2013-11-13bRagexe.exe

info
MZ
PE
resources
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	2013-11-13bRagexe.exe
size	3966384 (0x3c85b0)
md5	7bd872e3eba1630c8baeb6c6172eba10

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x138

Rich Header

lib id	version	times used
10	9782	1
11	9782	14
152	20115	10
158	40219	9
131	30729	9
156	40219	4
48	8943	1
147	30729	30
29	9178	1
4	8447	114
1	0	519
25	9210	5
28	9178	1
170	40219	51
171	40219	318
155	40219	1
154	40219	1
151	0	1
157	40219	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x5281d92f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x553600
SizeOfInitializedData	0x12fc00
SizeOfUninitializedData	0
AddressOfEntryPoint	0xc21000
BaseOfCode	0x1000
BaseOfData	0x555000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xc22000
SizeOfHeaders	0x400
CheckSum	0x3bcfea
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0x896000	0x21d200	RWX IDATA
.rsrc	0x897000	0x2a48	0x1200	RW- IDATA
.idata	0x89a000	0x1000	0x200	RW- IDATA
	0x89b000	0x1eb000	0x200	RWX IDATA
mwfkkpab	0xa86000	0x19b000	0x19a200	RWX IDATA
qppuolds	0xc21000	0x1000	0x200	RWX IDATA

Data Directory

type	va	size
EXPORT	0xc1ed2c	0x96
IMPORT	0x89a06d	0x95
RESOURCE	0x897000	0x2a48
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	744	1252
ICON	#2	744	1252
ICON	#3	2216	1252
DIALOG	#102	610	1252
DIALOG	#117	526	1252
DIALOG	#117	396	1252
DIALOG	#145	2866	1252
DIALOG	#151	556	1252
DIALOG	#154	152	1252
ACCELERATORS	#156	24	1252
GROUP_ICON	#114	20	1252
GROUP_ICON	#119	34	1252
MANIFEST	#1	618	1252
MANIFEST	#120	521	1252

module_name	hint	ord	function_name
kernel32.dll			lstrcpy
comctl32.dll			InitCommonControls

ord	entry_va	function_name
1	0x4afd97	??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
2	0x4afd9c	??4_Init_locks@std@@QAEAAV01@ABV01@@Z

module_name	Ragexe.exe
flags	0
timestamp	2013-11-12 07:30:54
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0xc1ed5c
Functions(2)	0xc1ed54
NameOrdinals(2)	0xc1ed64

show previews

offset	size	type	comment
0	3906560	EXE	11/12/2013 07:30:55	#
15c1	15	HTM		#
3b9c00	59824	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 3966384 bytes (3874 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x8983ec

[?] can't find file_offset of VA 0x8985fc

[?] can't find file_offset of VA 0x898788

[?] can't find file_offset of VA 0x8992bc

[?] can't find file_offset of VA 0x8994e8

[?] can't find file_offset of VA 0x899580