strings-malware.exe.htm

@jjjj

!this is a Windows NT character-mode executable

AUTO

`.idata

DGROUP

.bss

.reloc

Open Watcom C/C++32 Run-Time system. Portions Copyright (c) Sybase, Inc. 1988-2002.

SQRU

]ZY[

SQVW

QVWU

t.1

t(@

t<1

]_^Y

SQRVW

_^ZY[

SQVW

_^Y[

QVWU

]_^Y

SQRV

^ZY[

SQV

^Y[

SQR

ZY[

SQR

ZY[

SQRV

uA9

^ZY[

SQV

^Y[

SQR

ZY[

SQRVWU

]_^ZY[

WVIDEO

QVWU

]_^Y

SVU

]_^Y

t"WVj

]_^Y

QRVW

_^ZY

SQR

ZY[

SQRV

^ZY[

t@9

^ZY[

SQRh`

ZY[

QVW

_^Y

F@B

SVWU

]_^[

vd=

QRh

"$@

SVW

,#@

_^[

F(f

$0<0

F %

~$f

_^[

HT1

P#@

SQV

D$$P

^Y[

SQRV

^ZY[

SQRV

^ZY[

SQVWU

@u'

]_^Y[

D$H

L$d0

\$f

L$X

%t,1

D$H

D$X

\$H

D$]

\$f

D$X&

D$X

D$Xf&

D$Xf

D$X&

D$X

\$H

D$h

\$l

T$p

L$t

\$x

T$|

L$L

T$f

L$L

|$^ u

|$L

D$H

L$L

D$h

D$H

T$hJA

T$h

|$l

D$H

L$l

\$]

suM

D$f u

|$p

~'1

D$H&

T$pJE

T$p

\$H

|$t

D$H

L$t

|$p

D$H&

\$pKE

\$p

|$x

D$H&

T$xJE

T$x

|$|

D$H

L$|

D$f

|$L

D$H

L$L

QVW

8*t

0r*

9w%kK

|<@

8.uS

*t1

0r<

9w7kK

Is`

_^Y

SQf

QVW

_^Y

u*f&

QVWU

]_^Y

QVWU

~"1

<$k

9uT

90u

A<0t

]_^Y

SQRVWU

0u*

X$)

p()

x,)

h0)

H4)

X$]_^ZY[

~<1

;C(

C(HF

bui

F(9

osI

gvV

SQRVWU

]_^ZY[

t,8

t:It)

@ u

SQRVW

$$;-

_^ZY[

u0;5

_^ZY[

SQVWU

]_^Y[

SQRVWU

]_^ZY[

s*;

SQRVWU

]_^ZY[

SQRV

u#^ZY[

^ZY[

QVW

_^Y

QVWU

]_^Y

G(1

]_^Y

QVWU

]_^Y

C(9

rE9

]_^Y

QR1

t.1

@hC

t.1

SQR

ZY[

SQV

^Y[

<E@

tE@

AE@

SQR

wS.

ZY[

QRVW

_^ZY

SQR

ZY[

SQVW

_^Y[

SQR

ZY[

QVWU

\$$

|$$1

D$$A

(]_^Y

,a<

VWU

\$H

\$D

l$D1

\$DF

D$H

L]_^

QVWU

\$$

|$$1

\$$A

(]_^Y

|";

SQR1

|1;

ZY[

QVWU

tKj

PWU

]_^Y

;<$t

]_^Y

SQRVW

_^ZY[

j@h

_^ZY[

SQR

ZY[

VWU

f;T$

]_^

$f9

]_^

SQV

^Y[

SQR

ZY[

SQRVWU

441

]_^ZY[

SQRV

^ZY[

SQVW

_^Y[

SQRV

|;;

^ZY[

SQRVU

]^ZY[

SQRVW

t*;

_^ZY[

SQRV

^ZY[

SQRVWU

]_^ZY[

8=u

]_^ZY[

VWU

]_^

:0u

]_^

<xu

<Xt

]_^

R<0r

<9w

<ar

<iv

<jr

<rv

<sr

<zw

SQRVWU

]_^ZY[

SQRVWU

:=u1

]_^ZY[

SQVWU

]_^Y[

QVWU

]_^Y

SQRVWU

]_^ZY[

SQRVWU

t@f

:=u2f

t%f

t!1

]_^ZY[

SQVWU

:=u:

]_^Y[

QVW

t(s*

FGf

_^Y

<$X

t)1

t 1

QVWU

]_^Y

PRj

]_^Y

@@f

SQVWU

uJ1

]_^Y[

SQRV

^ZY[

QVWU

vgf

tW1

t:;

$wD

]_^Y

f=a

f=z

,$f

$fX

t"1

SQR

ZY[

%@q@

%<q@

%Xq@

% q@

%Tq@

%Dq@

%`q@

%8q@

%\q@

%Pq@

%Lq@

%$q@

%0q@

%4q@

%(q@

%Hq@

%,q@

%dq@

USER32.DLL

KERNEL32.DLL

CharUpperA

CloseHandle

CreateEventA

CreateFileA

ExitProcess

FlushFileBuffers

FreeEnvironmentStringsA

GetACP

GetCPInfo

GetCommandLineA

GetCommandLineW

GetCurrentThreadId

GetEnvironmentStrings

GetFileType

GetLastError

GetModuleFileNameA

GetModuleFileNameW

GetModuleHandleA

GetOEMCP

GetProcAddress

GetStdHandle

GetVersion

LoadLibraryA

MultiByteToWideChar

SetConsoleCtrlHandler

SetEnvironmentVariableA

SetEnvironmentVariableW

SetFilePointer

SetStdHandle

SetUnhandledExceptionFilter

UnhandledExceptionFilter

VirtualAlloc

VirtualFree

VirtualQuery

WideCharToMultiByte

WriteFile

Oh my...am I a really malware????

Do you know what is the meaning of life? It is 42!

USER32.DLL

GetActiveWindow

The instruction at 0x00000000 caused a stack overflow floating point

exception.

The instruction at 0x00000000 caused a stack underflow floating point

exception.

The instruction at 0x00000000 caused a denormal operand floating point

exception.

The instruction at 0x00000000 caused a division by zero floating point

exception.

The instruction at 0x00000000 caused an inexact value floating point

exception.

The instruction at 0x00000000 caused an overflow floating point exception.

The instruction at 0x00000000 caused an underflow floating point exception.

The instruction at 0x00000000 caused an invalid operation floating point

exception.

The instruction at 0x00000000 referenced memory

at 0x00000000.

The memory could not be

read.

written.

A privileged instruction was executed at address 0x00000000.

An illegal instruction was executed at address 0x00000000.

An integer divide by zero was encountered at address 0x00000000.

A stack overflow was encountered at address 0x00000000.

The program encountered exception 0x00000000 at

address 0x00000000 and

cannot continue.

Exception fielded by 0x00000000

EAX=0x00000000

EBX=0x00000000

ECX=0x00000000

EDX=0x00000000

ESI=0x00000000

EDI=0x00000000

EBP=0x00000000

ESP=0x00000000

EIP=0x00000000

EFL=0x00000000

CS =0x00000000

SS =0x00000000

DS =0x00000000

ES =0x00000000

FS =0x00000000

GS =0x00000000

Stack dump (SS:ESP)

-stack end

0x00000000

Not enough memory to allocate file structures

conin$

conout$

Floating-point support not loaded

C_FILE_INFO

C_FILE_INFO=

ABNORMAL TERMINATION

0123456789abcdefghijklmnopqrstuvwxyz

8888888888

XXXXXXHHHHHHHHHHHHHHHHHHHH

Stack Overflow!

0123456789abcdef

@9@

A9@

UUUU

?3333

*$I

UUU

^Cy

,d!

^B{

0&@

@J@

0)000<0K0Y0

0C1t1

1"212

3 3%3+3<3F3K3S3^3b3u3

3<4A4Y4^4i4s4{4

4 5&5B5i5r5~5

586y6

7.767

84898M8n8t8z8

9!9'9-9:9Y9y9

:!:/:5:?:E:S:

;&;1;F;M;[;l;q;

='=-=7=C=I=|=

>r>

?!?T?d?n?

0-0?0Q0c0u0

1.1S1s1

2#2>2Q2]2l2

3,3034383<3@3D3|3

5V5k5

666A6J6P6U6n6

7B7\7

8%8

6}7

7H9N9W9j9

:?:E:O:U:`:i:

<3<C<I<Z<

= =9=k=

=>>D>O>Z>s>

f1l1u1

1'2-2?2I2p2x2

3s4w4

585

5#6(6.646G6L6p6u6}6

6U7

758v8

8I9

92:W:c:

;d;

;P<m<v<;=

?l?q?

*0-1F1Z1h1r1

2l2t2

233F3x3

4$4G4`4

4M5Y5_5i5}5

80:

:1;?;W;

;#<4<K<

<'=

0L1Y1{1

313:3@3X3e3

4B4R4|4

5>5

5v6

8|8v8p8j8d8^8X8R8L8F8

8 8$8(8p=

:v=

:8;

=|=

=\=`=