andr7.exe - IPad.exe - What the fuck

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	andr7.exe
size	89088 (0x15c00)
md5	1c2f5593fb4beacaf3cf17f24b76c557

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
93	4035	3
1	0	161
149	30729	16
132	30729	28
131	30729	97
132	21022	1
148	21022	1
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x53d012c2
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xa800
SizeOfInitializedData	0xb000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x23d4
BaseOfCode	0x1000
BaseOfData	0xc000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x3f000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xa7f3	0xa800	R-X CODE
.rdata	0xc000	0x2dd8	0x2e00	R-- IDATA
.data	0xf000	0x28aa4	0x1e00	RW- IDATA
.rsrc	0x38000	0x62b4	0x6400	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xe06c	0x28
RESOURCE	0x38000	0x62b4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xdb80	0x40
Bound_IAT	0	0
IAT	0xc000	0x270
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
FONT	#64	24497	1252
VERSION	#1	608	1252

module_name	hint	function_name
KERNEL32.dll	529	HeapSize
KERNEL32.dll	56	CompareStringW
KERNEL32.dll	55	CompareStringA
KERNEL32.dll	331	GetDriveTypeA
KERNEL32.dll	768	SetEndOfFile
KERNEL32.dll	79	CreateFileA
KERNEL32.dll	910	WriteConsoleW
KERNEL32.dll	302	GetConsoleOutputCP
KERNEL32.dll	900	WriteConsoleA
KERNEL32.dll	769	SetEnvironmentVariableA
KERNEL32.dll	364	GetLocaleInfoW
KERNEL32.dll	805	SetStdHandle
KERNEL32.dll	563	IsValidLocale
KERNEL32.dll	172	EnumSystemLocalesA
KERNEL32.dll	472	GetUserDefaultLCID
KERNEL32.dll	363	GetLocaleInfoA
KERNEL32.dll	468	GetTickCount
KERNEL32.dll	660	QueryPerformanceCounter
KERNEL32.dll	335	GetEnvironmentStringsW
KERNEL32.dll	239	FreeEnvironmentStringsW
KERNEL32.dll	333	GetEnvironmentStrings
KERNEL32.dll	238	FreeEnvironmentStringsA
KERNEL32.dll	527	HeapReAlloc
KERNEL32.dll	878	VirtualAlloc
KERNEL32.dll	898	WideCharToMultiByte
KERNEL32.dll	615	MultiByteToWideChar
KERNEL32.dll	940	lstrcmpW
KERNEL32.dll	937	lstrcatW
KERNEL32.dll	373	GetModuleFileNameW
KERNEL32.dll	952	lstrlenW
KERNEL32.dll	946	lstrcpyW
KERNEL32.dll	130	DeleteFileW
KERNEL32.dll	943	lstrcmpiW
KERNEL32.dll	370	GetLongPathNameW
KERNEL32.dll	354	GetFullPathNameW
KERNEL32.dll	611	MoveFileW
KERNEL32.dll	776	SetFileAttributesW
KERNEL32.dll	345	GetFileAttributesW
KERNEL32.dll	511	GlobalUnlock
KERNEL32.dll	504	GlobalLock
KERNEL32.dll	360	GetLastError
KERNEL32.dll	318	GetCurrentThreadId
KERNEL32.dll	377	GetModuleHandleW
KERNEL32.dll	763	SetCurrentDirectoryW
KERNEL32.dll	314	GetCurrentDirectoryW
KERNEL32.dll	240	FreeLibrary
KERNEL32.dll	500	GlobalFree
KERNEL32.dll	49	CloseHandle
KERNEL32.dll	315	GetCurrentProcess
KERNEL32.dll	316	GetCurrentProcessId
KERNEL32.dll	82	CreateFileW
KERNEL32.dll	408	GetProcAddress
KERNEL32.dll	583	LoadLibraryW
KERNEL32.dll	590	LocalFree
KERNEL32.dll	536	InitializeCriticalSection
KERNEL32.dll	127	DeleteCriticalSection
KERNEL32.dll	150	EnterCriticalSection
KERNEL32.dll	579	LeaveCriticalSection
KERNEL32.dll	711	RtlUnwind
KERNEL32.dll	665	RaiseException
KERNEL32.dll	842	TerminateProcess
KERNEL32.dll	859	UnhandledExceptionFilter
KERNEL32.dll	822	SetUnhandledExceptionFilter
KERNEL32.dll	557	IsDebuggerPresent
KERNEL32.dll	678	ReadFile
KERNEL32.dll	195	FileTimeToSystemTime
KERNEL32.dll	194	FileTimeToLocalFileTime
KERNEL32.dll	332	GetDriveTypeW
KERNEL32.dll	448	GetSystemTimeAsFileTime
KERNEL32.dll	374	GetModuleHandleA
KERNEL32.dll	182	ExitProcess
KERNEL32.dll	523	HeapFree
KERNEL32.dll	265	GetCommandLineA
KERNEL32.dll	478	GetVersionExA
KERNEL32.dll	517	HeapAlloc
KERNEL32.dll	412	GetProcessHeap
KERNEL32.dll	430	GetStartupInfoA
KERNEL32.dll	566	LCMapStringA
KERNEL32.dll	567	LCMapStringW
KERNEL32.dll	253	GetCPInfo
KERNEL32.dll	433	GetStringTypeA
KERNEL32.dll	436	GetStringTypeW
KERNEL32.dll	849	TlsGetValue
KERNEL32.dll	847	TlsAlloc
KERNEL32.dll	850	TlsSetValue
KERNEL32.dll	848	TlsFree
KERNEL32.dll	395	GetOEMCP
KERNEL32.dll	561	IsValidCodePage
KERNEL32.dll	471	GetTimeZoneInformation
KERNEL32.dll	777	SetFilePointer
KERNEL32.dll	786	SetHandleCount
KERNEL32.dll	432	GetStdHandle
KERNEL32.dll	350	GetFileType
KERNEL32.dll	313	GetCurrentDirectoryA
KERNEL32.dll	469	GetTimeFormatA
KERNEL32.dll	319	GetDateFormatA
KERNEL32.dll	911	WriteFile
KERNEL32.dll	372	GetModuleFileNameA
KERNEL32.dll	283	GetConsoleCP
KERNEL32.dll	300	GetConsoleMode
KERNEL32.dll	230	FlushFileBuffers
KERNEL32.dll	596	LocalUnlock
KERNEL32.dll	580	LoadLibraryA
KERNEL32.dll	521	HeapDestroy
KERNEL32.dll	519	HeapCreate
KERNEL32.dll	881	VirtualFree
KERNEL32.dll	266	GetCommandLineW
KERNEL32.dll	790	SetLastError
KERNEL32.dll	460	GetTempPathW
KERNEL32.dll	586	LocalAlloc
KERNEL32.dll	592	LocalLock
KERNEL32.dll	226	FindResourceW
KERNEL32.dll	585	LoadResource
KERNEL32.dll	599	LockResource
KERNEL32.dll	833	SizeofResource
KERNEL32.dll	246	GetACP
KERNEL32.dll	614	MulDiv
KERNEL32.dll	362	GetLocalTime
KERNEL32.dll	320	GetDateFormatW
KERNEL32.dll	470	GetTimeFormatW
KERNEL32.dll	186	ExpandEnvironmentStringsW
KERNEL32.dll	479	GetVersionExW
KERNEL32.dll	443	GetSystemInfo
KERNEL32.dll	949	lstrcpynW
KERNEL32.dll	66	CopyFileW
KERNEL32.dll	843	TerminateThread
KERNEL32.dll	211	FindFirstFileW
KERNEL32.dll	218	FindNextFileW
KERNEL32.dll	204	FindClose
KERNEL32.dll	93	CreateMutexW
KERNEL32.dll	108	CreateThread
KERNEL32.dll	508	GlobalSize
KERNEL32.dll	74	CreateDirectoryW
KERNEL32.dll	894	WaitForSingleObject
KERNEL32.dll	691	ReleaseMutex
KERNEL32.dll	834	Sleep
KERNEL32.dll	493	GlobalAlloc
KERNEL32.dll	92	CreateMutexA
KERNEL32.dll	64	CopyFileExA
KERNEL32.dll	883	VirtualLock
KERNEL32.dll	499	GlobalFlags
KERNEL32.dll	643	PostQueuedCompletionStatus
KERNEL32.dll	171	EnumSystemLanguageGroupsW
KERNEL32.dll	73	CreateDirectoryExW
KERNEL32.dll	461	GetThreadContext
KERNEL32.dll	775	SetFileAttributesA
KERNEL32.dll	342	GetFileAttributesA
KERNEL32.dll	884	VirtualProtect
KERNEL32.dll	886	VirtualQuery
KERNEL32.dll	667	ReadConsoleInputA
KERNEL32.dll	749	SetConsoleMode
KERNEL32.dll	638	OutputDebugStringA
KERNEL32.dll	544	InterlockedIncrement
KERNEL32.dll	540	InterlockedDecrement
KERNEL32.dll	581	LoadLibraryExA

StringTable 04090000

FileDescription	What the fuck
FileVersion	6, 6, 6, 6
LegalCopyright	Copyright © IPadSoft 2003-2011
OriginalFilename	IPad.exe
ProductName	IPad
ProductVersion	6, 6, 6, 6

VS_FIXEDFILEINFO

FileVersion	4.6.5.0
ProductVersion	0.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	89088	EXE	07/23/2014 19:53:38	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

andr7.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 04090000

VS_FIXEDFILEINFO

andr7.exe
-