32312.exe

info
MZ
PE
resources
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	32312.exe
size	1693340 (0x19d69c)
md5	685b06caeea4770cbcbc141dee80ede9

type	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x454b
blocks_in_file	0x4e52
num_relocs	0x4c45
header_paragraphs	0x3233
min_extra_paragraphs	0x442e
max_extra_paragraphs	0x4c4c
ss	0
sp	0x4550
checksum	0
ip	0x14c
cs	3
reloc_table_offset	0xb0be
overlay_number	0x4011
reserved0	0x7ceb3476ff50ad00
oem_id	0x148
oem_info	0x818f
reserved2	0x6f4c010b
reserved3	0x694c6461
reserved4	0x72617262
reserved5	0x4179
reserved6	0x1018
lfanew	0x10

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4011b0be
PointerToSymbolTable	0xff50ad00
NumberOfSymbols	0x7ceb3476
SizeOfOptionalHeader	0x148
Characteristics	0x818f
Magic	0x10b
LinkerVersion	76.111
SizeOfCode	0x694c6461
SizeOfInitializedData	0x72617262
SizeOfUninitializedData	0x4179
AddressOfEntryPoint	0x1018
BaseOfCode	0x10
BaseOfData	0x426000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.57
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x767000
SizeOfHeaders	0x200
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0xa

Packer / Compiler

Upack v0.36 (Dwing)

Sections

name	va	vsize	raw size	flags
PS��	0x1000	0x5c0000	0x1f0	RWX CODE IDATA
@t��	0x5c1000	0x1a5000	0x19d49c	RWX CODE IDATA
s��@	0x766000	0x1000	0x1f0	RWX CODE IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x7661ee	0x14
RESOURCE	0x5c1000	0xfef0
EXCEPTION	0xad3876ff	0xbe3e8b50
SECURITY	0xb660f0	0xf359276a
BASERELOC	0x476ffa5	0x8bffc883
DEBUG	0x1cebabdf	0
ARCHITECTURE	0x50746547	0x41636f72
GLOBALPTR	0x65726464	0x7373
TLS	0x75e2f1	0x18

TLS

raw start	raw end	index	callbks	zero fill	flags
0x565000	0x565010	0x55a09c	0	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	CDROM	192
BITMAP	CLOSEDFOLDER	224
BITMAP	CURRENTFOLDER	224
BITMAP	EXECUTABLE	224
BITMAP	FLOPPY	192
BITMAP	HARD	192
BITMAP	KNOWNFILE	224
BITMAP	MENUBTN	3160
BITMAP	METRIC	808
BITMAP	NETWORK	192
BITMAP	OPENFOLDER	224
BITMAP	PREVIEWGLYPH	232
BITMAP	PS	808
BITMAP	RAM	192
BITMAP	RASTER	808
BITMAP	TTF	808
BITMAP	UNKNOWN	808
BITMAP	UNKNOWNFILE	224
ICON	#1	59064
DIALOG	DLGTEMPLATE	82
STRING	#3682	76
STRING	#3683	170
STRING	#3684	390
STRING	#3685	462
STRING	#3686	324
STRING	#3687	126
STRING	#3688	36
STRING	#4072	120
STRING	#4073	912
STRING	#4074	996
STRING	#4075	916
STRING	#4076	920
STRING	#4077	704
STRING	#4078	996
STRING	#4079	936
STRING	#4080	484
STRING	#4081	420
STRING	#4082	284
STRING	#4083	908
STRING	#4084	200
STRING	#4085	256
STRING	#4086	568
STRING	#4087	1052
STRING	#4088	832
STRING	#4089	924
STRING	#4090	1032
STRING	#4091	236
STRING	#4092	208
STRING	#4093	668
STRING	#4094	1036
STRING	#4095	816
STRING	#4096	788
RCDATA	ACGL	3263
RCDATA	ACSHDA	3416
RCDATA	ACSHDI	3341
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	2492
RCDATA	SC	1076
RCDATA	SD	1201
RCDATA	SE	417
RCDATA	SF	1649
RCDATA	SR	1969
RCDATA	TFORM1	543482
RCDATA	TFORM10	695029
RCDATA	TFORM11	5227
RCDATA	TFORM12	3698
RCDATA	TFORM13	1458
RCDATA	TFORM2	480
RCDATA	TFORM3	150567
RCDATA	TFORM4	802304
RCDATA	TFORM5	194441
RCDATA	TFORM7	63449
RCDATA	TFORM8	189811
RCDATA	TFORM9	1757
RCDATA	TFRMSELECTPROC	1203
RCDATA	TPATHDIALOGFORM	1379
RCDATA	TSCALCFORM	6919
RCDATA	TSCOLORDIALOGFORM	7053
RCDATA	TSPOPUPCALENDAR	778
RCDATA	TUHFO	1282
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_ICON	MAINICON	20

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	1687756	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1693340 bytes (1654 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] unusual size of IMAGE_OPTIONAL_HEADER = 328 (must be 224)

[?] 104 spare bytes after IMAGE_OPTIONAL_HEADER

[?] invalid DOS stub size -205600

[?] can't find file_offset of VA 0x17b824

[?] can't find file_offset of VA 0x17b958

[?] can't find file_offset of VA 0x17ba8c

[?] can't find file_offset of VA 0x17bbc0

[?] can't find file_offset of VA 0x17bcf4

[?] can't find file_offset of VA 0x17be28

[?] can't find file_offset of VA 0x17bf5c

[?] can't find file_offset of VA 0x17c090

[?] can't find file_offset of VA 0x17c260

[?] can't find file_offset of VA 0x17c444

[?] can't find file_offset of VA 0x17c614

[?] can't find file_offset of VA 0x17c7e4

[?] can't find file_offset of VA 0x17c9b4

[?] can't find file_offset of VA 0x17cb84

[?] can't find file_offset of VA 0x17cd54

[?] can't find file_offset of VA 0x17cf24

[?] can't find file_offset of VA 0x17d0f4

[?] can't find file_offset of VA 0x17d2c4

[?] can't find file_offset of VA 0x17d384

[?] can't find file_offset of VA 0x17d464

[?] can't find file_offset of VA 0x17d544

[?] can't find file_offset of VA 0x17d624

[?] can't find file_offset of VA 0x17d6e4

[?] can't find file_offset of VA 0x17d7a4

[?] can't find file_offset of VA 0x17d884

[?] can't find file_offset of VA 0x17e4dc

[?] can't find file_offset of VA 0x17e804

[?] can't find file_offset of VA 0x17e8c4

[?] can't find file_offset of VA 0x17e9a4

[?] can't find file_offset of VA 0x17ea8c

[?] can't find file_offset of VA 0x17edb4

[?] can't find file_offset of VA 0x17ee74

[?] can't find file_offset of VA 0x17f19c

[?] can't find file_offset of VA 0x17f4c4

[?] can't find file_offset of VA 0x17f7ec

[?] can't find file_offset of VA 0x18df84

[?] can't find file_offset of VA 0x18dfd8

[?] can't find file_offset of VA 0x18e024

[?] can't find file_offset of VA 0x18e0d0

[?] can't find file_offset of VA 0x18e258

[?] can't find file_offset of VA 0x18e428

[?] can't find file_offset of VA 0x18e56c

[?] can't find file_offset of VA 0x18e5ec

[?] can't find file_offset of VA 0x18e610

[?] can't find file_offset of VA 0x18e688

[?] can't find file_offset of VA 0x18ea18

[?] can't find file_offset of VA 0x18edfc

[?] can't find file_offset of VA 0x18f190

[?] can't find file_offset of VA 0x18f528

[?] can't find file_offset of VA 0x18f7e8

[?] can't find file_offset of VA 0x18fbcc

[?] can't find file_offset of VA 0x18ff74

[?] can't find file_offset of VA 0x190158

[?] can't find file_offset of VA 0x1902fc

[?] can't find file_offset of VA 0x190418

[?] can't find file_offset of VA 0x1907a4

[?] can't find file_offset of VA 0x19086c

[?] can't find file_offset of VA 0x19096c

[?] can't find file_offset of VA 0x190ba4

[?] can't find file_offset of VA 0x190fc0

[?] can't find file_offset of VA 0x191300

[?] can't find file_offset of VA 0x19169c

[?] can't find file_offset of VA 0x191aa4

[?] can't find file_offset of VA 0x191b90

[?] can't find file_offset of VA 0x191c60

[?] can't find file_offset of VA 0x191efc

[?] can't find file_offset of VA 0x192308

[?] can't find file_offset of VA 0x192638

[?] can't find file_offset of VA 0x19294c

[?] can't find file_offset of VA 0x19360c

[?] can't find file_offset of VA 0x194364

[?] can't find file_offset of VA 0x195074

[?] can't find file_offset of VA 0x195084

[?] can't find file_offset of VA 0x195a40

[?] can't find file_offset of VA 0x195e74

[?] can't find file_offset of VA 0x196328

[?] can't find file_offset of VA 0x1964cc

[?] can't find file_offset of VA 0x196b40

[?] can't find file_offset of VA 0x1972f4

[?] can't find file_offset of VA 0x21bdf0

[?] can't find file_offset of VA 0x2c58e8

[?] can't find file_offset of VA 0x2c6d54

[?] can't find file_offset of VA 0x2c7bc8

[?] can't find file_offset of VA 0x2c817c

[?] can't find file_offset of VA 0x2c835c

[?] can't find file_offset of VA 0x2ecf84

[?] can't find file_offset of VA 0x3b0d84

[?] can't find file_offset of VA 0x3e0510

[?] can't find file_offset of VA 0x3efcec

[?] can't find file_offset of VA 0x41e260

[?] can't find file_offset of VA 0x41e940

[?] can't find file_offset of VA 0x41edf4

[?] can't find file_offset of VA 0x41f358

[?] can't find file_offset of VA 0x420e60

[?] can't find file_offset of VA 0x4229f0

[?] can't find file_offset of VA 0x422cfc

[?] can't find file_offset of VA 0x423200

[?] can't find file_offset of VA 0x423214

[?] can't find file_offset of VA 0x423228

[?] can't find file_offset of VA 0x42323c

[?] can't find file_offset of VA 0x423250

[?] too many errors getting resource data, stopped on 0 of 1

[?] can't find file_offset of VA 0x15a09c

[?] non-empty last IMAGE_IMPORT_DESCRIPTOR: #<struct PEdump::IMAGE_IMPORT_DESCRIPTOR OriginalFirstThunk=4584, TimeDateStamp=0, ForwarderChain=0, Name=0, FirstThunk=65544, module_name=nil, original_first_thunk=nil, first_thunk=nil>

[?] invalid DOS stub size -205600

[?] can't find file_offset of VA 0xad3876ff

[?] can't find file_offset of VA 0x476ffa5

[?] can't find file_offset of VA 0x1cebabdf

[?] can't find file_offset of VA 0x50746547

[?] can't find file_offset of VA 0x65726464