filenameMediathek GmbH Media Hein Daddeldoo 06.05.2014.zip
size95769 (0x17619)
md502c05a8e998dd1801a2273a9c787fcee
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
9340358
1472991
1180472
10804711
480472
1197823
497823
10272
11816810
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5367dfc5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x5000
SizeOfInitializedData0x5000
SizeOfUninitializedData0
AddressOfEntryPoint0x4794
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0xee00
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x40c00x5000R-X CODE
.rdata0x60000x1ba80x2000R-- IDATA
.data0x80000xf480x1000RW- IDATA
.rsrc0x90000x14300x2000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x74680x8c
RESOURCE0x90000x1430
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x60000x458
Delay_IAT00
CLR_Header00
typenamesizecp
MENU#1283020
DIALOG#1002140
DIALOG#1301940
DIALOG#1332540
STRING#91320
STRING#3585500
STRING#36012300
STRING#36021920
STRING#36033100
STRING#3604600
STRING#3605960
STRING#3606840
STRING#3697580
STRING#38251640
STRING#3826620
STRING#3841580
ACCELERATORS#1281120
VERSION#17920
#241#128140
idlangstring
1282052cluster Cluste Cluster.Document Cluste Document
573442052cluster
573452052就绪
576002052建立新文档 新建
576012052打开一个现有文档 打开
576022052关闭活动文档 关闭
576032052保存活动文档 保存
576042052将活动文档以一个新文件名保存 另存为
576052052改变打印选项 页面设置
576062052改变打印机及打印选项 打印设置
576072052打印活动文档 打印
576092052显示整页 打印预览
576162052打开该文档
576172052打开该文档
576182052打开该文档
576192052打开该文档
576202052打开该文档
576212052打开该文档
576222052打开该文档
576232052打开该文档
576242052打开该文档
576252052打开该文档
576262052打开该文档
576272052打开该文档
576282052打开该文档
576292052打开该文档
576302052打开该文档
576312052打开该文档
576322052删除被选对象 删陪
576332052全部删除 全部删除
576342052复制被选对象并将其置于剪贴板上 复制
576352052剪切被选对象并将其置于剪贴板上 剪切
576362052查找指定的正文 查找
576372052插入剪贴板内容 粘贴
576402052重复上一步操作 重复
576412052用不同的正文替换指定的正文 替换
576422052选择整个文档 选择全部
576432052撤消最后一步操作 撤消
576442052重新执行先前已撤消的操作 重新执行
576532052将活动的窗口分隔成窗格 分隔
576642052显示程序信息，版本号和版权 关于
576652052退出应用程序；提示保存文档 退出
576802052切换到下一个窗格 下一窗格
576812052切换回前一个窗格 前一窗格
591362052扩展名
591372052大写
591382052数字
591392052滚动
591402052改写
591412052记录
611842052改变窗口大小
611852052改变窗口位置
611862052将窗口缩小成图标
611872052把窗口放大到最大尺寸
611882052切换到下一个文档窗口
611892052切换到先前的文档窗口
611902052关闭活动的窗口并提示保存所有文档
612022052把窗口恢复到正常大小
612032052激活任务表
614452052关闭打印预览模式 取消预阅
module_namehintordfunction_name
MFC42.DLL3922
MFC42.DLL1089
MFC42.DLL5199
MFC42.DLL2396
MFC42.DLL3346
MFC42.DLL5300
MFC42.DLL5302
MFC42.DLL2725
MFC42.DLL4079
MFC42.DLL4698
MFC42.DLL5307
MFC42.DLL5289
MFC42.DLL5714
MFC42.DLL2982
MFC42.DLL3147
MFC42.DLL3259
MFC42.DLL4465
MFC42.DLL3136
MFC42.DLL3262
MFC42.DLL2985
MFC42.DLL3081
MFC42.DLL2976
MFC42.DLL3830
MFC42.DLL3831
MFC42.DLL3825
MFC42.DLL3079
MFC42.DLL4080
MFC42.DLL4622
MFC42.DLL4424
MFC42.DLL3738
MFC42.DLL561
MFC42.DLL825
MFC42.DLL815
MFC42.DLL6215
MFC42.DLL617
MFC42.DLL5301
MFC42.DLL5214
MFC42.DLL296
MFC42.DLL986
MFC42.DLL520
MFC42.DLL823
MFC42.DLL4159
MFC42.DLL6117
MFC42.DLL2621
MFC42.DLL1134
MFC42.DLL5265
MFC42.DLL4376
MFC42.DLL4853
MFC42.DLL4998
MFC42.DLL4710
MFC42.DLL2514
MFC42.DLL6052
MFC42.DLL4078
MFC42.DLL1775
MFC42.DLL4407
MFC42.DLL5241
MFC42.DLL2385
MFC42.DLL5163
MFC42.DLL6374
MFC42.DLL4353
MFC42.DLL5280
MFC42.DLL3798
MFC42.DLL4837
MFC42.DLL4441
MFC42.DLL2648
MFC42.DLL2055
MFC42.DLL6376
MFC42.DLL3749
MFC42.DLL5065
MFC42.DLL1727
MFC42.DLL5261
MFC42.DLL2446
MFC42.DLL2124
MFC42.DLL5277
MFC42.DLL4627
MFC42.DLL4425
MFC42.DLL3597
MFC42.DLL324
MFC42.DLL641
MFC42.DLL4234
MFC42.DLL1825
MFC42.DLL4238
MFC42.DLL4696
MFC42.DLL3058
MFC42.DLL3065
MFC42.DLL6336
MFC42.DLL2510
MFC42.DLL2542
MFC42.DLL5243
MFC42.DLL5740
MFC42.DLL1746
MFC42.DLL5577
MFC42.DLL3172
MFC42.DLL5653
MFC42.DLL4420
MFC42.DLL4953
MFC42.DLL4858
MFC42.DLL2399
MFC42.DLL4387
MFC42.DLL3454
MFC42.DLL3198
MFC42.DLL6080
MFC42.DLL6175
MFC42.DLL4623
MFC42.DLL4426
MFC42.DLL338
MFC42.DLL652
MFC42.DLL4823
MFC42.DLL4614
MFC42.DLL4613
MFC42.DLL5731
MFC42.DLL4273
MFC42.DLL4589
MFC42.DLL4899
MFC42.DLL5076
MFC42.DLL4341
MFC42.DLL4349
MFC42.DLL4723
MFC42.DLL4890
MFC42.DLL4531
MFC42.DLL4545
MFC42.DLL4543
MFC42.DLL4526
MFC42.DLL4529
MFC42.DLL4524
MFC42.DLL4964
MFC42.DLL4961
MFC42.DLL4108
MFC42.DLL6055
MFC42.DLL1776
MFC42.DLL5240
MFC42.DLL5290
MFC42.DLL3748
MFC42.DLL1726
MFC42.DLL4432
MFC42.DLL623
MFC42.DLL813
MFC42.DLL540
MFC42.DLL304
MFC42.DLL560
MFC42.DLL800
MFC42.DLL5260
MFC42.DLL3693
MFC42.DLL3626
MFC42.DLL3663
MFC42.DLL668
MFC42.DLL613
MFC42.DLL629
MFC42.DLL1975
MFC42.DLL2414
MFC42.DLL4295
MFC42.DLL1641
MFC42.DLL4061
MFC42.DLL310
MFC42.DLL1770
MFC42.DLL1572
MFC42.DLL1980
MFC42.DLL2770
MFC42.DLL537
MFC42.DLL4133
MFC42.DLL4297
MFC42.DLL289
MFC42.DLL356
MFC42.DLL924
MFC42.DLL926
MFC42.DLL6172
MFC42.DLL5788
MFC42.DLL858
MFC42.DLL4129
MFC42.DLL5683
MFC42.DLL5572
MFC42.DLL2919
MFC42.DLL2535
MFC42.DLL2716
MFC42.DLL2379
MFC42.DLL1168
MFC42.DLL472
MFC42.DLL1973
MFC42.DLL922
MFC42.DLL5174
MFC42.DLL2294
MFC42.DLL2362
MFC42.DLL1842
MFC42.DLL4242
MFC42.DLL2723
MFC42.DLL2390
MFC42.DLL3059
MFC42.DLL5100
MFC42.DLL5103
MFC42.DLL4467
MFC42.DLL4303
MFC42.DLL3350
MFC42.DLL5012
MFC42.DLL975
MFC42.DLL5472
MFC42.DLL3403
MFC42.DLL2879
MFC42.DLL2878
MFC42.DLL4151
MFC42.DLL4077
MFC42.DLL5237
MFC42.DLL5282
MFC42.DLL2649
MFC42.DLL1665
MFC42.DLL4436
MFC42.DLL4427
MFC42.DLL796
MFC42.DLL674
MFC42.DLL554
MFC42.DLL529
MFC42.DLL366
MFC42.DLL807
MFC42.DLL2494
MFC42.DLL2627
MFC42.DLL2626
MFC42.DLL6000
MFC42.DLL2117
MFC42.DLL4163
MFC42.DLL6625
MFC42.DLL4457
MFC42.DLL5252
MFC42.DLL2512
MFC42.DLL2554
MFC42.DLL4486
MFC42.DLL6375
MFC42.DLL4274
MFC42.DLL4610
MFC42.DLL4612
MFC42.DLL1945
MFC42.DLL4615
MFC42.DLL1576
MSVCRT.dll610fseek
MSVCRT.dll515_wfopen
MSVCRT.dll735wcscat
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll46void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCRT.dll183_controlfp
MSVCRT.dll682rewind
MSVCRT.dll605fread
MSVCRT.dll588fclose
MSVCRT.dll585exit
MSVCRT.dll241_ftol
MSVCRT.dll426_setmbcp
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll678rand
MSVCRT.dll692srand
MSVCRT.dll720time
MSVCRT.dll612ftell
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll382GetModuleFileNameW
USER32.dll196EnableWindow
USER32.dll589SetCursor
USER32.dll700UpdateWindow
USER32.dll442LoadCursorA
GDI32.dll502Rectangle
GDI32.dll71CreatePen
GDI32.dll148Ellipse
OLEAUT32.dll9

StringTable 081004b0

Comments
CompanyName
FileDescriptioncluster
FileVersion1, 0, 0, 1
InternalNamecluster
LegalCopyrightCopyright ? 2014
LegalTrademarks
OriginalFilenamecluster.exe
PrivateBuild
ProductName cluster
ProductVersion1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
045056EXE05/05/2014 19:00:21#
15c115HTM#
b00050713BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 95769 bytes (94 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x507518