| filename | c72c709959b0ea5cbe6bf4a5411811e537b02534fa1457f9d7bfa2c9f98ec1a7 | |
|---|---|---|
| size | 39936 (0x9c00) | |
| md5 | 0f4caaa39137d175f05a1322a90335cb | |
| type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x50 |
| blocks_in_file | 2 |
| num_relocs | 0 |
| header_paragraphs | 4 |
| min_extra_paragraphs | 0xf |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0x1a |
| reserved0 | 0 |
| oem_id | 0 |
| oem_info | 0 |
| reserved2 | 0 |
| reserved3 | 0 |
| reserved4 | 0 |
| reserved5 | 0 |
| reserved6 | 0 |
| lfanew | 0x100 |
DOS stub
00000000: ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 |........!..L.!..| 00000010: 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 |This program mus| 00000020: 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 |t be run under W| 00000030: 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 |in32..$7........| 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000000c0:
PE Header
Packer / Compiler
This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0x18000 | 0 | RWX UDATA | |
| UPX1 | 0x19000 | 0x9000 | 0x9000 | RWX IDATA | |
| .rsrc | 0x22000 | 0x1000 | 0x800 | RW- IDATA |
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0x226b4 | 0x14c | |
| RESOURCE | 0x22000 | 0x6b4 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0x21f10 | 0x18 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0 | 0 | |
| Delay_IAT | 0 | 0 | |
| CLR_Header | 0 | 0 |
TLS
| raw start | raw end | index | callbks | zero fill | flags | |
|---|---|---|---|---|---|---|
| 0x421f28 | 0x421f34 | 0x413788 | 0 | 0 | 0 |
| type | name | size | cp | |
|---|---|---|---|---|
| STRING | #4090 | 88 | 0 | |
| STRING | #4091 | 488 | 0 | |
| STRING | #4092 | 204 | 0 | |
| STRING | #4093 | 376 | 0 | |
| STRING | #4094 | 916 | 0 | |
| STRING | #4095 | 860 | 0 | |
| STRING | #4096 | 640 | 0 | |
| RCDATA | DVCLAL | 16 | 0 | |
| RCDATA | PACKAGEINFO | 224 | 0 | |
| MANIFEST | #1 | 1103 | 0 |
| id | lang | string |
|---|---|---|
| 65424 | 0 | 猿j⩫载ƍ맻쎬ᏼꔫ๚牞ᦜﯜ痍鎉⮋㌫麘ᅚល⹂沟⚃鬖兯䬖ꆻ⚢쳊瀕퐰였曕툆抻 |
| 65440 | 0 | 1f 75 09 d8 a9 9e 7b 18 4e cd 72 65 47 54 3c a4 |.u....{.N.reGT<.|
51 c5 f3 cf f8 2a 7b fa 6b aa cc 4b cd f6 b1 81 |Q....*{.k..K....|
06 97 90 7b f2 a4 8b c7 e4 c4 37 6f 3d 5d 45 9c |...{......7o=]E.|
e7 1b 2e 41 bf ac e3 14 86 97 57 ca 8f 8d 7b 26 |...A......W...{&|
ee 08 2d c7 c2 16 f7 2c d8 12 cc 02 d3 d2 c8 8e |..-....,........|
48 2b 9b 57 cd b2 47 3f dd 0a ab 13 9f cc dd fb |H+.W..G?........|
4f 59 86 b1 b1 41 4a a8 27 8e 34 a5 7b 45 1b 65 |OY...AJ.'.4.{E.e|
c4 ff 67 d4 7b 7d e4 44 c5 aa 44 ed 62 56 53 25 |..g.{}.D..D.bVS%|
f0 c1 d3 f9 b5 b6 77 17 ea 48 5a 0d de ee a0 45 |......w..HZ....E|
41 de f6 f3 32 c9 18 85 2e bc 3e 70 a2 b8 82 9b |A...2.....>p....|
d4 17 90 8e 1f a7 24 ba 4b 6f e9 05 cd dc 98 02 |......$.Ko......|
1f bd ed 36 65 2b b7 15 0b 94 8d f1 df 9f 68 53 |...6e+........hS|
37 a0 63 c0 dc 0f 99 fb 54 bc fd c2 39 4b 5f 3d |7.c.....T...9K_=|
31 66 95 f6 55 ab a4 24 b4 97 da 8b 34 35 2c e3 |1f..U..$....45,.|
ea aa 99 de 91 33 3d fd 5c 7f 25 1f 51 19 b0 59 |.....3=.\.%.Q..Y|
ff aa 40 c4 2f 1e 3d 2b 5f 98 6c 81 c8 b1 4f fb |..@./.=+_.l...O.|
d9 45 97 40 97 e1 ba 98 e8 d8 9f 83 35 b9 6b 2e |.E.@........5.k.|
c2 10 56 98 4e 58 85 dd de a8 d4 53 a4 45 8c 5b |..V.NX.....S.E.[|
7d 88 fc c0 bc 95 03 21 49 58 6f 32 67 52 da 26 |}......!IXo2gR.&|
34 ef 95 fe 67 99 1a bb ff 69 05 99 f4 05 8e 36 |4...g....i.....6|
c5 ad 61 33 64 4d 24 80 af af 0a bd 68 e3 cf 25 |..a3dM$.....h..%|
75 ac 1b 8f 23 9f 17 fa 00 a8 bb b2 b3 83 8c 54 |u...#..........T|
9f 19 3f 1f ac f6 23 de 0c 01 47 8e 80 50 a7 2e |..?...#...G..P..|
dc 9d 80 06 27 e4 89 1e 44 80 cf 20 1a 77 de 6d |....'...D.. .w.m|
f1 e2 da df b5 e3 fb 37 71 48 b1 7b 39 52 27 50 |.......7qH.{9R'P|
40 26 38 9c ab dd 82 7b b2 c9 c6 80 5e fb a9 09 |@&8....{....^...|
ef 6c 62 1a 81 41 38 8d 0a e2 c6 65 e3 b3 da 12 |.lb..A8....e....|
71 ed 80 9a c9 d3 fd 0e 4e b9 de 5f b0 38 89 57 |q.......N.._.8.W|
e3 e9 64 a8 f0 73 68 84 d0 8f d8 f3 2d 99 91 37 |..d..sh.....-..7|
9f 1e 1d 75 53 a4 10 7d 85 49 11 a0 40 a3 31 d6 |...uS..}.I..@.1.|
5e a4 b8 09 3b 2f 8c a2 |^...;/.. |
|
| 65456 | 0 | 4f 85 30 ad 29 3c 0d 21 47 2d 81 df 1b 34 ee 2f |O.0.)<.!G-...4./| a8 d4 56 8b 01 20 50 d5 e9 e3 fd 03 d8 45 cc aa |..V.. P......E..| fe 72 c0 e8 db aa df e2 48 eb c7 11 f7 fb 24 4d |.r......H.....$M| 60 6e 7e c3 c5 c3 cd f6 aa f7 60 0f bc bf 9b 9f |`n~.......`.....| 5c 8d 6f ce e2 2f 45 d9 47 88 ef 42 63 2c 82 6a |\.o../E.G..Bc,.j| 6a 35 30 f8 cd 35 2e 47 7d 5b 80 f0 2a 17 0a ef |j50..5.G}[..*...| ee a7 02 f8 0b 33 a9 52 d7 69 82 d8 01 c4 de 31 |.....3.R.i.....1| 5a 61 e1 ca 28 e2 d2 4d 70 38 6a eb 12 88 9b 3d |Za..(..Mp8j....=| d5 be b7 fa 73 ef 6b 43 da 11 0b 3b 5e 7a af 30 |....s.kC...;^z.0| 91 f7 47 f4 6b bc 2e 2e 42 61 40 21 fd cb 8d af |..G.k...Ba@!....| cf 39 6f 5c 42 2a 13 38 b8 1b e1 a4 9c ac 2b e5 |.9o\B*.8......+.| d7 a2 e0 8e 46 2d 96 35 c0 59 8b b5 0a a2 0e fc |....F-.5.Y......| ae b9 79 5e 98 c2 a2 d9 90 16 10 c7 |..y^........ | |
| 65472 | 0 | 9b 52 b2 5d a2 7c 66 f6 08 13 6f 92 9b 7e cf af |.R.].|f...o..~..| 2b a0 55 f4 7c b6 b9 13 89 d1 b5 a7 8b fd 77 fa |+.U.|.........w.| a6 a8 fc 3c 69 c5 49 db 1d 9a 89 3b d7 a7 f5 5f |... |
| 65488 | 0 | be d0 d4 e3 9c 42 7f 67 4e 50 30 15 33 be 0a b6 |.....B.gNP0.3...|
bd 0c 11 00 cd 8f c2 d9 fc db 09 36 64 72 6e d4 |...........6drn.|
73 e5 76 34 f0 a7 01 35 cb 1f fe db c9 e1 8e a5 |s.v4...5........|
ac ed 62 64 44 d1 7f 45 b2 67 ff 09 29 ab 66 75 |..bdD..E.g..).fu|
77 20 7a 9b ea a5 04 b5 d2 b6 14 96 62 2b 28 f8 |w z.........b+(.|
d6 97 7b f9 c6 ce c3 95 99 28 65 b3 ef cb 60 30 |..{......(e...`0|
63 34 57 8e 26 f5 0f 28 45 81 27 14 61 08 d9 f7 |c4W.&..(E.'.a...|
26 8a 25 fa a1 1d 98 c9 3c 36 aa 6a 7c a7 ae ba |&.%.....<6.j|...|
3f 35 78 65 8a 78 a9 4c 0c fc f6 0c e0 9c c8 c5 |?5xe.x.L........|
75 05 18 72 27 7c 39 fc ea 6a a9 33 a7 5a 84 87 |u..r'|9..j.3.Z..|
36 9f 1e 7c a3 d7 09 e8 41 b2 02 0c 0c c2 17 c5 |6..|....A.......|
a9 d0 fd e9 18 4a d0 af b8 aa 49 3e d1 96 c2 93 |.....J....I>....|
71 00 f2 ac 99 0e ef 17 ec d9 ba 5f 18 47 61 6d |q.........._.Gam|
41 3e 6b 20 e9 75 30 ee 68 2e 45 18 a6 8e 16 b1 |A>k .u0.h.E.....|
0a f2 23 5c 51 f7 a8 e0 16 1f 33 34 66 07 c4 b5 |..#\Q.....34f...|
7c 03 9d a8 c6 ac 4e 49 d6 4d 6f 51 78 df 3b 32 ||.....NI.MoQx.;2|
21 13 6a 46 7a 85 d7 26 a6 08 b9 0f b4 39 dd 0c |!.jFz..&.....9..|
d3 4c c1 66 d9 9e f4 8b 9f 0a 1a ea 4c 92 da 06 |.L.f........L...|
02 75 17 6a 28 39 ab 7d 1e a5 21 c6 30 c3 98 60 |.u.j(9.}..!.0..`|
98 46 20 65 ca 2f d7 8c 81 28 9c ab 73 0f 1a bc |.F e./...(..s...|
c3 c2 12 d2 78 af af 38 b6 0a ff 15 d2 4e bc e2 |....x..8.....N..|
19 16 18 fa 86 4f fd db 0d ef 6b 0b 17 30 28 86 |.....O....k..0(.|
06 03 fc 81 05 ee 31 42 73 eb 26 5e 6d 91 ce 78 |......1Bs.&^m..x|
14 1e 97 92 b9 ed 3a 05 0d a1 f8 1f a4 4b 90 2c |......:......K.,|
31 ec 23 a5 fb 44 59 f7 a7 98 34 2a e7 d0 49 fe |1.#..DY...4*..I.|
54 bb 2c d9 54 a8 44 72 53 26 aa 79 bf 2f 71 ec |T.,.T.DrS&.y./q.|
49 f0 13 1b 3c 10 6b e1 d6 d6 f2 0c 28 7a 03 97 |I...<.k.....(z..|
dd 7a f4 52 16 ce 14 ba 20 21 e5 c0 33 da 2a 46 |.z.R.... !..3.*F|
8e e5 10 b2 09 8d 1a 3c 6d 2b 0e 0f 7d 70 88 84 |....... |
| 65504 | 0 | 13 bf 15 68 03 e5 1d 1c 8e 96 83 40 f0 d1 4f 41 |...h.......@..OA|
2d b6 25 f6 61 01 ab 6e 31 c4 07 09 b0 b8 ee 2a |-.%.a..n1......*|
61 41 d6 eb 56 bf 7f 42 0a 5a df c8 8d ec f3 04 |aA..V..B.Z......|
95 82 7f f0 53 06 04 17 e0 6a 76 c4 ca e1 2f 68 |....S....jv.../h|
0f a9 b7 82 9d c3 1a 13 f4 7c 3b cb 42 ed 17 51 |.........|;.B..Q|
67 b6 67 4d 75 f6 be bc 7a 3d 07 2e 74 12 6d 4b |g.gMu...z=..t.mK|
1f b2 5e f7 c1 d8 58 e8 92 d5 c8 67 47 5e ac d7 |..^...X....gG^..|
0d e3 1f 90 80 4a c7 4a a0 4e 99 7d 8f d0 3b c1 |.....J.J.N.}..;.|
aa 5f 3b e3 f5 5d 5a ca 00 be 26 46 1a e7 f4 12 |._;..]Z...&F....|
ea 73 03 b4 f8 2d 97 b7 25 2d 46 54 5a d0 d5 f1 |.s...-..%-FTZ...|
44 e5 98 81 bd 0a 7b 52 06 e1 df ca 44 30 f6 6a |D.....{R....D0.j|
e4 8a 3d 61 dd d3 c9 bb 96 ca 99 e0 37 1e 5b 20 |..=a........7.[ |
95 5e 10 87 b1 7c 2d 3a 1a 83 a1 1c ce 8b 92 2c |.^...|-:.......,|
0b 6e ab 36 ef f5 24 19 89 ff eb e0 0a bf ff c1 |.n.6..$.........|
d0 c9 a4 ca ba f6 f6 da be 90 77 cb fe 63 28 5a |..........w..c(Z|
31 03 8c cd 0e 6c 47 30 27 20 08 b5 ec 4b ce 8e |1....lG0' ...K..|
31 f1 c0 1b 8a a0 d1 43 1b 33 ab 10 f7 68 d4 2c |1......C.3...h.,|
5f 9e bd a9 bc 21 c6 24 49 bb 3a 08 90 e7 69 2b |_....!.$I.:...i+|
e3 dd 3a 91 57 43 0b d6 00 b4 ab ec b4 1f e2 2e |..:.WC..........|
16 93 8e 0f 86 c0 9e da e0 fd af 73 7e 98 a6 81 |...........s~...|
13 6d 18 b0 4a b4 ad f4 1d 8e cb 65 15 57 7c 11 |.m..J......e.W|.|
dd 59 0d 49 1b a4 7f d3 c0 a1 4e 74 4d 66 4b c7 |.Y.I......NtMfK.|
22 4c 90 2f a2 98 74 2f c2 ae 4d ca d8 b3 8d 17 |"L./..t/..M.....|
2d 61 ba f9 53 be 68 89 e3 ba 66 c9 8e 5d 41 2e |-a..S.h...f..]A.|
50 6b aa e3 b3 96 9a 20 e6 be 87 0b 9f 95 72 5a |Pk..... ......rZ|
8f 34 37 aa e2 7e 1f 05 ac 84 a0 3e 1b 88 14 c1 |.47..~.....>....|
6b f6 b7 41 37 3a 8f 87 75 25 9a 23 a9 27 01 60 |k..A7:..u%.#.'.`|
a7 10 b3 97 bf aa 9d f6 80 c3 0b 33 d5 42 7f 07 |...........3.B..|
fb 71 6a da fc 34 3c 0e 02 75 25 52 3a 80 72 07 |.qj..4<..u%R:.r.|
92 d7 f9 74 db 77 3e 84 e4 ec f0 43 b7 04 e7 70 |...t.w>....C...p|
84 49 b9 71 5d 22 8c 2a 6a f1 7c 72 5f 2d 3a 46 |.I.q]".*j.|r_-:F|
08 ca fc c6 9f a7 7e f9 c7 ce 53 2e c4 29 bc bb |......~...S..)..|
46 6c 32 31 b3 30 12 72 69 0f c9 f5 9e 0e 3a 03 |Fl21.0.ri.....:.|
7b 3a 2d c7 98 75 45 81 91 54 6a 19 4d 0a 89 07 |{:-..uE..Tj.M...|
58 fc 23 09 e4 87 5a a5 bb b3 13 f0 fa 81 f0 76 |X.#...Z........v|
52 ff 1b 35 61 53 8b ae 46 59 d8 c9 c0 69 a3 74 |R..5aS..FY...i.t|
8b da 68 e8 91 67 0e 92 e5 f6 49 1e d1 d0 60 a2 |..h..g....I...`.|
cc 4f a9 3f e6 63 f7 8d b5 22 b9 b2 e1 94 f2 81 |.O.?.c..."......|
c2 a4 4e e5 bb 87 ae 18 62 03 f9 ae 3a 13 d5 a6 |..N.....b...:...|
f2 b4 ba 21 77 48 5b 0b b4 ac b3 92 cc 36 39 85 |...!wH[......69.|
e3 97 3c ea 33 c8 5c f1 e1 64 f1 bc 9e 8e 73 1d |..<.3.\..d....s.|
ad cd ee 6e 59 ad f0 e1 f8 72 f7 7b ca 1d fb 16 |...nY....r.{....|
5b dc 93 bb 0e 60 58 06 7a e1 4b 76 46 e6 90 54 |[....`X.z.KvF..T|
18 ad 72 50 d2 ef 55 09 74 bf 3e 91 43 cc 54 0c |..rP..U.t.>.C.T.|
18 98 62 d5 f5 c9 06 26 1f 2d 93 32 bd e9 e1 fb |..b....&.-.2....|
6e f6 9d 3c 2c 32 bb 84 98 70 38 eb 3e bc a3 ac |n..<,2...p8.>...|
5a de 99 e0 6e 40 6f e7 ea ea 6e b0 27 9f f0 2d |Z...n@o...n.'..-|
e9 ce c2 ef 0a 78 71 ae d8 e8 82 8b 60 e9 4e 70 |.....xq.....`.Np|
95 af 4e ac 6a 1b 34 2c c0 68 86 0f 09 2a dd 5f |..N.j.4,.h...*._|
3a f9 4f 52 f4 e8 ff 5e 4e d9 bc ce dd 09 20 23 |:.OR...^N..... #|
8a 0e 79 a5 f8 c6 87 81 37 43 b0 79 b5 f9 ef 6d |..y.....7C.y...m|
72 8a 1f 49 04 d1 94 12 5a d2 27 7f 78 17 f4 7c |r..I....Z.'.x..||
df 72 f6 bc e3 41 1d 3c b4 1a c6 c0 fb cf 67 00 |.r...A.<......g.|
0e d8 0f f6 89 8a b1 c9 3b d6 c6 ba |........;... |
|
| 65520 | 0 | a6 4c 79 1e 43 93 00 31 e9 8b 16 c6 03 71 ea 23 |.Ly.C..1.....q.#| a7 45 d4 23 d7 94 89 e0 28 5a b5 b8 5f cd d5 43 |.E.#....(Z.._..C| 9d 79 b0 0b 57 88 87 4d 1f ea 83 02 e9 33 b7 90 |.y..W..M.....3..| c5 2f a6 aa 56 41 e9 fb 5a 92 47 1e 71 f8 31 a4 |./..VA..Z.G.q.1.| 56 ed 45 a5 d5 54 73 ba c7 d8 dc b1 19 cb 94 4f |V.E..Ts........O| 44 77 3d ab 26 80 1e 5e ac 3c 67 96 c3 97 c3 94 |Dw=.&..^. |
| module_name | hint | ord | function_name |
|---|---|---|---|
| KERNEL32.DLL | LoadLibraryA | ||
| KERNEL32.DLL | GetProcAddress | ||
| KERNEL32.DLL | VirtualProtect | ||
| KERNEL32.DLL | VirtualAlloc | ||
| KERNEL32.DLL | VirtualFree | ||
| KERNEL32.DLL | ExitProcess | ||
| advapi32.dll | RegFlushKey | ||
| oleaut32.dll | VariantCopy | ||
| user32.dll | CharNextA |
![]() |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[!] string size(34386) > stringtable size(88). truncated to 86
[!] string size(59966) > stringtable size(488). truncated to 486
[!] cannot convert "\t\xD8\xA9\x9E{\x18N\xCDreGT<\xA4Q\xC5"... to UTF-16
[!] string size(68254) > stringtable size(204). truncated to 202
[!] cannot convert "0\xAD)<\r!G-\x81\xDF\e4\xEE/\xA8\xD4"... to UTF-16
[!] string size(42294) > stringtable size(376). truncated to 374
[!] cannot convert "\xB2]\xA2|f\xF6\b\x13o\x92\x9B~\xCF\xAF+\xA0"... to UTF-16
[!] string size(106876) > stringtable size(916). truncated to 914
[!] cannot convert "\xD4\xE3\x9CB\x7FgNP0\x153\xBE\n\xB6\xBD\f"... to UTF-16
[!] string size(97830) > stringtable size(860). truncated to 858
[!] cannot convert "\x15h\x03\xE5\x1D\x1C\x8E\x96\x83@\xF0\xD1OA-\xB6"... to UTF-16
[!] string size(39244) > stringtable size(640). truncated to 638
[!] cannot convert "y\x1EC\x93\x001\xE9\x8B\x16\xC6\x03q\xEA#\xA7E"... to UTF-16
[?] can't find file_offset of VA 0x13788
offset:( 0x )