filename86D1807600B289F064BAE30005145B5D.exe
size482816 (0x75e00)
md586d1807600b289f064bae30005145b5d
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
428803138
96334375
19812464
10189
963204131
18844497

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5314d7fb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x98e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x5e00
SizeOfInitializedData0x6fc00
SizeOfUninitializedData0
AddressOfEntryPoint0x6bb4
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x78000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x104000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x25000
SizeOfHeapCommit0x4000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x5d400x5e00R-X CODE
.rdata0x70000x130c40x13200R-- IDATA
.data0x1b0000x5acb60x5ae00RW- IDATA
.reloc0x760000x1a0c0x1c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x70000xb4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x760000x1a0c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x18fec0x2a4
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
MSVCRT.dll1258memcpy
MSVCRT.dll1167exit
MSVCRT.dll858_strdup
MSVCRT.dll179__p___argv
MSVCRT.dll28const bad_typeid::`vftable'

??_7bad_typeid@@6B@

MSVCRT.dll354_exit
MSVCRT.dll211__set_app_type
MSVCRT.dll231_acmdln
MSVCRT.dll688_mbsnextc
MSVCRT.dll213__setusermatherr
MSVCRT.dll542_ismbstrail
MSVCRT.dll146__getmainargs
MSVCRT.dll50public: char const * __thiscall type_info::name(void)const

?name@type_info@@QBEPBDXZ

MSVCRT.dll191__p__fmode
MSVCRT.dll186__p__commode
MSVCRT.dll344_except_handler3
MSVCRT.dll490_ismbbgraph
MSVCRT.dll295_controlfp
MSVCRT.dll1290sinh
MSVCRT.dll218__unDName
MSVCRT.dll1201fwrite
MSVCRT.dll52void (__cdecl*__cdecl set_new_handler(void (__cdecl*)(void)))(void)

?set_new_handler@@YAP6AXXZP6AXXZ@Z

MSVCRT.dll1295sscanf
MSVCRT.dll1189fread
MSVCRT.dll53void (__cdecl*__cdecl set_terminate(void (__cdecl*)(void)))(void)

?set_terminate@@YAP6AXXZP6AXXZ@Z

MSVCRT.dll469_initterm
MSVCRT.dll187__p__daylight
MSVCRT.dll107_XcptFilter
MSVCRT.dll284_chkesp
MSVCRT.dll1228iswctype
MSVCRT.dll736_mkdir
MSVCRT.dll245_adjust_fdiv
MSVCRT.dll316_ctime64
USER32.dll577SendNotifyMessageA
USER32.dll719WaitMessage
USER32.dll200EndPaint
USER32.dll300GetMenu
USER32.dll114DdeEnableCallback
USER32.dll348GetSystemMenu
USER32.dll164DlgDirListA
USER32.dll541RegisterDeviceNotificationW
USER32.dll482MessageBoxIndirectA
USER32.dll599SetForegroundWindow
USER32.dll667TabbedTextOutA
USER32.dll147DestroyAcceleratorTable
USER32.dll327GetProcessDefaultLayout
USER32.dll38CharLowerA
USER32.dll162DispatchMessageW
USER32.dll712VkKeyScanExW
USER32.dll15BringWindowToTop
USER32.dll347GetSysColorBrush
USER32.dll429IsWindow
USER32.dll406IsCharAlphaA
USER32.dll414IsChild
USER32.dll387IMPQueryIMEA
USER32.dll573SendMessageCallbackW
USER32.dll268GetDC
USER32.dll649SetWindowsHookA
USER32.dll214EnumDisplaySettingsW
USER32.dll58CheckMenuRadioItem
USER32.dll272GetDlgCtrlID
OLEPRO32.dll4OleCreatePictureIndirect
OLEPRO32.dll1OleCreatePropertyFrameIndirect
OLEPRO32.dll8DllGetClassObject
OLEPRO32.dllOleIconToCursor
OLEPRO32.dll9DllRegisterServer
OLEPRO32.dll5OleCreateFontIndirect
OLEPRO32.dll3OleLoadPicture
OLEPRO32.dll6OleTranslateColor
OLEPRO32.dll7DllCanUnloadNow
SHLWAPI.dll766StrCSpnW
SHLWAPI.dll604PathFindFileNameW
SHLWAPI.dll814StrStrA
SHLWAPI.dll815StrStrIA
SHLWAPI.dll665PathRemoveExtensionA
SHLWAPI.dll680PathStripToRootW
SHLWAPI.dll806StrRStrIW
SHLWAPI.dll663PathRemoveBlanksA
SHLWAPI.dll829UrlApplySchemeW
SHLWAPI.dll602PathFindExtensionW
SHLWAPI.dll664PathRemoveBlanksW
SHLWAPI.dll676PathSkipRootW
SHLWAPI.dll616PathGetDriveNumberW
SHLWAPI.dll736SHRegGetBoolUSValueW
SHLWAPI.dll827StrTrimW
SHLWAPI.dll601PathFindExtensionA
SHLWAPI.dll826StrTrimA
SHLWAPI.dll678PathStripPathW
SHLWAPI.dll626PathIsLFNFileSpecW
SHLWAPI.dll634PathIsRootW
SHLWAPI.dll783StrCmpW
SHLWAPI.dll603PathFindFileNameA
SHLWAPI.dll819StrStrW
SHLWAPI.dll598PathCreateFromUrlW
SHLWAPI.dll816StrStrIW
SHLWAPI.dll701SHDeleteKeyW
SHLWAPI.dll763StrCSpnA
SHLWAPI.dll798StrNCatW
SHLWAPI.dll679PathStripToRootA
SHLWAPI.dll675PathSkipRootA
SHLWAPI.dll844UrlHashA
SHLWAPI.dll777StrCmpIW
SHLWAPI.dll666PathRemoveExtensionW
SHLWAPI.dll662PathRemoveBackslashW
SHLWAPI.dll615PathGetDriveNumberA
SHLWAPI.dll677PathStripPathA
SHLWAPI.dll759SHSetValueW
GDI32.dll41CreateBrushIndirect
GDI32.dll527SelectObject
GDI32.dll80CreateSolidBrush
GDI32.dll71CreatePen
GDI32.dll58CreateFontIndirectA
GDI32.dll211EqualRgn
GDI32.dll69CreatePalette
GDI32.dll422GetStockObject
GDI32.dll143DeleteObject
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll374GetModuleHandleA
KERNEL32.dll478GetVersionExA
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll517HeapAlloc
KERNEL32.dll878VirtualAlloc
KERNEL32.dll523HeapFree
KERNEL32.dll468GetTickCount
KERNEL32.dll479GetVersionExW
KERNEL32.dll951lstrlenA
KERNEL32.dll446GetSystemTime
KERNEL32.dll430GetStartupInfoA
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll939lstrcmpA
KERNEL32.dll703ResetEvent
KERNEL32.dll772SetEvent
KERNEL32.dll49CloseHandle
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll431GetStartupInfoW
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll412GetProcessHeap
KERNEL32.dll75CreateEventA
COMCTL32.dll77ImageList_SetIconSize
COMCTL32.dll33FlatSB_SetScrollProp
COMCTL32.dll26FlatSB_EnableScrollBar
COMCTL32.dll14CreateUpDownControl
COMCTL32.dll25DrawStatusTextW
COMCTL32.dll80InitCommonControlsEx
COMCTL32.dll15InitCommonControls
OLE32.dll84CoRegisterPSClsid
OLE32.dll105CoUninitialize
OLE32.dll85CoRegisterSurrogate
OLE32.dll136CreateDataCache
OLE32.dll146CreateStreamOnHGlobal
OLE32.dll332WdtpInterfacePointer_UserSize
OLE32.dll28CoFreeLibrary
OLE32.dll40CoGetCurrentProcess
OLE32.dll134CreateClassMoniker
OLE32.dll230OleCreateEmbeddingHelper
OLE32.dll258OleLoadFromStream
OLE32.dll170HBITMAP_UserSize
OLE32.dll182HENHMETAFILE_UserSize
OLE32.dll87CoReleaseMarshalData
OLE32.dll69CoInitialize
OLE32.dll9CLSIDFromString
offsetsizetypecomment
0482816EXE03/03/2014 19:28:59#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK