uTorrent_v3.2.3_DHT.exe - uTorrent.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	uTorrent_v3.2.3_DHT.exe
size	823808 (0xc9200)
md5	98752627789465f249803a2fa2342372

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x128

DOS stub

00000000: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000e0: 00 00 00 00 00 00 00 00                           |........        |

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x50c122c9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xae000
SizeOfInitializedData	0x1c000
SizeOfUninitializedData	0x486000
AddressOfEntryPoint	0x533e10
BaseOfCode	0x487000
BaseOfData	0x535000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x551000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x2dc6c0
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v3.0 (EXE_LZMA) (Markus Oberhumer & Laszlo Molnar & John Reiser)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x486000	0	RWX UDATA
UPX1	0x487000	0xae000	0xada00	RWX IDATA
.rsrc	0x535000	0x1c000	0x1b400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x550054	0x368
RESOURCE	0x535000	0x1b054
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x5503bc	0xc
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
GIF	SPINNER	3208
PNG	#18	577
PNG	#19	995
PNG	#20	475
PNG	#21	1082
BITMAP	#11	16936
BITMAP	#267	2090
BITMAP	#1706	658
ICON	#1	4264
ICON	#2	2216
ICON	#3	3790
ICON	#4	9640
ICON	#5	9640
ICON	#6	9640
ICON	#7	9640
ICON	#8	9640
ICON	#9	9640
ICON	#10	9640
ICON	#11	4264
ICON	#12	18280
ICON	#13	18280
ICON	#14	2216
ICON	#15	2216
ICON	#16	2216
ICON	#17	1512
ICON	#18	36200
ICON	#19	9640
ICON	#20	9640
ICON	#21	3240
ICON	#22	3240
ICON	#23	3240
ICON	#24	8136
ICON	#25	9640
ICON	#26	9832
ICON	#27	1128
ICON	#28	4264
ICON	#29	9640
ICON	#30	16936
ICON	#31	67624
ICON	#32	2216
ICON	#33	1384
ICON	#34	296
ICON	#35	2216
ICON	#36	2216
ICON	#37	1128
ICON	#38	1128
ICON	#39	1128
DIALOG	#3	188
DIALOG	#10	114
DIALOG	#11	120
DIALOG	#12	120
DIALOG	#13	120
DIALOG	#14	226
DIALOG	#15	120
DIALOG	#16	120
DIALOG	#18	64
DIALOG	#19	252
DIALOG	#20	860
DIALOG	#21	864
DIALOG	#22	896
DIALOG	#24	576
DIALOG	#25	356
DIALOG	#26	704
DIALOG	#27	408
DIALOG	#29	384
DIALOG	#30	128
DIALOG	#31	800
DIALOG	#32	256
DIALOG	#34	192
DIALOG	#35	96
DIALOG	#37	188
DIALOG	#41	1080
DIALOG	#42	768
DIALOG	#43	320
DIALOG	#44	800
DIALOG	#45	608
DIALOG	#46	1648
DIALOG	#47	480
DIALOG	#48	128
DIALOG	#49	458
DIALOG	#50	96
DIALOG	#51	460
DIALOG	#52	320
DIALOG	#231	152
DIALOG	#232	952
DIALOG	#233	416
DIALOG	#234	704
DIALOG	#235	544
DIALOG	#236	372
DIALOG	#237	96
DIALOG	#238	288
DIALOG	#240	160
DIALOG	#242	352
DIALOG	#243	736
DIALOG	#244	500
DIALOG	#245	192
DIALOG	#246	320
DIALOG	#248	1320
DIALOG	#249	224
DIALOG	#252	192
DIALOG	#253	580
DIALOG	#254	224
DIALOG	#255	224
DIALOG	#257	320
DIALOG	#259	592
DIALOG	#269	224
DIALOG	#270	352
DIALOG	#272	288
DIALOG	#273	184
DIALOG	#274	184
DIALOG	#277	96
DIALOG	#278	128
DIALOG	#279	64
DIALOG	#280	376
DIALOG	#288	160
DIALOG	#289	624
DIALOG	#290	224
DIALOG	#308	64
DIALOG	#309	152
DIALOG	#310	204
DIALOG	#311	96
DIALOG	#313	64
DIALOG	#316	352
DIALOG	#329	192
DIALOG	#338	184
DIALOG	#339	344
DIALOG	#341	64
DIALOG	#342	328
DIALOG	#343	196
DIALOG	#344	64
DIALOG	#345	604
DIALOG	#1048	64
DIALOG	#1175	96
DIALOG	#1496	64
DIALOG	#1512	340
DIALOG	#1516	288
DIALOG	#1517	344
DIALOG	#1574	96
DIALOG	#1575	64
DIALOG	#1630	256
DIALOG	#1649	204
RCDATA	#14	11107
RCDATA	#16	9553
RCDATA	#17	9864
GROUP_ICON	#2	76
GROUP_ICON	#5	20
GROUP_ICON	#244	20
GROUP_ICON	#248	20
GROUP_ICON	#249	20
GROUP_ICON	#250	20
GROUP_ICON	#252	20
GROUP_ICON	#253	20
GROUP_ICON	#256	20
GROUP_ICON	#276	20
GROUP_ICON	#300	20
GROUP_ICON	#301	20
GROUP_ICON	#302	20
GROUP_ICON	#303	20
GROUP_ICON	#304	20
GROUP_ICON	#305	20
GROUP_ICON	#306	20
GROUP_ICON	#307	20
GROUP_ICON	#310	20
GROUP_ICON	#317	20
GROUP_ICON	#320	20
GROUP_ICON	#321	20
GROUP_ICON	#322	20
GROUP_ICON	#323	20
GROUP_ICON	#325	20
GROUP_ICON	#328	20
GROUP_ICON	#331	20
GROUP_ICON	#332	20
GROUP_ICON	#333	20
GROUP_ICON	#334	20
GROUP_ICON	#336	20
GROUP_ICON	#337	20
GROUP_ICON	#339	20
GROUP_ICON	#340	20
GROUP_ICON	#1619	20
VERSION	#1	768
MANIFEST	#1	1254

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		VirtualFree
KERNEL32.DLL		ExitProcess
ADVAPI32.dll		FreeSid
COMCTL32.dll	17
comdlg32.dll		GetSaveFileNameW
GDI32.dll		SaveDC
gdiplus.dll		GdipCreateFont
MSIMG32.dll		GradientFill
MSVCRT.dll		atof
ole32.dll		OleCreate
OLEAUT32.dll	6
PSAPI.DLL		GetProcessMemoryInfo
SETUPAPI.dll		SetupDiGetClassDevsW
SHELL32.dll		DragFinish
USER32.dll		GetDC
WS2_32.dll	112

StringTable 040904E4

CompanyName	BitTorrent, Inc.
FileDescription	µTorrent
FileVersion	3.2.3.28705
InternalName	uTorrent.exe
OriginalFilename	uTorrent.exe
LegalCopyright	©2012 BitTorrent, Inc. All Rights Reserved.
ProductName	µTorrent
ProductVersion	3.2.3.28705

VS_FIXEDFILEINFO

FileVersion	3.2.3.28705
ProductVersion	3.2.3.28705
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	0
FileType	0
FileSubtype	0

show previews

offset	size	type	comment
0	823808	EXE	12/06/2012 22:57:13	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] refusing to read ICODIRENTRY beyond resource size

uTorrent_v3.2.3_DHT.exe- uTorrent.exe - µTorrent