pdfcrypt.unpacked.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

parent	pdfcrypt.exe
filename	pdfcrypt.unpacked.exe
size	5299712 (0x50de00)
md5	05b9ca52da9c7719fb35dec654304d5b

type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x492110bd
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	2.56
SizeOfCode	0x2cd000
SizeOfInitializedData	0x50da00
SizeOfUninitializedData	0x1f600
AddressOfEntryPoint	0x1280
BaseOfCode	0x1000
BaseOfData	0x2ce000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x530000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MingWin32 - Dev C++ v4.x

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2ccf08	0x2cd000	R-X CODE IDATA
.data	0x2ce000	0xbb800	0xbb800	RW- IDATA
.rdata	0x38a000	0x183dd0	0x183e00	R-- IDATA
.bss	0x50e000	0x1f430	0	RW- UDATA
.idata	0x52e000	0x13fc	0x1400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x52e000	0x13fc
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.DLL			AddAtomA
KERNEL32.DLL			CloseHandle
KERNEL32.DLL			CreateDirectoryA
KERNEL32.DLL			CreateEventA
KERNEL32.DLL			CreateFileA
KERNEL32.DLL			CreateMutexA
KERNEL32.DLL			CreatePipe
KERNEL32.DLL			CreateProcessA
KERNEL32.DLL			CreateThread
KERNEL32.DLL			DebugBreak
KERNEL32.DLL			DeleteCriticalSection
KERNEL32.DLL			DeleteFileA
KERNEL32.DLL			DuplicateHandle
KERNEL32.DLL			EnterCriticalSection
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			FindAtomA
KERNEL32.DLL			FindClose
KERNEL32.DLL			FindFirstFileA
KERNEL32.DLL			FindNextFileA
KERNEL32.DLL			FlushFileBuffers
KERNEL32.DLL			FormatMessageA
KERNEL32.DLL			FreeLibrary
KERNEL32.DLL			GetACP
KERNEL32.DLL			GetAtomNameA
KERNEL32.DLL			GetCurrentDirectoryA
KERNEL32.DLL			GetCurrentProcess
KERNEL32.DLL			GetCurrentThread
KERNEL32.DLL			GetCurrentThreadId
KERNEL32.DLL			GetExitCodeProcess
KERNEL32.DLL			GetExitCodeThread
KERNEL32.DLL			GetFileAttributesA
KERNEL32.DLL			GetFileSize
KERNEL32.DLL			GetFullPathNameA
KERNEL32.DLL			GetHandleInformation
KERNEL32.DLL			GetLastError
KERNEL32.DLL			GetLogicalDrives
KERNEL32.DLL			GetModuleFileNameA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			GetStdHandle
KERNEL32.DLL			GetSystemInfo
KERNEL32.DLL			GetTempPathA
KERNEL32.DLL			GetThreadContext
KERNEL32.DLL			GetTickCount
KERNEL32.DLL			GetVersion
KERNEL32.DLL			GetVersionExA
KERNEL32.DLL			GetWindowsDirectoryA
KERNEL32.DLL			GlobalAlloc
KERNEL32.DLL			GlobalFree
KERNEL32.DLL			InitializeCriticalSection
KERNEL32.DLL			InterlockedExchange
KERNEL32.DLL			InterlockedIncrement
KERNEL32.DLL			IsDBCSLeadByteEx
KERNEL32.DLL			LeaveCriticalSection
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			LocalFree
KERNEL32.DLL			MoveFileA
KERNEL32.DLL			MultiByteToWideChar
KERNEL32.DLL			ReadFile
KERNEL32.DLL			ReleaseMutex
KERNEL32.DLL			RemoveDirectoryA
KERNEL32.DLL			ResetEvent
KERNEL32.DLL			ResumeThread
KERNEL32.DLL			SetEndOfFile
KERNEL32.DLL			SetEvent
KERNEL32.DLL			SetFileAttributesA
KERNEL32.DLL			SetFilePointer
KERNEL32.DLL			SetFileTime
KERNEL32.DLL			SetHandleInformation
KERNEL32.DLL			SetLastError
KERNEL32.DLL			SetThreadPriority
KERNEL32.DLL			SetUnhandledExceptionFilter
KERNEL32.DLL			Sleep
KERNEL32.DLL			SuspendThread
KERNEL32.DLL			TerminateProcess
KERNEL32.DLL			TlsAlloc
KERNEL32.DLL			TlsGetValue
KERNEL32.DLL			TlsSetValue
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			VirtualProtect
KERNEL32.DLL			VirtualQuery
KERNEL32.DLL			WaitForMultipleObjects
KERNEL32.DLL			WaitForSingleObject
KERNEL32.DLL			WideCharToMultiByte
KERNEL32.DLL			WriteFile
ADVAPI32.DLL			GetUserNameA
msvcrt.dll			__getmainargs
msvcrt.dll			__lc_codepage
msvcrt.dll			__mb_cur_max
msvcrt.dll			__p__environ
msvcrt.dll			__p__fmode
msvcrt.dll			__set_app_type
msvcrt.dll			_cexit
msvcrt.dll			_errno
msvcrt.dll			_findclose
msvcrt.dll			_findfirst
msvcrt.dll			_findnext
msvcrt.dll			_fullpath
msvcrt.dll			_iob
msvcrt.dll			_isctype
msvcrt.dll			_onexit
msvcrt.dll			_pctype
msvcrt.dll			_pipe
msvcrt.dll			_setmode
msvcrt.dll			abort
msvcrt.dll			atexit
msvcrt.dll			atoi
msvcrt.dll			atol
msvcrt.dll			calloc
msvcrt.dll			exit
msvcrt.dll			fclose
msvcrt.dll			fflush
msvcrt.dll			fgets
msvcrt.dll			fmod
msvcrt.dll			fopen
msvcrt.dll			fprintf
msvcrt.dll			free
msvcrt.dll			getenv
msvcrt.dll			localtime
msvcrt.dll			malloc
msvcrt.dll			memcpy
msvcrt.dll			memmove
msvcrt.dll			memset
msvcrt.dll			mktime
msvcrt.dll			qsort
msvcrt.dll			realloc
msvcrt.dll			signal
msvcrt.dll			sprintf
msvcrt.dll			strcat
msvcrt.dll			strchr
msvcrt.dll			strcmp
msvcrt.dll			strcpy
msvcrt.dll			strerror
msvcrt.dll			strlen
msvcrt.dll			strncat
msvcrt.dll			strncmp
msvcrt.dll			strncpy
msvcrt.dll			strrchr
msvcrt.dll			strtoul
msvcrt.dll			time
msvcrt.dll			_access
msvcrt.dll			_ftime
msvcrt.dll			_getcwd
msvcrt.dll			_strdup
msvcrt.dll			_timezone
USER32.dll			MessageBoxA
WS2_32.DLL			WSACloseEvent
WS2_32.DLL			WSACreateEvent
WS2_32.DLL			WSAEventSelect
WS2_32.DLL			WSAGetLastError
WS2_32.DLL			WSASetLastError
WS2_32.DLL			WSAStartup
WS2_32.DLL			WSAWaitForMultipleEvents
WS2_32.DLL			accept
WS2_32.DLL			bind
WS2_32.DLL			closesocket
WS2_32.DLL			connect
WS2_32.DLL			gethostbyaddr
WS2_32.DLL			gethostbyname
WS2_32.DLL			gethostname
WS2_32.DLL			getsockname
WS2_32.DLL			getsockopt
WS2_32.DLL			htonl
WS2_32.DLL			htons
WS2_32.DLL			inet_addr
WS2_32.DLL			inet_ntoa
WS2_32.DLL			ioctlsocket
WS2_32.DLL			listen
WS2_32.DLL			ntohs
WS2_32.DLL			recv
WS2_32.DLL			recvfrom
WS2_32.DLL			send
WS2_32.DLL			sendto
WS2_32.DLL			setsockopt
WS2_32.DLL			shutdown
WS2_32.DLL			socket

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	5294128	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK