filenamehbc.exe
size86528 (0x15200)
md5f8f51015c2021d281de4727c5224ea67
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
10816811
1472991
481682
1064
19803413
0018
1181682
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x541865dd
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x5000
SizeOfInitializedData0x17e000
SizeOfUninitializedData0
AddressOfEntryPoint0x528c
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x184000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text�,0x10000x449e0x5000R-X CODE
.rdataO0x60000x8640x1000R-- IDATA
.dataS0x70000x17b3880x1000RW- IDATA
.rsrc{I0x1830000x8a00x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x615c0xdc
RESOURCE0x1830000x8a0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x60000x150
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#22960
ICON#32960
MENU#1091160
DIALOG#1032380
GROUP_ICON#107340
GROUP_ICON#108200
module_namehintordfunction_name
KERNEL32.dll2Heap32ListFirst
KERNEL32.dll4Heap32Next
KERNEL32.dll350GetSystemTimeAdjustment
KERNEL32.dll355GetTempFileNameA
KERNEL32.dll370GetUserDefaultLangID
KERNEL32.dll326GetProcessWorkingSetSize
KERNEL32.dll401GlobalUnWire
KERNEL32.dll341GetStringTypeExW
KERNEL32.dll388GlobalFindAtomA
KERNEL32.dll416HeapLock
KERNEL32.dll348GetSystemPowerStatus
KERNEL32.dll390GlobalFix
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll308GetPrivateProfileIntA
KERNEL32.dll382GetWindowsDirectoryW
KERNEL32.dll291GetMailslotInfo
KERNEL32.dll353GetTapePosition
KERNEL32.dll375GetVolumeInformationA
KERNEL32.dll349GetSystemTime
KERNEL32.dll300GetNumberFormatA
KERNEL32.dll319GetProcessAffinityMask
KERNEL32.dll323GetProcessShutdownParameters
KERNEL32.dll411HeapCreate
KERNEL32.dll294GetModuleHandleA
Msi.dll19
Msi.dll62
Msi.dll55
Msi.dll164
Msi.dll21
Msi.dll72
Msi.dll29
Msi.dll15
Msi.dll53
MPR.dll20WNetConnectionDialog1W
MPR.dll65WNetOpenEnumW
MPR.dll13WNetCancelConnection2W
MPR.dll24WNetDisconnectDialog
MPR.dll7WNetAddConnection2W
MPR.dll14WNetCancelConnectionA
MPR.dll44WNetGetLastErrorA
MPR.dll9WNetAddConnection3W
USER32.dll414LoadIconA
USER32.dll499RegisterClassExA
USER32.dll89CreateWindowExA
USER32.dll298GetMessageA
USER32.dll639TranslateAcceleratorA
USER32.dll642TranslateMessage
USER32.dll149DispatchMessageA
NDdeApi.dll606
NDdeApi.dll600
NDdeApi.dll605
NDdeApi.dll603
NDdeApi.dll502
NDdeApi.dll509
NETAPI32.dll163NetServerSetInfo
NETAPI32.dll82NetConnectionEnum
NETAPI32.dll172NetSessionDel
NETAPI32.dll162NetServerGetInfo
KERNEL32.dll2Heap32ListFirst
KERNEL32.dll4Heap32Next
KERNEL32.dll350GetSystemTimeAdjustment
KERNEL32.dll355GetTempFileNameA
KERNEL32.dll370GetUserDefaultLangID
KERNEL32.dll326GetProcessWorkingSetSize
KERNEL32.dll401GlobalUnWire
KERNEL32.dll341GetStringTypeExW
KERNEL32.dll388GlobalFindAtomA
KERNEL32.dll416HeapLock
KERNEL32.dll348GetSystemPowerStatus
KERNEL32.dll390GlobalFix
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll308GetPrivateProfileIntA
KERNEL32.dll382GetWindowsDirectoryW
KERNEL32.dll291GetMailslotInfo
KERNEL32.dll353GetTapePosition
KERNEL32.dll375GetVolumeInformationA
KERNEL32.dll349GetSystemTime
KERNEL32.dll300GetNumberFormatA
KERNEL32.dll319GetProcessAffinityMask
KERNEL32.dll323GetProcessShutdownParameters
KERNEL32.dll411HeapCreate
KERNEL32.dll294GetModuleHandleA
MSIMG32.dll3TransparentBlt
MSVCRT.dll143_acmdln
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll183_controlfp
MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll131__setusermatherr
LZ32.dll10LZSeek
offsetsizetypecomment
036864EXE09/16/2014 16:31:25#
15c115HTM#
900049664BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 86528 bytes (85 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK