filenamereport934875438jdfg8i45jg_07242014.exe
size305152 (0x4a800)
md57e3e28320d209a586917668e3b8eac40
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1540355
10239
93403523
95403518
9440351
96403523
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x53d0f3b4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.1
SizeOfCode0x35800
SizeOfInitializedData0x15200
SizeOfUninitializedData0
AddressOfEntryPoint0x32a90
BaseOfCode0x1000
BaseOfData0x37000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x4d000
SizeOfHeaders0x400
CheckSum0x4d8dc
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x357aa0x35800R-X CODE
.rdata0x370000x68020x6a00R-- IDATA
.data0x3e0000xb7bc0xb200RW- IDATA
.rsrc0x4a0000x2e600x3000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x3d1080x50
RESOURCE0x4a0000x2e60
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x370000x13c
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP#25669200
BITMAP#25738400
RCDATA#100300
VERSION#13720
MANIFEST#13460
module_namehintordfunction_name
USER32.dll567PostQuitMessage
USER32.dll631SendMessageA
USER32.dll155DefWindowProcA
USER32.dll109CreateWindowExA
USER32.dll735ShowWindow
USER32.dll785UpdateWindow
USER32.dll492LoadIconA
USER32.dll488LoadCursorA
USER32.dll588RegisterClassExA
USER32.dll345GetMessageA
USER32.dll761TranslateAcceleratorA
USER32.dll764TranslateMessage
USER32.dll174DispatchMessageA
USER32.dll110CreateWindowExW
USER32.dll166DestroyWindow
USER32.dll162DestroyCursor
USER32.dll216EnableWindow
USER32.dll356GetParent
USER32.dll161DestroyCaret
USER32.dll160DestroyAcceleratorTable
USER32.dll170DialogBoxIndirectParamW
USER32.dll163DestroyIcon
USER32.dll157DeferWindowPos
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll617GetStringTypeW
KERNEL32.dll614GetStringTypeA
KERNEL32.dll813LCMapStringW
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll828LoadLibraryA
KERNEL32.dll581GetProcAddress
KERNEL32.dll722HeapReAlloc
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll567GetOEMCP
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll82CloseHandle
KERNEL32.dll960ReadFile
KERNEL32.dll136CreateFileA
KERNEL32.dll715HeapAlloc
KERNEL32.dll717HeapCreate
KERNEL32.dll811LCMapStringA
KERNEL32.dll612GetStdHandle
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll390GetCommandLineA
KERNEL32.dll674GetVersion
KERNEL32.dll281ExitProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll352FreeEnvironmentStringsA
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll472GetEnvironmentStrings
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll1135SetHandleCount
KERNEL32.dll499GetFileType
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll1139SetLastError
KERNEL32.dll1223TlsGetValue
KERNEL32.dll514GetLastError
KERNEL32.dll475GetEnvironmentVariableA
KERNEL32.dll675GetVersionExA
KERNEL32.dll718HeapDestroy
KERNEL32.dll1260VirtualFree
KERNEL32.dll719HeapFree
KERNEL32.dll1048RtlUnwind
KERNEL32.dll1317WriteFile
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll370GetCPInfo
KERNEL32.dll360GetACP
COMCTL32.dll123InitCommonControlsEx

StringTable 042504B3

FileVersion1.0.2.2
ProductVersion1.0.2.2
CompanyNameSec Corp.

VS_FIXEDFILEINFO

FileVersion1.0.2.1
ProductVersion1.0.2.1
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS5
FileType1
FileSubtype0
offsetsizetypecomment
0305152EXE07/24/2014 11:53:24#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK