filenameadwcleaner_5.037.exe
size1518592 (0x172c00)
md50e9f11b207b75ce99e7d9d6c156d8290
typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
225208062
199411181
2232100551
22421005177
2252100553
131307299
1473072937
10544
2344062980
223406291
219210051
15101
222406291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x56d3073d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x122
Magic0x10b
LinkerVersion12.0
SizeOfCode0x56000
SizeOfInitializedData0x11d000
SizeOfUninitializedData0x19e000
AddressOfEntryPoint0x1f4b50
BaseOfCode0x19f000
BaseOfData0x1f5000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x312000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x8040
SizeOfStackReserve0x400000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x400000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX Modified >> *$igBy Ahmed18

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
UPX00x10000x19e0000RWX UDATA
UPX10x19f0000x560000x55e00RWX IDATA
.rsrc0x1f50000x11d0000x11ca00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x3115d00x424
RESOURCE0x1f50000x11c5d0
EXCEPTION00
SECURITY00
BASERELOC0x3119f40xc
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1f4d340x48
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12961252
ICON#28721252
ICON#322161252
ICON#437521252
ICON#5534241252
ICON#642641252
ICON#796401252
STRING#714281252
STRING#816741252
STRING#911681252
STRING#1015321252
STRING#1116281252
STRING#1211261252
STRING#3133441252
RCDATASCRIPT10868671252
GROUP_ICON#99901252
GROUP_ICON#169201252
VERSION#15401252
MANIFEST#116291252
module_namehintordfunction_name
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLVirtualProtect
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLVirtualFree
KERNEL32.DLLExitProcess
ADVAPI32.dllGetAce
COMCTL32.dllImageList_Remove
COMDLG32.dllGetOpenFileNameW
GDI32.dllLineTo
IPHLPAPI.DLLIcmpSendEcho
MPR.dllWNetUseConnectionW
ole32.dllCoGetObject
OLEAUT32.dll8
PSAPI.DLLGetProcessMemoryInfo
SHELL32.dllDragFinish
USER32.dllGetDC
USERENV.dllLoadUserProfileW
UxTheme.dllIsThemeActive
VERSION.dllVerQueryValueW
WININET.dllFtpOpenFileW
WINMM.dlltimeGetTime
WSOCK32.dll4

StringTable 040C04b0

FileVersion5.0.3.7
Commentshttp://www.autoitscript.com/autoit3/
FileDescriptionAdwCleaner
ProductVersion3.3.14.2
LegalCopyrightXplode

VS_FIXEDFILEINFO

FileVersion5.0.3.7
ProductVersion3.3.14.2
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType0
FileSubtype0
offsetsizetypecomment
01518592EXE02/28/2016 14:42:05#
15c115HTM#
5823453424PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0xd9720
[?] can't find file_offset of VA 0xd9cb4
[?] can't find file_offset of VA 0xda340
[?] can't find file_offset of VA 0xda7d0
[?] can't find file_offset of VA 0xdadcc
[?] can't find file_offset of VA 0xdb428
[?] can't find file_offset of VA 0xdb890