3.exe

info
MZ
PE
resources
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	3.exe
size	8032907 (0x7a928b)
md5	09e91426953dafe569a1cc605207b42b

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x120

Rich Header

lib id	version	times used
12	7291	6
11	8047	9
10	8047	6
14	7299	44
19	8022	45
93	2179	2
1	0	716
19	8034	31
11	9782	115
10	9782	221
11	8168	117
10	8168	27
0	0	119
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x5992e1f6
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0xe2000
SizeOfInitializedData	0x466000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x549001
BaseOfCode	0x1000
BaseOfData	0xe3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x54c000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.12

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xe2000	0x5a400	RWX CODE IDATA
.rdata	0xe3000	0x400000	0x3ac200	RW- IDATA
.data	0x4e3000	0x60000	0x6800	RW- IDATA
.rsrc	0x543000	0x6000	0x2000	RW- IDATA
.aspack	0x549000	0x2000	0x1e00	RWX CODE IDATA
.adata	0x54b000	0x1000	0	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x54a008	0x31c
RESOURCE	0x543000	0x5118
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x549fb0	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size
TEXTINCLUDE	#1	11
TEXTINCLUDE	#2	22
TEXTINCLUDE	#3	337
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	180
BITMAP	IEXT_IDB_STATEIMAGES	364
BITMAP	#1031	584
BITMAP	#1038	324
BITMAP	#1138	344
BITMAP	#1139	344
BITMAP	#1140	344
BITMAP	#1141	344
BITMAP	#1142	344
BITMAP	#1143	344
BITMAP	#1144	344
BITMAP	#1145	344
BITMAP	#26567	1508
BITMAP	#30994	184
BITMAP	#30995	364
BITMAP	#30996	324
ICON	#1	744
ICON	#2	296
ICON	#3	744
MENU	#127	12
MENU	#1039	644
DIALOG	#150	152
DIALOG	#286	378
DIALOG	#554	250
DIALOG	#1037	234
DIALOG	#1084	2222
DIALOG	#1124	178
DIALOG	#1134	204
DIALOG	#1150	178
DIALOG	#30721	226
DIALOG	#30722	396
STRING	#3841	80
STRING	#3842	44
STRING	#3843	120
STRING	#3857	452
STRING	#3858	298
STRING	#3859	326
STRING	#3865	64
STRING	#3866	100
STRING	#3867	472
STRING	#3868	276
STRING	#3869	36
GROUP_CURSOR	#1032	20
GROUP_CURSOR	#1033	20
GROUP_CURSOR	#30977	34
GROUP_ICON	DEFAULT_ICON	20
GROUP_ICON	#1151	20
GROUP_ICON	#1152	20
MANIFEST	#1	466

module_name	ord	function_name
kernel32.dll		GetProcAddress
kernel32.dll		GetModuleHandleA
kernel32.dll		LoadLibraryA
rasapi32.dll		RasHangUpA
winmm.dll		midiStreamRestart
ws2_32.dll	18
user32.dll		wsprintfA
gdi32.dll		PtVisible
winspool.drv		OpenPrinterA
advapi32.dll		RegQueryValueA
shell32.dll		ShellExecuteA
ole32.dll		StgCreateDocfileOnILockBytes
oleaut32.dll	23
comctl32.dll		ImageList_Read
oledlg.dll	8
wininet.dll		InternetCanonicalizeUrlA
comdlg32.dll		ChooseColorA

show previews

offset	size	type	comment
15c1	15	HTM		#
423efc	984	ZIP		#
4242d4	3690423	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 8032907 bytes (7845 KiB)


--
Type = zip
WARNINGS:
There are data after the end of archive
Offset = 4341500
Physical Size = 984
Tail Size = 3690423

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2017-08-16 15:35:18 D....            0            0  Config
2017-08-16 15:35:18 D....            0            0  Data
2017-08-16 15:35:18 D....            0            0  Map
2017-08-16 15:35:18 D....            0            0  Resources
2017-08-16 15:35:18 D....            0            0  Resources/Data
2017-08-16 15:35:18 D....            0            0  Resources/Map
2017-08-16 15:35:18 D....            0            0  Resources/Wav
2017-08-16 15:35:18 D....            0            0  Wav
------------------- ----- ------------ ------------  ------------------------
2017-08-16 15:35:18                  0            0  0 files, 8 folders

Warnings: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x5462e0

[?] can't find file_offset of VA 0x546430

[?] can't find file_offset of VA 0x546580

[?] can't find file_offset of VA 0x5466b8

[?] can't find file_offset of VA 0x547ad0

[?] can't find file_offset of VA 0x546798

[?] can't find file_offset of VA 0x546e68

[?] can't find file_offset of VA 0x546f20

[?] can't find file_offset of VA 0x547090

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x546048

[?] can't find file_offset of VA 0x546058

[?] can't find file_offset of VA 0x545d30

[?] can't find file_offset of VA 0x545dc8

[?] can't find file_offset of VA 0x545f48

[?] can't find file_offset of VA 0x5459f8

[?] can't find file_offset of VA 0x545870

[?] can't find file_offset of VA 0x545928

[?] can't find file_offset of VA 0x545ae8

[?] can't find file_offset of VA 0x546d80

[?] can't find file_offset of VA 0x545ba0

[?] can't find file_offset of VA 0x5471d8

[?] can't find file_offset of VA 0x547228

[?] can't find file_offset of VA 0x547258

[?] can't find file_offset of VA 0x5472d0

[?] can't find file_offset of VA 0x547620

[?] can't find file_offset of VA 0x5474d8

[?] can't find file_offset of VA 0x547498

[?] can't find file_offset of VA 0x547a40

[?] can't find file_offset of VA 0x547750

[?] can't find file_offset of VA 0x547928

[?] can't find file_offset of VA 0x547aa8

[?] can't find file_offset of VA 0x546568

[?] can't find file_offset of VA 0x546418

[?] can't find file_offset of VA 0x546770

[?] can't find file_offset of VA 0x0