PaxGal.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	PaxGal.exe
size	1061206 (0x103156)
md5	056c8eb1e4c952ae65e296e4b072c4e2

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0x6a8d000000000000
oem_id	0xe
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xb
TimeDateStamp	0x469abbc5
PointerToSymbolTable	0xc5e00
NumberOfSymbols	0x105f
SizeOfOptionalHeader	0xe0
Characteristics	0x107
Magic	0x10b
LinkerVersion	83.82
SizeOfCode	0x3d000
SizeOfInitializedData	0x78000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3cf000
BaseOfCode	0x39f000
BaseOfData	0x3df000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x46f000
SizeOfHeaders	0x1000
CheckSum	0x1032ca
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Armadillo v4.x

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x88c0c	0	R-X CODE IDATA
.data	0x8a000	0x3a80	0	RW- IDATA
.rdata	0x8e000	0x7dc0	0	R-- IDATA
.bss	0x96000	0x2d5f60	0	RW- UDATA
.idata	0x36c000	0x1334	0	RW- IDATA
.stab	0x36e000	0x77ac	0x8000	R-- DISCARDABLE
.stabstr	0x376000	0x28528	0x29000	R-- DISCARDABLE
.text1	0x39f000	0x30000	0x30000	RWX CODE
.adata	0x3cf000	0x10000	0xd000	RWX CODE
.data1	0x3df000	0x20000	0x9000	RW- IDATA
.pdata	0x3ff000	0x70000	0x6f000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3e72fc	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x3df000	0x260
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	365	GetTickCount
KERNEL32.dll	383	GlobalAddAtomA
KERNEL32.dll	294	GetModuleHandleA
KERNEL32.dll	392	GlobalFree
KERNEL32.dll	387	GlobalDeleteAtom
KERNEL32.dll	393	GlobalGetAtomNameA
KERNEL32.dll	177	FreeConsole
KERNEL32.dll	265	GetEnvironmentVariableA
KERNEL32.dll	707	VirtualProtect
KERNEL32.dll	699	VirtualAlloc
KERNEL32.dll	318	GetProcAddress
KERNEL32.dll	282	GetLastError
KERNEL32.dll	450	LoadLibraryA
KERNEL32.dll	625	SetLastError
KERNEL32.dll	373	GetVersionExA
KERNEL32.dll	647	SetThreadPriority
KERNEL32.dll	249	GetCurrentThread
KERNEL32.dll	68	CreateProcessA
KERNEL32.dll	202	GetCommandLineA
KERNEL32.dll	336	GetStartupInfoA
KERNEL32.dll	610	SetEnvironmentVariableA
KERNEL32.dll	549	ReleaseMutex
KERNEL32.dll	718	WaitForSingleObject
KERNEL32.dll	63	CreateMutexA
KERNEL32.dll	493	OpenMutexA
KERNEL32.dll	250	GetCurrentThreadId
KERNEL32.dll	27	CloseHandle
KERNEL32.dll	536	ReadFile
KERNEL32.dll	274	GetFileSize
KERNEL32.dll	52	CreateFileA
KERNEL32.dll	711	VirtualQueryEx
KERNEL32.dll	144	FindClose
KERNEL32.dll	148	FindFirstFileA
KERNEL32.dll	151	FindFirstFileW
KERNEL32.dll	293	GetModuleFileNameW
KERNEL32.dll	267	GetExitCodeProcess
KERNEL32.dll	540	ReadProcessMemory
KERNEL32.dll	37	ContinueDebugEvent
KERNEL32.dll	643	SetThreadContext
KERNEL32.dll	359	GetThreadContext
KERNEL32.dll	715	WaitForDebugEvent
KERNEL32.dll	664	SuspendThread
KERNEL32.dll	80	DebugActiveProcess
KERNEL32.dll	556	ResumeThread
KERNEL32.dll	69	CreateProcessW
KERNEL32.dll	385	GlobalAlloc
KERNEL32.dll	337	GetStartupInfoW
KERNEL32.dll	470	MapViewOfFile
KERNEL32.dll	99	DuplicateHandle
KERNEL32.dll	247	GetCurrentProcess
KERNEL32.dll	53	CreateFileMappingA
KERNEL32.dll	708	VirtualProtectEx
KERNEL32.dll	745	WriteProcessMemory
KERNEL32.dll	125	ExitProcess
KERNEL32.dll	33	CompareStringA
KERNEL32.dll	170	FlushFileBuffers
KERNEL32.dll	448	LCMapStringW
KERNEL32.dll	447	LCMapStringA
KERNEL32.dll	636	SetStdHandle
KERNEL32.dll	305	GetOEMCP
KERNEL32.dll	185	GetACP
KERNEL32.dll	191	GetCPInfo
KERNEL32.dll	342	GetStringTypeW
KERNEL32.dll	339	GetStringTypeA
KERNEL32.dll	34	CompareStringW
KERNEL32.dll	484	MultiByteToWideChar
KERNEL32.dll	618	SetFilePointer
KERNEL32.dll	418	HeapReAlloc
KERNEL32.dll	735	WriteFile
KERNEL32.dll	703	VirtualFree
KERNEL32.dll	411	HeapCreate
KERNEL32.dll	413	HeapDestroy
KERNEL32.dll	277	GetFileType
KERNEL32.dll	338	GetStdHandle
KERNEL32.dll	621	SetHandleCount
KERNEL32.dll	264	GetEnvironmentStringsW
KERNEL32.dll	262	GetEnvironmentStrings
KERNEL32.dll	722	WideCharToMultiByte
KERNEL32.dll	179	FreeEnvironmentStringsW
KERNEL32.dll	178	FreeEnvironmentStringsA
KERNEL32.dll	685	UnhandledExceptionFilter
KERNEL32.dll	415	HeapFree
KERNEL32.dll	409	HeapAlloc
KERNEL32.dll	372	GetVersion
KERNEL32.dll	283	GetLocalTime
KERNEL32.dll	349	GetSystemTime
KERNEL32.dll	368	GetTimeZoneInformation
KERNEL32.dll	559	RtlUnwind
KERNEL32.dll	670	TerminateProcess
KERNEL32.dll	396	GlobalLock
KERNEL32.dll	403	GlobalUnlock
KERNEL32.dll	74	CreateThread
KERNEL32.dll	662	Sleep
KERNEL32.dll	102	EnterCriticalSection
KERNEL32.dll	449	LeaveCriticalSection
KERNEL32.dll	426	InitializeCriticalSection
KERNEL32.dll	248	GetCurrentProcessId
KERNEL32.dll	292	GetModuleFileNameA
KERNEL32.dll	203	GetCommandLineW
KERNEL32.dll	334	GetShortPathNameA
USER32.dll	255	GetDesktopWindow
USER32.dll	457	MoveWindow
USER32.dll	578	SetPropA
USER32.dll	205	EnumThreadWindows
USER32.dll	314	GetPropA
USER32.dll	298	GetMessageA
USER32.dll	12	BeginPaint
USER32.dll	187	EndPaint
USER32.dll	405	KillTimer
USER32.dll	227	GetAsyncKeyState
USER32.dll	326	GetSystemMetrics
USER32.dll	594	SetTimer
USER32.dll	606	SetWindowTextA
USER32.dll	258	GetDlgItem
USER32.dll	76	CreateDialogIndirectParamA
USER32.dll	618	ShowWindow
USER32.dll	657	UpdateWindow
USER32.dll	427	LoadStringA
USER32.dll	428	LoadStringW
USER32.dll	213	FindWindowA
USER32.dll	676	WaitForInputIdle
USER32.dll	142	DestroyWindow
USER32.dll	446	MessageBoxA
USER32.dll	367	InSendMessage
USER32.dll	650	UnpackDDElParam
USER32.dll	220	FreeDDElParam
USER32.dll	132	DefWindowProcA
USER32.dll	410	LoadCursorA
USER32.dll	89	CreateWindowExA
USER32.dll	354	GetWindowThreadProcessId
USER32.dll	532	SendMessageA
USER32.dll	476	PeekMessageA
USER32.dll	642	TranslateMessage
USER32.dll	149	DispatchMessageA
USER32.dll	208	EnumWindows
USER32.dll	474	PackDDElParam
USER32.dll	478	PostMessageA
USER32.dll	399	IsWindow
USER32.dll	498	RegisterClassA
GDI32.dll	83	DeleteObject
GDI32.dll	43	CreateDCA
GDI32.dll	456	SelectPalette
GDI32.dll	428	RealizePalette
GDI32.dll	48	CreateDIBitmap
GDI32.dll	80	DeleteDC
GDI32.dll	17	BitBlt
GDI32.dll	455	SelectObject
GDI32.dll	42	CreateCompatibleDC
GDI32.dll	66	CreatePalette

show previews

offset	size	type	comment
0	950272	EXE	07/16/2007 00:28:53	#
15c1	15	HTM		#
e8000	110934	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1061206 bytes (1037 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK