filenamePayload.exe
size1146368 (0x117e00)
md50734f519b574f6865e5994537bb227b2
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
239401162
2602340613
257234066
2612340638
1994111814
1473072933
10182
261235065
256235061
258235061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0x56d19496
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.0
SizeOfCode0xd1a00
SizeOfInitializedData0x46600
SizeOfUninitializedData0
AddressOfEntryPoint0x65903
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion0.0
SubsystemVersion6.2
Reserved10
SizeOfImage0x17d000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x9140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x607f10RWX CODE UDATA
.text0x620000xd18740xd1a00R-X CODE
.rdata0x1340000x33f480x34000R-- IDATA
.data0x1680000x5b080x5600RW- IDATA
.idata0x16e0000x2d5f0x2e00R-- IDATA
minATL0x1710000x4100x600R-- IDATA
.gfids0x1720000x4960x600R-- IDATA
.00cfg0x1730000x1040x200R-- IDATA
.reloc0x1740000x8dde0x8e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x167da00x1a8
IMPORT0x16e6b80x1a4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x1740000x79c8
DEBUG0x14ffb00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x14ffe80x5c
Bound_IAT00
IAT0x16e0000x6b8
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
api-ms-win-core-debug-l1-1-1.dll5IsDebuggerPresent
api-ms-win-core-com-l1-1-1.dll62CoTaskMemAlloc
api-ms-win-core-com-l1-1-1.dll63CoTaskMemFree
api-ms-win-core-com-l1-1-1.dll24CoGetContextToken
api-ms-win-core-com-l1-1-1.dll6CoCreateFreeThreadedMarshaler
vccorlib140d_app.DLL229void __stdcall __abi_WinRTraiseNotImplementedException(void)

?__abi_WinRTraiseNotImplementedException@@YGXXZ

vccorlib140d_app.DLL228void __stdcall __abi_WinRTraiseInvalidCastException(void)

?__abi_WinRTraiseInvalidCastException@@YGXXZ

vccorlib140d_app.DLL230void __stdcall __abi_WinRTraiseNullReferenceException(void)

?__abi_WinRTraiseNullReferenceException@@YGXXZ

vccorlib140d_app.DLL232void __stdcall __abi_WinRTraiseOperationCanceledException(void)

?__abi_WinRTraiseOperationCanceledException@@YGXXZ

vccorlib140d_app.DLL226void __stdcall __abi_WinRTraiseFailureException(void)

?__abi_WinRTraiseFailureException@@YGXXZ

vccorlib140d_app.DLL221void __stdcall __abi_WinRTraiseAccessDeniedException(void)

?__abi_WinRTraiseAccessDeniedException@@YGXXZ

vccorlib140d_app.DLL234void __stdcall __abi_WinRTraiseOutOfMemoryException(void)

?__abi_WinRTraiseOutOfMemoryException@@YGXXZ

vccorlib140d_app.DLL227void __stdcall __abi_WinRTraiseInvalidArgumentException(void)

?__abi_WinRTraiseInvalidArgumentException@@YGXXZ

vccorlib140d_app.DLL233void __stdcall __abi_WinRTraiseOutOfBoundsException(void)

?__abi_WinRTraiseOutOfBoundsException@@YGXXZ

vccorlib140d_app.DLL223void __stdcall __abi_WinRTraiseChangedStateException(void)

?__abi_WinRTraiseChangedStateException@@YGXXZ

vccorlib140d_app.DLL224void __stdcall __abi_WinRTraiseClassNotRegisteredException(void)

?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ

vccorlib140d_app.DLL33??0Object@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL235void __stdcall __abi_WinRTraiseWrongThreadException(void)

?__abi_WinRTraiseWrongThreadException@@YGXXZ

vccorlib140d_app.DLL225void __stdcall __abi_WinRTraiseDisconnectedException(void)

?__abi_WinRTraiseDisconnectedException@@YGXXZ

vccorlib140d_app.DLL231void __stdcall __abi_WinRTraiseObjectDisposedException(void)

?__abi_WinRTraiseObjectDisposedException@@YGXXZ

vccorlib140d_app.DLL222void __stdcall __abi_WinRTraiseCOMException(long)

?__abi_WinRTraiseCOMException@@YGXJ@Z

vccorlib140d_app.DLL237?__abi_cast_String_to_Object@__abi_details@@YGP$AAVObject@Platform@@P$AAVString@3@@Z
vccorlib140d_app.DLL184private: void __thiscall Platform::Details::ControlBlock::ReleaseTarget(void)

?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ

vccorlib140d_app.DLL84public: static void * __cdecl Platform::Details::Heap::Allocate(unsigned int)

?Allocate@Heap@Details@Platform@@SAPAXI@Z

vccorlib140d_app.DLL85public: static void * __cdecl Platform::Details::Heap::Allocate(unsigned int, unsigned int)

?Allocate@Heap@Details@Platform@@SAPAXII@Z

vccorlib140d_app.DLL125public: static void __cdecl Platform::Details::Heap::Free(void *)

?Free@Heap@Details@Platform@@SAXPAX@Z

vccorlib140d_app.DLL239long __stdcall __abi_translateCurrentException(bool)

?__abi_translateCurrentException@@YGJ_N@Z

vccorlib140d_app.DLL82public: static void __cdecl Platform::Details::Heap::AlignedFree(void *)

?AlignedFree@Heap@Details@Platform@@SAXPAX@Z

vccorlib140d_app.DLL87public: static void * __cdecl Platform::Details::Heap::AllocateException(unsigned int, unsigned int)

?AllocateException@Heap@Details@Platform@@SAPAXII@Z

vccorlib140d_app.DLL238?__abi_make_type_id@@YGP$AAVType@Platform@@ABU__abi_type_descriptor@@@Z
vccorlib140d_app.DLL13??0Delegate@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL19??0FailureException@Platform@@Q$AAA@P$AAVString@1@@Z
vccorlib140d_app.DLL69??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@P$AAV01@@Z
vccorlib140d_app.DLL15??0DisconnectedException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL173?GetWeakReference@Details@Platform@@YGPAU__abi_IUnknown@@Q$ADVObject@2@@Z
vccorlib140d_app.DLL185?ResolveWeakReference@Details@Platform@@YGP$AAVObject@2@ABU_GUID@@PAPAU__abi_IUnknown@@@Z
vccorlib140d_app.DLL157long __stdcall Platform::Details::GetProxyImpl(struct IUnknown *, struct _GUID const &, struct IUnknown *, struct IUnknown * *)

?GetProxyImpl@Details@Platform@@YGJPAUIUnknown@@ABU_GUID@@0PAPAU3@@Z

vccorlib140d_app.DLL40??0OutOfBoundsException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL32??0NullReferenceException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL30??0NotImplementedException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL25??0InvalidArgumentException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL153void * __stdcall Platform::Details::GetIBoxArrayVtable(void *)

?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z

vccorlib140d_app.DLL121void __stdcall Platform::Details::EventSourceInitialize(void * *)

?EventSourceInitialize@Details@Platform@@YGXPAPAX@Z

vccorlib140d_app.DLL123void __stdcall Platform::Details::EventSourceUninitialize(void * *)

?EventSourceUninitialize@Details@Platform@@YGXPAPAX@Z

vccorlib140d_app.DLL118void * __stdcall Platform::Details::EventSourceGetTargetArray(void *, struct Platform::Details::EventLock *)

?EventSourceGetTargetArray@Details@Platform@@YGPAXPAXPAUEventLock@12@@Z

vccorlib140d_app.DLL120unsigned int __stdcall Platform::Details::EventSourceGetTargetArraySize(void *)

?EventSourceGetTargetArraySize@Details@Platform@@YGIPAX@Z

vccorlib140d_app.DLL119void * __stdcall Platform::Details::EventSourceGetTargetArrayEvent(void *, unsigned int, void const *, __int64 *)

?EventSourceGetTargetArrayEvent@Details@Platform@@YGPAXPAXIPBXPA_J@Z

vccorlib140d_app.DLL117?EventSourceAdd@Details@Platform@@YG?AVEventRegistrationToken@Foundation@Windows@@PAPAXPAUEventLock@12@P$AAVDelegate@2@@Z
vccorlib140d_app.DLL122void __stdcall Platform::Details::EventSourceRemove(void * *, struct Platform::Details::EventLock *, class Windows::Foundation::EventRegistrationToken)

?EventSourceRemove@Details@Platform@@YGXPAPAXPAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z

vccorlib140d_app.DLL156struct IUnknown * __stdcall Platform::Details::GetObjectContext(void)

?GetObjectContext@Details@Platform@@YGPAUIUnknown@@XZ

vccorlib140d_app.DLL183long __stdcall Platform::Details::ReleaseInContextImpl(struct IUnknown *, struct IUnknown *)

?ReleaseInContextImpl@Details@Platform@@YGJPAUIUnknown@@0@Z

vccorlib140d_app.DLL10??0ChangedStateException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL42??0OutOfMemoryException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL20??0FailureException@Platform@@Q$AAA@XZ
vccorlib140d_app.DLL175long __cdecl Platform::Details::InitializeData(int)

?InitializeData@Details@Platform@@YAJH@Z

vccorlib140d_app.DLL212void __cdecl Platform::Details::UninitializeData(int)

?UninitializeData@Details@Platform@@YAXH@Z

vccorlib140d_app.DLL128long __stdcall GetActivationFactoryByPCWSTR(void *, class Platform::Guid &, void * *)

?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z

vccorlib140d_app.DLL155long __stdcall GetIidsFn(int, unsigned long *, struct __s_GUID const *, class Platform::Guid * *)

?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z

vccorlib140d_app.DLL129wchar_t ** __cdecl Platform::Details::GetCmdArguments(int *)

?GetCmdArguments@Details@Platform@@YAPAPA_WPAH@Z

vccorlib140d_app.DLL127long __stdcall Platform::Details::GetActivationFactory(class Microsoft::WRL::Details::ModuleBase *, struct HSTRING__ *, struct IActivationFactory * *)

?GetActivationFactory@Details@Platform@@YGJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z

vccorlib140d_app.DLL188bool __stdcall Platform::Details::TerminateModule(class Microsoft::WRL::Details::ModuleBase *)

?TerminateModule@Details@Platform@@YG_NPAVModuleBase@1WRL@Microsoft@@@Z

MSVCP140D_APP.dll985public: static class std::locale::id std::ctype<wchar_t>::id

?id@?$ctype@_W@std@@2V0locale@2@A

MSVCP140D_APP.dll165public: __thiscall std::_Lockit::~_Lockit(void)

??1_Lockit@std@@QAE@XZ

MSVCP140D_APP.dll421void __cdecl std::_Debug_message(wchar_t const *, wchar_t const *, unsigned int)

?_Debug_message@std@@YAXPB_W0I@Z

MSVCP140D_APP.dll659void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP140D_APP.dll661void __cdecl std::_Xinvalid_argument(char const *)

?_Xinvalid_argument@std@@YAXPBD@Z

MSVCP140D_APP.dll662void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP140D_APP.dll663void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

MSVCP140D_APP.dll1487_Wcscoll
MSVCP140D_APP.dll1488_Wcsxfrm
MSVCP140D_APP.dll108public: __thiscall std::_Locinfo::_Locinfo(char const *)

??0_Locinfo@std@@QAE@PBD@Z

MSVCP140D_APP.dll164public: __thiscall std::_Locinfo::~_Locinfo(void)

??1_Locinfo@std@@QAE@XZ

MSVCP140D_APP.dll462public: struct _Collvec __thiscall std::_Locinfo::_Getcoll(void)const

?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ

MSVCP140D_APP.dll679public: char const * __thiscall std::_Yarn<char>::c_str(void)const

?c_str@?$_Yarn@D@std@@QBEPBDXZ

MSVCP140D_APP.dll174public: static void * __cdecl std::_Crt_new_delete::operator new(unsigned int)

??2_Crt_new_delete@std@@SAPAXI@Z

MSVCP140D_APP.dll178public: static void __cdecl std::_Crt_new_delete::operator delete(void *)

??3_Crt_new_delete@std@@SAXPAX@Z

MSVCP140D_APP.dll311public: __thiscall std::locale::id::operator unsigned int(void)

??Bid@locale@std@@QAEIXZ

MSVCP140D_APP.dll117protected: __thiscall std::locale::facet::facet(unsigned int)

??0facet@locale@std@@IAE@I@Z

MSVCP140D_APP.dll171protected: virtual __thiscall std::locale::facet::~facet(void)

??1facet@locale@std@@MAE@XZ

MSVCP140D_APP.dll535private: static class std::locale::_Locimp * __cdecl std::locale::_Init(bool)

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

MSVCP140D_APP.dll477private: static class std::locale::_Locimp * __cdecl std::locale::_Getgloballocale(void)

?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

MSVCP140D_APP.dll1051public: bool __thiscall std::ctype<wchar_t>::is(short, wchar_t)const

?is@?$ctype@_W@std@@QBE_NF_W@Z

MSVCP140D_APP.dll1307public: wchar_t __thiscall std::ctype<wchar_t>::tolower(wchar_t)const

?tolower@?$ctype@_W@std@@QBE_W_W@Z

MSVCP140D_APP.dll1306public: wchar_t const * __thiscall std::ctype<wchar_t>::tolower(wchar_t *, wchar_t const *)const

?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z

MSVCP140D_APP.dll448public: static unsigned int __cdecl std::ctype<wchar_t>::_Getcat(class std::locale::facet const * *, class std::locale const *)

?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

MSVCP140D_APP.dll665void __cdecl std::_Xregex_error(enum std::regex_constants::error_type)

?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

MSVCP140D_APP.dll982public: static class std::locale::id std::collate<wchar_t>::id

?id@?$collate@_W@std@@2V0locale@2@A

MSVCP140D_APP.dll109public: __thiscall std::_Lockit::_Lockit(int)

??0_Lockit@std@@QAE@H@Z

MSVCP140D_APP.dll506public: virtual void __thiscall std::locale::facet::_Incref(void)

?_Incref@facet@locale@std@@UAEXXZ

MSVCP140D_APP.dll422public: virtual class std::_Facet_base * __thiscall std::locale::facet::_Decref(void)

?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ

VCRUNTIME140D_APP.dll1_CxxThrowException
VCRUNTIME140D_APP.dll16__CxxFrameHandler3
VCRUNTIME140D_APP.dll70memcpy
VCRUNTIME140D_APP.dll71memmove
VCRUNTIME140D_APP.dll72memset
VCRUNTIME140D_APP.dll74strchr
VCRUNTIME140D_APP.dll79wcsrchr
VCRUNTIME140D_APP.dll33__std_exception_copy
VCRUNTIME140D_APP.dll34__std_exception_destroy
VCRUNTIME140D_APP.dll61_purecall
VCRUNTIME140D_APP.dll40__telemetry_main_invoke_trigger
VCRUNTIME140D_APP.dll41__telemetry_main_return_trigger
VCRUNTIME140D_APP.dll37__std_type_info_destroy_list
VCRUNTIME140D_APP.dll46__vcrt_GetModuleFileNameW
VCRUNTIME140D_APP.dll47__vcrt_GetModuleHandleW
VCRUNTIME140D_APP.dll49__vcrt_LoadLibraryExW
VCRUNTIME140D_APP.dll53_except_handler4_common
ucrtbased.dll1406wcscpy_s
ucrtbased.dll996_wsplitpath_s
ucrtbased.dll968_wmakepath_s
ucrtbased.dll411_invalid_parameter
ucrtbased.dll262_errno
ucrtbased.dll1190free
ucrtbased.dll1316realloc
ucrtbased.dll1425wcstol
ucrtbased.dll1409wcslen
ucrtbased.dll1357strlen
ucrtbased.dll21_CrtDbgReportW
ucrtbased.dll1403wcscmp
ucrtbased.dll322_free_dbg
ucrtbased.dll563_malloc_dbg
ucrtbased.dll20_CrtDbgReport
ucrtbased.dll199_callnewh
ucrtbased.dll1272malloc
ucrtbased.dll409_initterm
ucrtbased.dll410_initterm_e
ucrtbased.dll750_seh_filter_exe
ucrtbased.dll753_set_app_type
ucrtbased.dll129__setusermatherr
ucrtbased.dll220_configure_narrow_argv
ucrtbased.dll406_initialize_narrow_environment
ucrtbased.dll357_get_narrow_winmain_command_line
ucrtbased.dll224_controlfp_s
ucrtbased.dll273_exit
ucrtbased.dll758_set_fmode
ucrtbased.dll202_cexit
ucrtbased.dll197_c_exit
ucrtbased.dll738_register_thread_local_exe_atexit_callback
ucrtbased.dll219_configthreadlocale
ucrtbased.dll761_set_new_mode
ucrtbased.dll115__p__commode
ucrtbased.dll749_seh_filter_dll
ucrtbased.dll407_initialize_onexit_table
ucrtbased.dll737_register_onexit_function
ucrtbased.dll268_execute_onexit_table
ucrtbased.dll232_crt_atexit
ucrtbased.dll231_crt_at_quick_exit
ucrtbased.dll142__stdio_common_vsprintf_s
ucrtbased.dll1141exit
api-ms-win-core-util-l1-1-0.dll1DecodePointer
api-ms-win-core-synch-l1-2-0.dllAcquireSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll36ReleaseSRWLockExclusive
api-ms-win-core-winrt-error-l1-1-1.dll18SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1.dll4RoFailFastWithErrorContext
api-ms-win-core-winrt-error-l1-1-1.dll13RoReportUnhandledError
api-ms-win-core-winrt-string-l1-1-0.dll7WindowsCreateStringReference
api-ms-win-core-winrt-string-l1-1-0.dll10WindowsDuplicateString
api-ms-win-core-winrt-string-l1-1-0.dll5WindowsConcatString
api-ms-win-core-winrt-string-l1-1-0.dll6WindowsCreateString
api-ms-win-core-winrt-string-l1-1-0.dll12WindowsGetStringRawBuffer
api-ms-win-core-winrt-string-l1-1-0.dll11WindowsGetStringLen
api-ms-win-core-winrt-string-l1-1-0.dll15WindowsIsStringEmpty
api-ms-win-core-winrt-string-l1-1-0.dll4WindowsCompareStringOrdinal
api-ms-win-core-winrt-string-l1-1-0.dll8WindowsDeleteString
api-ms-win-core-errorhandling-l1-1-1.dll7RaiseException
api-ms-win-core-errorhandling-l1-1-1.dll5GetLastError
api-ms-win-core-string-l1-1-0.dll7WideCharToMultiByte
api-ms-win-core-string-l1-1-0.dll6MultiByteToWideChar
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2.dll17GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll46IsProcessorFeaturePresent
api-ms-win-core-processthreads-l1-1-2.dll13GetCurrentProcessId
api-ms-win-core-sysinfo-l1-2-1.dll20GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0.dll1DisableThreadLibraryCalls
api-ms-win-core-libraryloader-l1-2-0.dll11FreeLibrary
api-ms-win-core-libraryloader-l1-2-0.dll20GetProcAddress
api-ms-win-core-interlocked-l1-2-0.dllInitializeSListHead
api-ms-win-core-winrt-l1-1-0.dll3RoInitialize
api-ms-win-core-heap-l1-2-0.dllGetProcessHeap
api-ms-win-core-heap-l1-2-0.dll6HeapFree
api-ms-win-core-heap-l1-2-0.dll2HeapAlloc
api-ms-win-core-memory-l1-1-2.dll43VirtualQuery
ordentry_vafunction_name
10x655deDllCanUnloadNow
20x668d0DllGetActivationFactory
30x66c36VSDesignerDllMain
module_namePayload.exe
flags0
timestamp2016-02-27 12:20:38
version0.0
ordinal_base1
nFunctions3
nNames3
Names(3)0x167dd4
Functions(3)0x167dc8
NameOrdinals(3)0x167de0
offsetsizetypecomment
01146368EXE02/27/2016 12:20:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK