filenameRibbons.scr
size120832 (0x1d800)
md50c35c32d4435836df9339178c7a56fde
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
207655012
2066550121
205655015
2036550119
10219
2116550172
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x54504666
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x10800
SizeOfInitializedData0xf800
SizeOfUninitializedData0
AddressOfEntryPoint0x10b00
BaseOfCode0x1000
BaseOfData0x12000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x22000
SizeOfHeaders0x400
CheckSum0x1f3e9
Subsystem2
DllCharacteristics0xc140
SizeOfStackReserve0xaae60
SizeOfStackCommit0x9000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 2005

Sections

namevavsizeraw sizeflags
.text0x10000x106a40x10800R-X CODE
.data0x120000x3cfc0x1200RW- IDATA
.idata0x160000xcd40xe00R-- IDATA
.rsrc0x170000x9d380x9e00R-- IDATA
.reloc0x210000xc280xe00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1620c0xc8
RESOURCE0x170000x9d38
EXCEPTION00
SECURITY00
BASERELOC0x210000xc28
DEBUG0x13100x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x21500x5c
Bound_IAT00
IAT0x160000x208
Delay_IAT00
CLR_Header00
typenamesizecp
BMP#102363110
MUI#12240
ICON#13040
ICON#27440
GROUP_ICON#101340
VERSION#19000
MANIFEST#112060
module_namehintordfunction_name
ADVAPI32.dll645RegOpenKeyExW
ADVAPI32.dll658RegQueryValueExW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll657RegQueryValueExA
ADVAPI32.dll605RegCreateKeyExW
ADVAPI32.dll644RegOpenKeyExA
KERNEL32.dll823HeapSetInformation
KERNEL32.dll1362Sleep
KERNEL32.dll701GetStartupInfoA
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1377TerminateProcess
KERNEL32.dll772GetVersionExA
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll669GetProcAddress
KERNEL32.dll1017OutputDebugStringA
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll393FindResourceW
KERNEL32.dll1361SizeofResource
KERNEL32.dll939LoadResource
KERNEL32.dll957LockResource
KERNEL32.dll839InitializeCriticalSection
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll457GetCommandLineW
KERNEL32.dll976MulDiv
KERNEL32.dll1070QueryPerformanceFrequency
KERNEL32.dll754GetTickCount
USER32.dll589MessageBoxW
USER32.dll214DrawTextW
USER32.dll755SetRect
USER32.dll855UpdateWindow
USER32.dll495InvalidateRect
USER32.dll685ScreenToClient
USER32.dll836UnionRect
USER32.dll783SetWindowPos
USER32.dll161DefWindowProcW
USER32.dll233EndPaint
USER32.dll261FillRect
USER32.dll14BeginPaint
USER32.dll713SetCursor
USER32.dll537KillTimer
USER32.dll769SetTimer
USER32.dll620PeekMessageW
USER32.dll815SystemParametersInfoW
USER32.dll605OffsetRect
USER32.dll494IntersectRect
USER32.dll560LoadStringW
USER32.dll625PostQuitMessage
USER32.dll426GetSystemMetrics
USER32.dll814SystemParametersInfoA
USER32.dll756SetRectEmpty
USER32.dll624PostMessageW
USER32.dll371GetMessageW
USER32.dll113CreateWindowExW
USER32.dll831TranslateMessage
USER32.dll181DispatchMessageW
USER32.dll247EnumDisplaySettingsW
USER32.dll545LoadCursorW
USER32.dll547LoadIconW
USER32.dll650RegisterClassW
USER32.dll293GetClientRect
USER32.dll2AdjustWindowRect
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll1327srand
msvcrt.dll113_XcptFilter
msvcrt.dll203__p__commode
msvcrt.dll275_amsg_exit
msvcrt.dll163__getmainargs
msvcrt.dll228__set_app_type
msvcrt.dll1200exit
msvcrt.dll373_exit
msvcrt.dll294_cexit
msvcrt.dll208__p__fmode
msvcrt.dll521_ismbblead
msvcrt.dll230__setusermatherr
msvcrt.dll490_initterm
msvcrt.dll249_acmdln
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll313_controlfp
msvcrt.dll364_except_handler4_common
msvcrt.dll610_lock
msvcrt.dll966_unlock
msvcrt.dll159__dllonexit
msvcrt.dll779_onexit
msvcrt.dll1291memcpy
msvcrt.dll394_finite
msvcrt.dll1262iswdigit
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1307qsort
msvcrt.dll1166_wtol
msvcrt.dll1006_vsnwprintf
msvcrt.dll1310rand
msvcrt.dll1365time
msvcrt.dll1295memset
msvcrt.dll425_ftol2_sse
msvcrt.dll424_ftol2
msvcrt.dll58_CIacos
msvcrt.dll61_CIatan2
msvcrt.dll69_CIsin
msvcrt.dll71_CIsqrt
COMCTL32.dll123InitCommonControlsEx
COMCTL32.dll344
ole32.dll127CoUninitialize
ole32.dll80CoInitializeEx
GDI32.dll503GetDeviceCaps
GDI32.dll732SetBkColor
GDI32.dll271DeleteObject
GDI32.dll725SelectObject
GDI32.dll66CreateFontW
GDI32.dll346ExcludeClipRect
GDI32.dll569GetStockObject
GDI32.dll772SetTextColor
d3d9.dll10Direct3DCreate9
WINMM.dll148timeGetTime

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionRibbons Screen Saver
FileVersion6.3.9600.17415 (winblue_r4.141028-1500)
InternalNameRibbons
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameRibbons
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.17415

VS_FIXEDFILEINFO

FileVersion6.3.9600.17415
ProductVersion6.3.9600.17415
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0120832EXE10/29/2014 01:44:06#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK