filenamecface.exe
size930606 (0xe332e)
md50be90de031e95c32c8f12c99f8099cd7
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0x11
TimeDateStamp0x517d815d
PointerToSymbolTable0xbee00
NumberOfSymbols0x149a
SizeOfOptionalHeader0xe0
Characteristics0x107
Magic0x10b
LinkerVersion2.22
SizeOfCode0x2a200
SizeOfInitializedData0x54800
SizeOfUninitializedData0x89800
AddressOfEntryPoint0x12a0
BaseOfCode0x1000
BaseOfData0x2c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x152000
SizeOfHeaders0x600
CheckSum0xe64f4
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPolyX v0.1 (Delikon)

Sections

namevavsizeraw sizeflags
.text0x10000x2a1bc0x2a200R-X CODE IDATA
.data0x2c0000xae40xc00RW- IDATA
.rdata0x2d0000x33400x3400R-- IDATA
/40x310000x3e00x400R-- IDATA
.bss0x320000x897f80RW- UDATA
.idata0xbc0000x153c0x1600RW- IDATA
.CRT0xbe0000x180x200RW- IDATA
.tls0xbf0000x200x200RW- IDATA
.rsrc0xc00000x247f80x24800RW- IDATA
/140xe50000xef00x1000R-- IDATA DISCARDABLE
/290xe60000x47aa80x47c00R-- IDATA DISCARDABLE
/410x12e0000x78940x7a00R-- IDATA DISCARDABLE
/550x1360000x76ae0x7800R-- IDATA DISCARDABLE
/670x13e0000x4fa80x5000R-- IDATA DISCARDABLE
/800x1430000xaf80xc00R-- IDATA DISCARDABLE
/910x1440000xb16e0xb200R-- IDATA DISCARDABLE
/1020x1500000x12280x1400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xbc0000x153c
RESOURCE0xc00000x247f8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xbf0000x18
LOAD_CONFIG00
Bound_IAT00
IAT0xbc3ac0x30c
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4bf0190x4bf01c0x4bb79c0x4be00400
typenamesizecp
BITMAPDEVELOPER51600
BITMAPLIST108400
BITMAPPREVIEW1065360
BITMAPTOOLBAR266640
module_namehintordfunction_name
COMDLG32.DLL9GetOpenFileNameA
COMDLG32.DLL11GetSaveFileNameA
GDI32.dll12BitBlt
GDI32.dll17CloseEnhMetaFile
GDI32.dll33CreateCompatibleBitmap
GDI32.dll34CreateCompatibleDC
GDI32.dll39CreateDIBSection
GDI32.dll44CreateEnhMetaFileA
GDI32.dll46CreateFontA
GDI32.dll58CreatePen
GDI32.dll62CreateRectRgn
GDI32.dll67CreateSolidBrush
GDI32.dll70DeleteDC
GDI32.dll71DeleteEnhMetaFile
GDI32.dll73DeleteObject
GDI32.dll79Ellipse
GDI32.dll125GetCharABCWidthsA
GDI32.dll129GetCharWidth32A
GDI32.dll137GetClipBox
GDI32.dll138GetClipRgn
GDI32.dll141GetCurrentObject
GDI32.dll185GetObjectA
GDI32.dll192GetPixel
GDI32.dll201GetStockObject
GDI32.dll209GetTextColor
GDI32.dll219GetTextMetricsA
GDI32.dll231LineTo
GDI32.dll234MoveToEx
GDI32.dll240PatBlt
GDI32.dll243PlayEnhMetaFile
GDI32.dll250PolyDraw
GDI32.dll263Rectangle
GDI32.dll273RoundRect
GDI32.dll279SelectClipRgn
GDI32.dll281SelectObject
GDI32.dll288SetBkMode
GDI32.dll312SetPixel
GDI32.dll323SetTextColor
GDI32.dll339TextOutA
KERNEL32.dll3AddAtomA
KERNEL32.dll82CloseHandle
KERNEL32.dll103ContinueDebugEvent
KERNEL32.dll154CreateMutexA
KERNEL32.dll169CreateSemaphoreA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll298FindAtomA
KERNEL32.dll300FindClose
KERNEL32.dll304FindFirstFileA
KERNEL32.dll321FindNextFileA
KERNEL32.dll363GetAtomNameA
KERNEL32.dll451GetCurrentThreadId
KERNEL32.dll510GetLastError
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll687GlobalAlloc
KERNEL32.dll698GlobalLock
KERNEL32.dll702GlobalSize
KERNEL32.dll705GlobalUnlock
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll743InterlockedDecrement
KERNEL32.dll747InterlockedIncrement
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll974ReleaseMutex
KERNEL32.dll978ReleaseSemaphore
KERNEL32.dll1091SetLastError
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1171TlsAlloc
KERNEL32.dll1172TlsFree
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1174TlsSetValue
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1220WaitForDebugEvent
KERNEL32.dll1223WaitForSingleObject
msvcrt.dll43_itoa
msvcrt.dll81_stricmp
msvcrt.dll84_strnicmp
msvcrt.dll109_write
MSIMG32.DLLAlphaBlend
MSIMG32.DLL1GradientFill
MSIMG32.DLL2TransparentBlt
msvcrt.dll55__getmainargs
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll147_cexit
msvcrt.dll266_iob
msvcrt.dll383_onexit
msvcrt.dll426_setmode
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll592atoi
msvcrt.dll595calloc
msvcrt.dll607fclose
msvcrt.dll618fopen
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll624fread
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll644isalpha
msvcrt.dll676malloc
msvcrt.dll681memcmp
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll698realloc
msvcrt.dll704setlocale
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll713strcat
msvcrt.dll714strchr
msvcrt.dll715strcmp
msvcrt.dll717strcpy
msvcrt.dll721strlen
msvcrt.dll723strncmp
msvcrt.dll724strncpy
msvcrt.dll725strpbrk
msvcrt.dll743toupper
msvcrt.dll748vfprintf
USER32.dll2AdjustWindowRectEx
USER32.dll4AnimateWindow
USER32.dll6AppendMenuA
USER32.dll11BeginPaint
USER32.dll13BringWindowToTop
USER32.dll59ClientToScreen
USER32.dll61CloseClipboard
USER32.dll88CreateMenu
USER32.dll89CreatePopupMenu
USER32.dll90CreateWindowExA
USER32.dll134DefWindowProcA
USER32.dll143DestroyMenu
USER32.dll144DestroyWindow
USER32.dll149DispatchMessageA
USER32.dll164DrawFocusRect
USER32.dll177EmptyClipboard
USER32.dll180EnableWindow
USER32.dll184EndPaint
USER32.dll218GetActiveWindow
USER32.dll224GetCapture
USER32.dll228GetClassInfoExA
USER32.dll236GetClientRect
USER32.dll238GetClipboardData
USER32.dll247GetCursorPos
USER32.dll250GetDesktopWindow
USER32.dll259GetForegroundWindow
USER32.dll266GetKeyNameTextA
USER32.dll268GetKeyState
USER32.dll279GetMenu
USER32.dll285GetMenuItemCount
USER32.dll287GetMenuItemInfoA
USER32.dll293GetMessageA
USER32.dll323GetSysColor
USER32.dll326GetSystemMetrics
USER32.dll342GetWindowLongA
USER32.dll348GetWindowRect
USER32.dll350GetWindowTextA
USER32.dll365InsertMenuItemA
USER32.dll370InvalidateRect
USER32.dll382IsClipboardFormatAvailable
USER32.dll400KillTimer
USER32.dll405LoadCursorA
USER32.dll409LoadIconA
USER32.dll411LoadImageA
USER32.dll427MapVirtualKeyA
USER32.dll434MessageBoxA
USER32.dll455OpenClipboard
USER32.dll466PostMessageA
USER32.dll480RegisterClassExA
USER32.dll493ReleaseCapture
USER32.dll500ScreenToClient
USER32.dll508SendMessageA
USER32.dll517SetCapture
USER32.dll523SetClipboardData
USER32.dll525SetCursor
USER32.dll533SetFocus
USER32.dll543SetMenuItemInfoA
USER32.dll563SetTimer
USER32.dll569SetWindowLongA
USER32.dll572SetWindowPos
USER32.dll574SetWindowTextA
USER32.dll585ShowWindow
USER32.dll601TrackMouseEvent
USER32.dll602TrackPopupMenu
USER32.dll608TranslateMessage
offsetsizetypecomment
0781824EXE04/28/2013 20:06:53#
15c115HTM#
bee00148782BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xbb79c