filenamedrobz.exe
size617984 (0x96e00)
md50446bf62bd5dfad99e95050445739180
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
152201151
1584021937
17040219128
131307294
1473072923
10254
1714021983
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5213b388
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x24a00
SizeOfInitializedData0x72000
SizeOfUninitializedData0
AddressOfEntryPoint0x17a5b
BaseOfCode0x1000
BaseOfData0x26000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0xc3000
SizeOfHeaders0x400
CheckSum0xa2660
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x249ae0x24a00R-X CODE
.rdata0x260000xa5820xa600R-- IDATA
.data0x310000x2aa480x1e00RW- IDATA
.rsrc0x5c0000x618800x61a00R-- IDATA
.reloc0xbe0000x41680x4200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2f17c0xf0
RESOURCE0x5c0000x61880
EXCEPTION00
SECURITY00
BASERELOC0xbe0000x229c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x2c7100x40
Bound_IAT00
IAT0x260000x398
Delay_IAT00
CLR_Header00
typenamesizecp
GIF#103234791252
GIF#104141711252
GIF#106300761252
BITMAP#107369061252
BITMAP#108369061252
BITMAP#109369041252
BITMAP#110369041252
BITMAP#111369041252
BITMAP#112369041252
BITMAP#117164241252
BITMAP#120164241252
BITMAP#121164241252
ICON#122161252
ICON#213841252
ICON#3169361252
ICON#496401252
ICON#542641252
ICON#611281252
ICON#722161252
ICON#813841252
ICON#996401252
ICON#1042641252
ICON#1111281252
DIALOG#1014361252
DIALOG#11813621252
DIALOG#12314601252
STRING#85461252
GROUP_ICON#102901252
GROUP_ICON#122761252
VERSION#18281252
MANIFEST#13461252
idlangstring
1131049Start drawing with the mouse
1141049Stop action with the mouse
1151049Program settings
1161049Mouse clicks create water drobz on your desktop
1171049Mouse clicks cast magic stars over your windows
1181049Play settings
1191049Hide Drobz to tray
1201049Show Drobz on desktop
1211049Start play Drobz
1221049Stop play Drobz
1231049Exit Drobz
module_namehintordfunction_name
KERNEL32.dll581GetProcAddress
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll1322WritePrivateProfileStringA
KERNEL32.dll1324WritePrivateProfileStructA
KERNEL32.dll579GetPrivateProfileStructA
KERNEL32.dll577GetPrivateProfileStringA
KERNEL32.dll573GetPrivateProfileSectionA
KERNEL32.dll574GetPrivateProfileSectionNamesA
KERNEL32.dll896OpenProcess
KERNEL32.dll627GetSystemInfo
KERNEL32.dll1156SetProcessWorkingSetSize
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll143CreateFileW
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll1159SetStdHandle
KERNEL32.dll722HeapReAlloc
KERNEL32.dll1126SetFilePointer
KERNEL32.dll831LoadLibraryW
KERNEL32.dll617GetStringTypeW
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll717HeapCreate
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll499GetFileType
KERNEL32.dll1135SetHandleCount
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll813LCMapStringW
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll428GetConsoleMode
KERNEL32.dll410GetConsoleCP
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll281ExitProcess
KERNEL32.dll724HeapSize
KERNEL32.dll1202Sleep
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll612GetStdHandle
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll1216TerminateProcess
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1139SetLastError
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll1222TlsFree
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll778IsValidCodePage
KERNEL32.dll567GetOEMCP
KERNEL32.dll360GetACP
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll370GetCPInfo
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll723HeapSetInformation
KERNEL32.dll390GetCommandLineA
KERNEL32.dll945RaiseException
KERNEL32.dll234EncodePointer
KERNEL32.dll202DecodePointer
KERNEL32.dll1048RtlUnwind
KERNEL32.dll331FindResourceA
KERNEL32.dll833LoadResource
KERNEL32.dll1201SizeofResource
KERNEL32.dll852LockResource
KERNEL32.dll357FreeResource
KERNEL32.dll659GetTickCount
KERNEL32.dll586GetProcessHeap
KERNEL32.dll715HeapAlloc
KERNEL32.dll719HeapFree
KERNEL32.dll1354lstrcpynA
KERNEL32.dll691GlobalAlloc
KERNEL32.dll702GlobalLock
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll709GlobalUnlock
KERNEL32.dll698GlobalFree
KERNEL32.dll514GetLastError
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll1317WriteFile
KERNEL32.dll82CloseHandle
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1149SetPriorityClass
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll211DeleteFileA
USER32.dll420GetWindowThreadProcessId
USER32.dll709SetWindowPlacement
USER32.dll417GetWindowTextLengthA
USER32.dll416GetWindowTextA
USER32.dll505LoadStringA
USER32.dll382GetSystemMetrics
USER32.dll439InsertMenuA
USER32.dll158DeleteMenu
USER32.dll107CreatePopupMenu
USER32.dll106CreateMenu
USER32.dll379GetSysColor
USER32.dll195DrawEdge
USER32.dll200DrawIconEx
USER32.dll205DrawTextA
USER32.dll549OffsetRect
USER32.dll220EndPaint
USER32.dll14BeginPaint
USER32.dll785UpdateWindow
USER32.dll252FlashWindowEx
USER32.dll616RemovePropA
USER32.dll567PostQuitMessage
USER32.dll166DestroyWindow
USER32.dll818wsprintfA
USER32.dll526MessageBoxA
USER32.dll610RegisterWindowMessageA
USER32.dll588RegisterClassExA
USER32.dll488LoadCursorA
USER32.dll246FillRect
USER32.dll757TrackMouseEvent
USER32.dll264GetCapture
USER32.dll155DefWindowProcA
USER32.dll362GetPropA
USER32.dll684SetPropA
USER32.dll707SetWindowLongA
USER32.dll718SetWindowsHookExA
USER32.dll768UnhookWindowsHookEx
USER32.dll747SystemParametersInfoA
USER32.dll612ReleaseCapture
USER32.dll640SetCapture
USER32.dll317GetKeyState
USER32.dll576PtInRect
USER32.dll486LoadBitmapA
USER32.dll686SetRect
USER32.dll85CopyRect
USER32.dll273GetClassNameA
USER32.dll300GetFocus
USER32.dll216EnableWindow
USER32.dll289GetDC
USER32.dll782UpdateLayeredWindow
USER32.dll613ReleaseDC
USER32.dll28CallNextHookEx
USER32.dll446InvalidateRect
USER32.dll658SetFocus
USER32.dll462IsDlgButtonChecked
USER32.dll758TrackPopupMenu
USER32.dll62CheckDlgButton
USER32.dll565PostMessageA
USER32.dll494LoadImageA
USER32.dll710SetWindowPos
USER32.dll398GetWindow
USER32.dll621ScreenToClient
USER32.dll301GetForegroundWindow
USER32.dll480IsWindowVisible
USER32.dll735ShowWindow
USER32.dll659SetForegroundWindow
USER32.dll411GetWindowPlacement
USER32.dll288GetCursorPos
USER32.dll759TrackPopupMenuEx
USER32.dll164DestroyMenu
USER32.dll163DestroyIcon
USER32.dll345GetMessageA
USER32.dll764TranslateMessage
USER32.dll460IsDialogMessageA
USER32.dll174DispatchMessageA
USER32.dll699SetTimer
USER32.dll483KillTimer
USER32.dll412GetWindowRect
USER32.dll295GetDlgItem
USER32.dll405GetWindowLongA
USER32.dll171DialogBoxParamA
USER32.dll168DialogBoxIndirectParamA
USER32.dll98CreateDialogParamA
USER32.dll95CreateDialogIndirectParamA
USER32.dll356GetParent
USER32.dll218EndDialog
USER32.dll475IsWindow
USER32.dll276GetClientRect
USER32.dll29CallWindowProcA
USER32.dll109CreateWindowExA
USER32.dll631SendMessageA
USER32.dll291GetDesktopWindow
GDI32.dll311ExtTextOutA
GDI32.dll536GetTextColor
GDI32.dll639SetBkMode
GDI32.dll678SetTextColor
GDI32.dll638SetBkColor
GDI32.dll61CreateFontIndirectA
GDI32.dll84CreateSolidBrush
GDI32.dll507GetObjectA
GDI32.dll649SetDIBitsToDevice
GDI32.dll19BitBlt
GDI32.dll458GetDIBits
GDI32.dll48CreateCompatibleDC
GDI32.dll47CreateCompatibleBitmap
GDI32.dll459GetDeviceCaps
GDI32.dll227DeleteDC
GDI32.dll425GetBkColor
GDI32.dll631SelectObject
GDI32.dll230DeleteObject
COMDLG32.dllChooseColorA
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll590RegEnumKeyExA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll583RegDeleteValueA
SHELL32.dll300Shell_NotifyIconA
SHELL32.dll191SHGetFolderPathA
ole32.dll16CoCreateInstance
ole32.dll108CoUninitialize
ole32.dll134CreateStreamOnHGlobal
ole32.dll62CoInitialize
OLEAUT32.dll418
COMCTL32.dll6
VERSION.dll3GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dll13VerQueryValueA
SHLWAPI.dll68PathFileExistsA
SHLWAPI.dll47PathAddBackslashA
SHLWAPI.dll178SHDeleteKeyA

StringTable 040904b0

CommentsDecoration for Windows desktop, Water drops etc.
CompanyNameDecortop
FileDescriptionDrobz Desktop Decoration
FileVersion1.0.0.2
InternalNameDrobz
LegalCopyrightCopyright © 2013 Decortop
OriginalFilenameDrobz.exe
ProductName Drobz
ProductVersion1.0.0.2

VS_FIXEDFILEINFO

FileVersion1.0.0.2
ProductVersion1.0.0.2
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0617984EXE08/20/2013 18:20:56#
15c115HTM#
318a81600GIF(256 x 256)#
3746014171GIF(256 x 256)#
3abbc3925GIF(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK