unexpected relocation type:
VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
ExPr-v.1.3..
D2)X>
jj@$JQ5H@I3hR[<vIR4vCH(gdi(3tt
)Ytfpe
HrCg@b
www.360.cn
TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO
MMMMMMMMMMMMMMMMMMMMMMMMMMM~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
LLLLLLLLLLLLLLLLLLLLLLL}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ttttttttttttttttttttttttttt
?????????????????????????????????????????????????????????????????????????????????????ssssssss
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
??????????????????????????????????????????????pppppppppppppppppppppppppppppppppppppppppppppppppppppp
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
======================qqqqqqqqqqqqqqqqqqqqqqqqqq
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ppppppppppppppppppppppppppppppppppppppppppppp
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
9999999999999999999999999999999999999999999999999mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
888888888888888888888888888888888888888888888888888llllllllllllllllllllllllllllllllllllllllllll
::::::::::::::::::::::::::::::::::::::::::::::kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk
8888888888888888888888888888888888888888888888888888888888888888888888iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
777777777777777777777777777777777777777777777777777777777777777777777hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
66666666666666666666666666666666666666666666666666jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
444444444444444444444444444444444444444444444444444444444444444444444444444444444
333333333333333333333333333333333333333333333333333333gggggggggggggggggggggggggggggggggggggggggggggggg
2222222222222222222222222222222222222222fffffffffffffffffffffffffffffffffffffffffffffffffffffff
1111111111111111111111111111111111111111111111111111111111111111111111111111eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
3333333333333333333333333333333333333333333333333333333333ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
11111111111111111111111111111111111111111111111111111111111111111bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
///////////////////////////////////////////////////////ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
---------------------------------------------------------bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,`````````````````````````````````````````````````````````````````````````````
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++________________________________________
****************************************************************************************^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
*********************************************[[[[[[[[[[[[[[[[[[[[[[
)))))))))))))))))))))))))))))))))))))))))))))ZZZZZZZZZZZZZZZZZZZZZZZZZZ
(((((((((((((((((((((((((((((((((((((((((((((((((((((((\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
#############################################WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
VS_VERSION_INFO
StringFileInfo
080404b0
Comments
1.5901.1.195
CompanyName
FileDescription
FileVersion
1, 5901, 1, 195
InternalName
soul.exe
LegalCopyright
(C) 2002
LegalTrademarks
OriginalFilename
PrivateBuild
ProductName
ProductVersion
1, 0, 0, 1
SpecialBuild
VarFileInfo
Translation
No antivirus signatures available.
IRMA Signature
Trend Micro SProtect (Linux) Clean
Avast Core Security (Linux) Win32:MalwareX-gen [Trj]
C4S ClamAV (Linux) Win.Dropper.Gh0stRAT-7645027-0
Trellix (Linux) Generic Malware.dq trojan
Sophos Anti-Virus (Linux) Troj/Farfli-DL
Bitdefender Antivirus (Linux) Gen:Variant.Barys.494697
G Data Antivirus (Windows) Virus: Gen:Variant.Barys.494697 (Engine A)
WithSecure (Linux) Trojan.TR/Crypt.XPACK.Gen
ESET Security (Windows) Win32/Farfli.AAG trojan
DrWeb Antivirus (Linux) Trojan.DownLoad3.17387
ClamAV (Linux) Win.Dropper.Gh0stRAT-7645027-0
eScan Antivirus (Linux) Gen:Variant.Barys.494697(DB)
Kaspersky Standard (Windows) HEUR:Trojan-Dropper.Win32.Injector.gen
Emsisoft Commandline Scanner (Windows) Gen:Variant.Barys.494697 (B)
Cuckoo

We're processing your submission... This could take a few seconds.