rain003.exe

info
MZ
PE
resources
imports
foremost
7zip
signature
hexdump
disasm
log
discuss
donate

filename	rain003.exe
size	91338 (0x164ca)
md5	095ec350a139da6d96fef627db401e73

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
47035	24900	3481846
0	0	2113929216
93	4035	6
14	7299	2
10	8047	11
4	8047	2
11	9782	3
4	9782	3
1	0	257
11	8086	10
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x558c0267
PointerToSymbolTable	1
NumberOfSymbols	0xff01
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.6
SizeOfCode	0x4000
SizeOfInitializedData	0x6000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x441a
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xb000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0xff1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
�ext	0x1000	0x368e	0x3500	R-X CODE
.rdata	0x5000	0x12f5	0x2000	R--
.data	0x7000	0x1024	0x1000	RW- IDATA
.rsrc	0x9000	0x1750	0x2001	R-- IDATA

Data Directory

type	va	size
EXPORT	0x100	0xff00
IMPORT	0x5c74	0x1000078
RESOURCE	0x9000	0x101
EXCEPTION	0	0
SECURITY	0x10000	1
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5000	0x401
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp	r
	#128	143360	34176	149504
	#10805248	3196599813	740747318	2002470710
	#10856448	3873587090	2502172791	788071475
	#10936320	1439483445	3813638749	503977515
	#10897408	1332282852	4230518298	2774013017
	#10604544	4127191965	3151749421	1136080157
	#10713088	1056966912	16128	768
	#10536960	1694528512	27904	16777472
	#10240	1126411130	3109709588	726526424
#16776960	#256	2521925138	160441677	4207757816
#16776960	#640	4143501405	3861871025	3267971818
#16776960	#1152	3641665138	2570846662	3802389895
#16776960	#1408	4087131640	3893418334	1554141700
#16776960	#2432	1023556877	2960735700	1192363753
	#10359	248315903	4155768703	190906271
	#4294914816	2973031384	3774083439	3329830073
	#3422591232	2908324718	764301783	828495937
	???	3027475356	3834142834	2537458509

module_name	hint	ord	function_name
MFC42.DLL		4486
MFC42.DLL		2554
MFC42.DLL		2512
MFC42.DLL		5731
MFC42.DLL		3922
MFC42.DLL		1089
MFC42.DLL		5199
MFC42.DLL		2396
MFC42.DLL		3346
MFC42.DLL		5300
MFC42.DLL		5302
MFC42.DLL		2725
MFC42.DLL		4079
MFC42.DLL		4698
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		5714
MFC42.DLL		2982
MFC42.DLL		3147
MFC42.DLL		3259
MFC42.DLL		4465
MFC42.DLL		3136
MFC42.DLL		3262
MFC42.DLL		2985
MFC42.DLL		3081
MFC42.DLL		2976
MFC42.DLL		3830
MFC42.DLL		3831
MFC42.DLL		3825
MFC42.DLL		3079
MFC42.DLL		4080
MFC42.DLL		4622
MFC42.DLL		4424
MFC42.DLL		3738
MFC42.DLL		561
MFC42.DLL		815
MFC42.DLL		6215
MFC42.DLL		617
MFC42.DLL		5301
MFC42.DLL		5214
MFC42.DLL		296
MFC42.DLL		986
MFC42.DLL		520
MFC42.DLL		4159
MFC42.DLL		6117
MFC42.DLL		2621
MFC42.DLL		1134
MFC42.DLL		1199
MFC42.DLL		1247
MFC42.DLL		5265
MFC42.DLL		4376
MFC42.DLL		4853
MFC42.DLL		4998
MFC42.DLL		4710
MFC42.DLL		2514
MFC42.DLL		6052
MFC42.DLL		4078
MFC42.DLL		1775
MFC42.DLL		4407
MFC42.DLL		5241
MFC42.DLL		2385
MFC42.DLL		5163
MFC42.DLL		6374
MFC42.DLL		4353
MFC42.DLL		5280
MFC42.DLL		3798
MFC42.DLL		4837
MFC42.DLL		4441
MFC42.DLL		2648
MFC42.DLL		2055
MFC42.DLL		6376
MFC42.DLL		3749
MFC42.DLL		5065
MFC42.DLL		1727
MFC42.DLL		5261
MFC42.DLL		2446
MFC42.DLL		2124
MFC42.DLL		5277
MFC42.DLL		4627
MFC42.DLL		4425
MFC42.DLL		3597
MFC42.DLL		324
MFC42.DLL		641
MFC42.DLL		4234
MFC42.DLL		825
MFC42.DLL		823
MFC42.DLL		1825
MFC42.DLL		4238
MFC42.DLL		4696
MFC42.DLL		3058
MFC42.DLL		3065
MFC42.DLL		6336
MFC42.DLL		2510
MFC42.DLL		2542
MFC42.DLL		5243
MFC42.DLL		5740
MFC42.DLL		1746
MFC42.DLL		5577
MFC42.DLL		3172
MFC42.DLL		5653
MFC42.DLL		4420
MFC42.DLL		4953
MFC42.DLL		4858
MFC42.DLL		2399
MFC42.DLL		4387
MFC42.DLL		3454
MFC42.DLL		3198
MFC42.DLL		6080
MFC42.DLL		6175
MFC42.DLL		4623
MFC42.DLL		6375
MFC42.DLL		338
MFC42.DLL		652
MFC42.DLL		4823
MFC42.DLL		1945
MFC42.DLL		4273
MFC42.DLL		4614
MFC42.DLL		4613
MFC42.DLL		4589
MFC42.DLL		4899
MFC42.DLL		5076
MFC42.DLL		4341
MFC42.DLL		4349
MFC42.DLL		4723
MFC42.DLL		4890
MFC42.DLL		4531
MFC42.DLL		4545
MFC42.DLL		4543
MFC42.DLL		4526
MFC42.DLL		4529
MFC42.DLL		4524
MFC42.DLL		4964
MFC42.DLL		4961
MFC42.DLL		4108
MFC42.DLL		6055
MFC42.DLL		1776
MFC42.DLL		5240
MFC42.DLL		5290
MFC42.DLL		3748
MFC42.DLL		1726
MFC42.DLL		4432
MFC42.DLL		560
MFC42.DLL		813
MFC42.DLL		5260
MFC42.DLL		2535
MFC42.DLL		1168
MFC42.DLL		3571
MFC42.DLL		3626
MFC42.DLL		3663
MFC42.DLL		2414
MFC42.DLL		1641
MFC42.DLL		1146
MFC42.DLL		2379
MFC42.DLL		860
MFC42.DLL		540
MFC42.DLL		800
MFC42.DLL		2370
MFC42.DLL		5308
MFC42.DLL		4779
MFC42.DLL		5811
MFC42.DLL		5482
MFC42.DLL		2032
MFC42.DLL		4411
MFC42.DLL		4447
MFC42.DLL		4863
MFC42.DLL		4975
MFC42.DLL		4919
MFC42.DLL		5797
MFC42.DLL		5479
MFC42.DLL		1995
MFC42.DLL		967
MFC42.DLL		3717
MFC42.DLL		523
MFC42.DLL		791
MFC42.DLL		4335
MFC42.DLL		1083
MFC42.DLL		1842
MFC42.DLL		4242
MFC42.DLL		2723
MFC42.DLL		2390
MFC42.DLL		3059
MFC42.DLL		5100
MFC42.DLL		5103
MFC42.DLL		4467
MFC42.DLL		4303
MFC42.DLL		3350
MFC42.DLL		5012
MFC42.DLL		975
MFC42.DLL		5472
MFC42.DLL		3403
MFC42.DLL		2879
MFC42.DLL		2878
MFC42.DLL		4151
MFC42.DLL		4077
MFC42.DLL		5237
MFC42.DLL		5282
MFC42.DLL		2649
MFC42.DLL		1665
MFC42.DLL		4436
MFC42.DLL		4427
MFC42.DLL		5600
MFC42.DLL		554
MFC42.DLL		529
MFC42.DLL		501
MFC42.DLL		366
MFC42.DLL		674
MFC42.DLL		773
MFC42.DLL		796
MFC42.DLL		807
MFC42.DLL		2494
MFC42.DLL		2627
MFC42.DLL		2626
MFC42.DLL		6000
MFC42.DLL		2117
MFC42.DLL		6625
MFC42.DLL		4457
MFC42.DLL		5252
MFC42.DLL		2029
MFC42.DLL		4163
MFC42.DLL		2077
MFC42.DLL		4610
MFC42.DLL		4612
MFC42.DLL		4615
MFC42.DLL		4426
MFC42.DLL		4274
MFC42.DLL		1576
MSVCRT.dll	271		_initterm
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	390		_onexit
MSVCRT.dll	183		_controlfp
MSVCRT.dll	143		_acmdln
MSVCRT.dll	585		exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	702		strlen
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	88		__getmainargs
KERNEL32.dll	83		CreateFileA
KERNEL32.dll	383		GetModuleHandleA
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	381		GetModuleFileNameA
USER32.dll	589		SetCursor
USER32.dll	440		LoadBitmapA
USER32.dll	403		InvalidateRect
USER32.dll	634		SetTimer
USER32.dll	442		LoadCursorA
USER32.dll	446		LoadIconA
USER32.dll	571		SendMessageA
USER32.dll	700		UpdateWindow
USER32.dll	196		EnableWindow
WSOCK32.dll		13

OpenSSL (terse)
ASN.1 (verbose)

No certificates in

#<struct PEdump::WIN_CERTIFICATE dwLength=3126010091, wRevision=50559, wCertificateType=12315, data=nil>

Cannot call to_der on

#<struct PEdump::WIN_CERTIFICATE dwLength=3126010091, wRevision=50559, wCertificateType=12315, data=nil>

show previews

offset	size	type	comment
0	41216	EXE	06/25/2015 13:30:15	#
15c1	15	HTM		#
a100	50122	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 91338 bytes (90 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] cannot find rich_hdr start_idx, using heuristics

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 18434 entries in directory, but got EOF on 7288-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33039

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 83727

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 73999

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 60687

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 70927

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61711

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 38159

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 38671

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 49423

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 88335

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37647

[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "\r\xD8" followed by "q@" on UTF-16LE

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 19727

[?] too many errors getting resource data, stopped on 325 of 7288

[?] can't find file_offset of VA 0x8400

[?] can't find file_offset of VA 0xb32d2b1

[?] can't find file_offset of VA 0xdd53afa0

[?] can't find file_offset of VA 0x814d81ab

[?] can't find file_offset of VA 0x3aa134c4

[?] can't find file_offset of VA 0xdedab2bb

[?] can't find file_offset of VA 0x73007900

[?] can't find file_offset of VA 0x3039c5a7

[?] can't find file_offset of VA 0xf5820810

[?] can't find file_offset of VA 0xc4ae5ad1

[?] can't find file_offset of VA 0x483c5944

[?] can't find file_offset of VA 0x404d9059

[?] can't find file_offset of VA 0xb3c14798

[?] can't find file_offset of VA 0xf9f3ffff

[?] can't find file_offset of VA 0x1df8377f

[?] can't find file_offset of VA 0x176ca18b

[?] can't find file_offset of VA 0x9be95adb

[?] can't find file_offset of VA 0x90608c

[?] can't find file_offset of VA 0x100

[!] PEdump::WIN_CERTIFICATE: too big length 3126010091

[?] can't find file_offset of VA 0x100

[!] PEdump::WIN_CERTIFICATE: too big length 3126010091