SetupCasinoRoyal.exe - Trojan.OnlineGames-1726

info
MZ
PE
resources
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	SetupCasinoRoyal.exe
size	467997 (0x7241d)
md5	89c10738fb44f9a529092bfa3c15dcf9

type	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
mimetype	application/x-dosexec

clamav	Trojan.OnlineGames-1726 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
105	2067	1
15	3077	28
28	9178	1
93	2067	2
95	3077	161
25	9210	4
93	2179	11
1	0	213
42	8803	55
95	2179	22
96	3077	46
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x459cc7fb
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x37000
SizeOfInitializedData	0xda000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x23de3
BaseOfCode	0x1000
BaseOfData	0x38000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x125000
SizeOfHeaders	0x400
CheckSum	0x80912
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

PeCompact 2.xx (BitSum Technologies / v2.0)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x116000	0x64400	RWX CODE
.rsrc	0x117000	0xe000	0xda00	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x123b04	0x8f
RESOURCE	0x117000	0xcaca
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
CURSOR	#100	308	1252
BITMAP	IDO_AGREE-CH	2506	1252
BITMAP	IDO_AGREE-DE	2502	1252
BITMAP	IDO_AGREE-EN	2506	1252
BITMAP	IDO_AGREE-ES	2502	1252
BITMAP	IDO_AGREE-FR	2506	1252
BITMAP	IDO_AGREE-IT	2502	1252
BITMAP	IDO_AGREE-JA	2502	1252
BITMAP	IDO_AGREE-RU	2506	1252
BITMAP	IDO_AGREE_OVER-CH	2506	1252
BITMAP	IDO_AGREE_OVER-DE	2502	1252
BITMAP	IDO_AGREE_OVER-EN	2506	1252
BITMAP	IDO_AGREE_OVER-ES	2502	1252
BITMAP	IDO_AGREE_OVER-FR	2506	1252
BITMAP	IDO_AGREE_OVER-IT	2502	1252
BITMAP	IDO_AGREE_OVER-JA	2502	1252
BITMAP	IDO_AGREE_OVER-RU	2506	1252
BITMAP	IDO_BROWSE-CH	2506	1252
BITMAP	IDO_BROWSE-DE	2502	1252
BITMAP	IDO_BROWSE-EN	2506	1252
BITMAP	IDO_BROWSE-ES	2502	1252
BITMAP	IDO_BROWSE-FR	2506	1252
BITMAP	IDO_BROWSE-IT	2502	1252
BITMAP	IDO_BROWSE-JA	2502	1252
BITMAP	IDO_BROWSE-RU	2506	1252
BITMAP	IDO_BROWSE_OVER-CH	2506	1252
BITMAP	IDO_BROWSE_OVER-DE	2502	1252
BITMAP	IDO_BROWSE_OVER-EN	2506	1252
BITMAP	IDO_BROWSE_OVER-ES	2502	1252
BITMAP	IDO_BROWSE_OVER-FR	2506	1252
BITMAP	IDO_BROWSE_OVER-IT	2502	1252
BITMAP	IDO_BROWSE_OVER-JA	2502	1252
BITMAP	IDO_BROWSE_OVER-RU	2506	1252
BITMAP	IDO_CANCEL-CH	2506	1252
BITMAP	IDO_CANCEL-DE	2502	1252
BITMAP	IDO_CANCEL-EN	2506	1252
BITMAP	IDO_CANCEL-ES	2502	1252
BITMAP	IDO_CANCEL-FR	2506	1252
BITMAP	IDO_CANCEL-IT	2502	1252
BITMAP	IDO_CANCEL-JA	2502	1252
BITMAP	IDO_CANCEL-RU	2506	1252
BITMAP	IDO_CANCEL_OVER-CH	2506	1252
BITMAP	IDO_CANCEL_OVER-DE	2502	1252
BITMAP	IDO_CANCEL_OVER-EN	2506	1252
BITMAP	IDO_CANCEL_OVER-ES	2502	1252
BITMAP	IDO_CANCEL_OVER-FR	2506	1252
BITMAP	IDO_CANCEL_OVER-IT	2502	1252
BITMAP	IDO_CANCEL_OVER-JA	2502	1252
BITMAP	IDO_CANCEL_OVER-RU	2506	1252
BITMAP	IDO_CLOSE	1426	1252
BITMAP	IDO_CLOSE_OVER	1426	1252
BITMAP	IDO_CONTINUE-CH	2506	1252
BITMAP	IDO_CONTINUE-DE	2502	1252
BITMAP	IDO_CONTINUE-EN	2506	1252
BITMAP	IDO_CONTINUE-ES	2502	1252
BITMAP	IDO_CONTINUE-FR	2506	1252
BITMAP	IDO_CONTINUE-IT	2502	1252
BITMAP	IDO_CONTINUE-JA	2502	1252
BITMAP	IDO_CONTINUE-RU	2506	1252
BITMAP	IDO_CONTINUE_OVER-CH	2506	1252
BITMAP	IDO_CONTINUE_OVER-DE	2502	1252
BITMAP	IDO_CONTINUE_OVER-EN	2506	1252
BITMAP	IDO_CONTINUE_OVER-ES	2502	1252
BITMAP	IDO_CONTINUE_OVER-FR	2506	1252
BITMAP	IDO_CONTINUE_OVER-IT	2502	1252
BITMAP	IDO_CONTINUE_OVER-JA	2502	1252
BITMAP	IDO_CONTINUE_OVER-RU	2506	1252
BITMAP	IDO_DISAGREE-CH	2506	1252
BITMAP	IDO_DISAGREE-DE	2502	1252
BITMAP	IDO_DISAGREE-EN	2506	1252
BITMAP	IDO_DISAGREE-ES	2502	1252
BITMAP	IDO_DISAGREE-FR	2506	1252
BITMAP	IDO_DISAGREE-IT	2502	1252
BITMAP	IDO_DISAGREE-JA	2502	1252
BITMAP	IDO_DISAGREE-RU	2506	1252
BITMAP	IDO_DISAGREE_OVER-CH	2506	1252
BITMAP	IDO_DISAGREE_OVER-DE	2502	1252
BITMAP	IDO_DISAGREE_OVER-EN	2506	1252
BITMAP	IDO_DISAGREE_OVER-ES	2502	1252
BITMAP	IDO_DISAGREE_OVER-FR	2506	1252
BITMAP	IDO_DISAGREE_OVER-IT	2502	1252
BITMAP	IDO_DISAGREE_OVER-JA	2502	1252
BITMAP	IDO_DISAGREE_OVER-RU	2506	1252
BITMAP	IDO_INSTALL-CH	2506	1252
BITMAP	IDO_INSTALL-DE	2502	1252
BITMAP	IDO_INSTALL-EN	2506	1252
BITMAP	IDO_INSTALL-ES	2502	1252
BITMAP	IDO_INSTALL-FR	2506	1252
BITMAP	IDO_INSTALL-IT	2502	1252
BITMAP	IDO_INSTALL-JA	2502	1252
BITMAP	IDO_INSTALL-RU	2506	1252
BITMAP	IDO_INSTALL_OVER-CH	2506	1252
BITMAP	IDO_INSTALL_OVER-DE	2502	1252
BITMAP	IDO_INSTALL_OVER-EN	2506	1252
BITMAP	IDO_INSTALL_OVER-ES	2502	1252
BITMAP	IDO_INSTALL_OVER-FR	2506	1252
BITMAP	IDO_INSTALL_OVER-IT	2502	1252
BITMAP	IDO_INSTALL_OVER-JA	2502	1252
BITMAP	IDO_INSTALL_OVER-RU	2506	1252
BITMAP	IDO_LANG_CH	3266	1252
BITMAP	IDO_LANG_CH_OVER	2482	1252
BITMAP	IDO_LANG_DE	3266	1252
BITMAP	IDO_LANG_DE_OVER	3266	1252
BITMAP	IDO_LANG_EN	3266	1252
BITMAP	IDO_LANG_EN_OVER	3266	1252
BITMAP	IDO_LANG_ES	3266	1252
BITMAP	IDO_LANG_ES_OVER	3266	1252
BITMAP	IDO_LANG_FR	3266	1252
BITMAP	IDO_LANG_FR_OVER	2546	1252
BITMAP	IDO_LANG_IT	3266	1252
BITMAP	IDO_LANG_IT_OVER	3262	1252
BITMAP	IDO_LANG_JA	3266	1252
BITMAP	IDO_LANG_JA_OVER	3262	1252
BITMAP	IDO_LANG_RU	3266	1252
BITMAP	IDO_LANG_RU_OVER	2442	1252
BITMAP	IDO_MINIMIZE	1426	1252
BITMAP	IDO_MINIMIZE_OVER	1426	1252
BITMAP	IDO_PALETTE	1070	1252
BITMAP	IDO_PROGRESS	2830	1252
BITMAP	IDO_SKIN	80266	1252
ICON	#101	1384	1252
ICON	#102	2216	1252
RCDATA	IDO_ADV_TEXT_FONT	17	1252
RCDATA	IDO_ADV_TEXT_POS	14	1252
RCDATA	IDO_AGREE_POS	8	1252
RCDATA	IDO_BROWSE_POS	8	1252
RCDATA	IDO_CANCEL_POS	8	1252
RCDATA	IDO_CLOSE_POS	6	1252
RCDATA	IDO_CONTINUE_POS	8	1252
RCDATA	IDO_DESTDIR_FONT	17	1252
RCDATA	IDO_DESTDIR_POS	14	1252
RCDATA	IDO_DISAGREE_POS	8	1252
RCDATA	IDO_INSTALL_POS	8	1252
RCDATA	IDO_LANG_CH_POS	7	1252
RCDATA	IDO_LANG_DE_POS	6	1252
RCDATA	IDO_LANG_EN_POS	6	1252
RCDATA	IDO_LANG_ES_POS	8	1252
RCDATA	IDO_LANG_FR_POS	7	1252
RCDATA	IDO_LANG_IT_POS	8	1252
RCDATA	IDO_LANG_JA_POS	8	1252
RCDATA	IDO_LANG_RU_POS	7	1252
RCDATA	IDO_LICENSE_POS	13	1252
RCDATA	IDO_MINIMIZE_POS	6	1252
RCDATA	IDO_PROGRESS1_POS	7	1252
RCDATA	IDO_PROGRESS1_TEXT_FONT	17	1252
RCDATA	IDO_PROGRESS1_TEXT_POS	14	1252
RCDATA	IDO_PROGRESS2_POS	7	1252
RCDATA	IDS_ADV_ASKDIR-CH	68	1252
RCDATA	IDS_ADV_ASKDIR-DE	122	1252
RCDATA	IDS_ADV_ASKDIR-EN	85	1252
GROUP_ICON	IDI_CASINOSETUP	34	1252

module_name	hint	ord	function_name
kernel32.dll			LoadLibraryA
kernel32.dll			GetProcAddress
kernel32.dll			VirtualAlloc
kernel32.dll			VirtualFree

show previews

offset	size	type	comment
0	467456	EXE	01/04/2007 09:25:15	#
15c1	15	HTM		#
72200	541	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 467997 bytes (458 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x65da8

[?] can't find file_offset of VA 0x66778

[?] can't find file_offset of VA 0x66d10

[?] can't find file_offset of VA 0x672a8

[?] can't find file_offset of VA 0x67c78

[?] can't find file_offset of VA 0x68640

[?] can't find file_offset of VA 0x69010

[?] can't find file_offset of VA 0x699d8

[?] can't find file_offset of VA 0x6a3a8

[?] can't find file_offset of VA 0x6ad70

[?] can't find file_offset of VA 0x6b738

[?] can't find file_offset of VA 0x6c108

[?] can't find file_offset of VA 0x6cad8

[?] can't find file_offset of VA 0x6d4a0

[?] can't find file_offset of VA 0x6de70

[?] can't find file_offset of VA 0x6e838

[?] can't find file_offset of VA 0x6f208

[?] can't find file_offset of VA 0x6fbd0

[?] can't find file_offset of VA 0x70598

[?] can't find file_offset of VA 0x70f68

[?] can't find file_offset of VA 0x71938

[?] can't find file_offset of VA 0x72300

[?] can't find file_offset of VA 0x72cd0

[?] can't find file_offset of VA 0x73698

[?] can't find file_offset of VA 0x74068

[?] can't find file_offset of VA 0x74a30

[?] can't find file_offset of VA 0x753f8

[?] can't find file_offset of VA 0x75dc8

[?] can't find file_offset of VA 0x76798

[?] can't find file_offset of VA 0x77160

[?] can't find file_offset of VA 0x77b30

[?] can't find file_offset of VA 0x784f8

[?] can't find file_offset of VA 0x78ec8

[?] can't find file_offset of VA 0x79890

[?] can't find file_offset of VA 0x7a258

[?] can't find file_offset of VA 0x7ac28

[?] can't find file_offset of VA 0x7b5f8

[?] can't find file_offset of VA 0x7bfc0

[?] can't find file_offset of VA 0x7c990

[?] can't find file_offset of VA 0x7d358

[?] can't find file_offset of VA 0x7dd28

[?] can't find file_offset of VA 0x7e6f0

[?] can't find file_offset of VA 0x7f0b8

[?] can't find file_offset of VA 0x7fa88

[?] can't find file_offset of VA 0x80458

[?] can't find file_offset of VA 0x80e20

[?] can't find file_offset of VA 0x817f0

[?] can't find file_offset of VA 0x821b8

[?] can't find file_offset of VA 0x82b88

[?] can't find file_offset of VA 0x83550

[?] can't find file_offset of VA 0x83f18

[?] can't find file_offset of VA 0x848e8

[?] can't find file_offset of VA 0x855b0

[?] can't find file_offset of VA 0x85f68

[?] can't find file_offset of VA 0x86c30

[?] can't find file_offset of VA 0x878f8

[?] can't find file_offset of VA 0x885c0

[?] can't find file_offset of VA 0x89288

[?] can't find file_offset of VA 0x89f50

[?] can't find file_offset of VA 0x8ac18

[?] can't find file_offset of VA 0x8b8e0

[?] can't find file_offset of VA 0x8c2d8

[?] can't find file_offset of VA 0x8cfa0

[?] can't find file_offset of VA 0x8dc60

[?] can't find file_offset of VA 0x8e928

[?] can't find file_offset of VA 0x8f5e8

[?] can't find file_offset of VA 0x902b0

[?] can't find file_offset of VA 0x90c40

[?] can't find file_offset of VA 0x911d8

[?] can't find file_offset of VA 0x91770

[?] can't find file_offset of VA 0x91ba0

[?] can't find file_offset of VA 0x926b0

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0xa6040

[?] can't find file_offset of VA 0xa6058

[?] can't find file_offset of VA 0xa6068

[?] can't find file_offset of VA 0xa6070

[?] can't find file_offset of VA 0xa6078

[?] can't find file_offset of VA 0xa6080

[?] can't find file_offset of VA 0xa6088

[?] can't find file_offset of VA 0xa6090

[?] can't find file_offset of VA 0xa60a8

[?] can't find file_offset of VA 0xa60b8

[?] can't find file_offset of VA 0xa60c0

[?] can't find file_offset of VA 0xa60c8

[?] can't find file_offset of VA 0xa60d0

[?] can't find file_offset of VA 0xa60d8

[?] can't find file_offset of VA 0xa60e0

[?] can't find file_offset of VA 0xa60e8

[?] can't find file_offset of VA 0xa60f0

[?] can't find file_offset of VA 0xa60f8

[?] can't find file_offset of VA 0xa6100

[?] can't find file_offset of VA 0xa6108

[?] can't find file_offset of VA 0xa6118

[?] can't find file_offset of VA 0xa6120

[?] can't find file_offset of VA 0xa6128

[?] can't find file_offset of VA 0xa6140

[?] can't find file_offset of VA 0xa6150

[?] can't find file_offset of VA 0xa6158

[?] can't find file_offset of VA 0xa61a0

[?] can't find file_offset of VA 0xa6220

[?] can't find file_offset of VA 0xa6278

[?] too many errors getting resource data, stopped on 0 of 1

SetupCasinoRoyal.exe- Trojan.OnlineGames-1726