filenamePlay_Movie6260_Click_Run._xe
size246797 (0x3c40d)
md50c138b07b4b6679ff488765c9472b976
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1010
93403513
1754021914
155402191
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x4dce4028
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x1c400
SizeOfInitializedData0x22e00
SizeOfUninitializedData0
AddressOfEntryPoint0x1786d
BaseOfCode0x1000
BaseOfData0x1e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x50000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1c2480x1c400R-X CODE
.data0x1e0000x5000x600RW- IDATA
.rdata0x1f0000x159be0x15a00RW- IDATA
.port0x350000x173d50xbe00RW- IDATA
.dir0x4d0000x58c0x600RW- IDATA
.rsrc0x4e0000x100x200R-- IDATA
.reloc0x4f0000x6540x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x2b1e00x71
IMPORT0x342900x78
RESOURCE0x4e0000x10
EXCEPTION00
SECURITY00
BASERELOC0x4f0000x654
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x1f0000x150
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
USER32.dll342GetShellWindow
USER32.dll180DrawIconEx
USER32.dll488ModifyMenuW
USER32.dll519RegisterHotKey
USER32.dll3AdjustWindowRectEx
USER32.dll498PostThreadMessageW
USER32.dll364GetWindowDC
USER32.dll233GetActiveWindow
USER32.dll514RegisterClassW
USER32.dll701wsprintfA
USER32.dll694WaitMessage
USER32.dll225FindWindowA
USER32.dll372GetWindowTextA
USER32.dll407IsDialogMessageW
USER32.dll561ScreenToClient
USER32.dll598SetRectEmpty
USER32.dll565SetCursor
USER32.dll343GetSubMenu
USER32.dll1ActivateKeyboardLayout
USER32.dll642SwitchToThisWindow
USER32.dll510RedrawWindow
USER32.dll634ShowOwnedPopups
USER32.dll36ChangeMenuW
USER32.dll294GetKeyboardType
USER32.dll151DestroyMenu
USER32.dll99CreateWindowExW
USER32.dll461MessageBoxA
USER32.dll137DefFrameProcA
USER32.dll193EnableWindow
USER32.dll185DrawTextA
USER32.dll466MessageBoxW
USER32.dll50CharToOemA
USER32.dll533RemovePropW
USER32.dll552SendMessageW
USER32.dll646TabbedTextOutW
USER32.dll272GetDlgItemTextA
USER32.dll511RegisterClassA
KERNEL32.dll790OpenFile
KERNEL32.dll282EnumResourceLanguagesA
KERNEL32.dll681HeapWalk
KERNEL32.dll614GetTimeFormatA
KERNEL32.dll869ReleaseMutex
KERNEL32.dll788OpenEventA
KERNEL32.dll1148lstrcpyW
KERNEL32.dll197CreateDirectoryW
KERNEL32.dll262DisconnectNamedPipe
KERNEL32.dll1138lstrcatA
KERNEL32.dll535GetPriorityClass
KERNEL32.dll753LocalUnlock
KERNEL32.dll1048TryEnterCriticalSection
KERNEL32.dll223CreatePipe
KERNEL32.dll355FindNextFileW
KERNEL32.dll118AddAtomA
KERNEL32.dll988SetPriorityClass
GDI32.dll337GetBrushOrgEx
GDI32.dll153CreateFontA
GDI32.dll140CreateCompatibleBitmap
GDI32.dll478SetDIBitsToDevice
GDI32.dll416OffsetRgn
GDI32.dll466SetBitmapBits
GDI32.dll413MoveToEx
GDI32.dll464SetAbortProc
GDI32.dll500SetRectRgn
GDI32.dll320GetDIBits
GDI32.dll527UnrealizeObject
GDI32.dll442RectVisible
GDI32.dll199EnumFontsW
GDI32.dll170CreatePolygonRgn
GDI32.dll171CreateRectRgn
GDI32.dll454RoundRect
GDI32.dll205Escape
comdlg32.dll13GetSaveFileNameW
comdlg32.dll20PrintDlgW
comdlg32.dll11GetOpenFileNameW
comdlg32.dll19PrintDlgExW
comdlg32.dll5CommDlgExtendedError
COMCTL32.dll21CreateStatusWindowW
COMCTL32.dll22CreateToolbarEx
COMCTL32.dll23DestroyPropertySheetPage
ordentry_vafunction_name
10x5559?MDdklJDILuDOIUUIODIUdiIODoidOPdd@@YGKEPA_WG@Z
module_nameY_eMjeuUkWG.uni
flags0
timestamp2011-05-14 08:41:12
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x2b20c
Functions(1)0x2b208
NameOrdinals(1)0x2b210
offsetsizetypecomment
0246797EXE05/14/2011 08:41:12#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK