filenameevrika.exe
size251392 (0x3d600)
md511dc4986ceefb98aa2eb647c06820a94
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
221204263
223204262
2242042619
225204264
203655018
10173
2292061730
219206171
15101
222206171

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x52972a80
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x10600
SizeOfInitializedData0x47000
SizeOfUninitializedData0
AddressOfEntryPoint0x106b4
BaseOfCode0x1000
BaseOfData0x12000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x5a000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x105770x10600R-X CODE
.rdata0x120000x2b540x2c00R-- IDATA
.data0x150000x1cde00x2a00RW- IDATA
.rsrc0x320000x257a00x25800R-- IDATA
.reloc0x580000x1d960x1e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x13e4c0x78
RESOURCE0x320000x257a0
EXCEPTION00
SECURITY00
BASERELOC0x580000x148c
DEBUG0x122e00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x131f80x40
Bound_IAT00
IAT0x120000x27c
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAPTABLE108400
BITMAPTOOLBAR266640
ICON#1297620
ICON#2676240
ICON#396400
ICON#442640
ICON#524400
ICON#611280
GROUP_ICONAPPLICATION900
MANIFEST#13810
module_namehintordfunction_name
MSVCR120.dll372__CxxFrameHandler3
MSVCR120.dll1753memcpy
MSVCR120.dll578_controlfp_s
MSVCR120.dll786_invoke_watson
MSVCR120.dll424__crtSetUnhandledExceptionFilter
MSVCR120.dll632_except_handler4_common
MSVCR120.dll309void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR120.dll426__crtTerminateProcess
MSVCR120.dll427__crtUnhandledException
MSVCR120.dll591_crt_debugger_hook
MSVCR120.dll574_commode
MSVCR120.dll672_fmode
MSVCR120.dll525_acmdln
MSVCR120.dll778_initterm
MSVCR120.dll779_initterm_e
MSVCR120.dll499__setusermatherr
MSVCR120.dll575_configthreadlocale
MSVCR120.dll815_ismbblead
MSVCR120.dll1757memset
MSVCR120.dll558_cexit
MSVCR120.dll641_exit
MSVCR120.dll1612exit
MSVCR120.dll497__set_app_type
MSVCR120.dll437__getmainargs
MSVCR120.dll534_amsg_exit
MSVCR120.dll412__crtGetShowWindowMode
MSVCR120.dll363_XcptFilter
MSVCR120.dll1080_onexit
MSVCR120.dll429__dllonexit
MSVCR120.dll557_calloc_crt
MSVCR120.dll1282_unlock
MSVCR120.dll914_lock
MSVCR120.dll111public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR120.dll1517atoi
MSVCR120.dll1838strncmp
MSVCR120.dll112void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR120.dll1095_purecall
MSVCR120.dll114void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSIMG32.dllAlphaBlend
MSIMG32.dll2GradientFill
KERNEL32.dll724GetSystemTimeAsFileTime
KERNEL32.dll610GetModuleHandleA
KERNEL32.dll185CreateFileA
KERNEL32.dll1258SetFilePointer
KERNEL32.dll1486WriteFile
KERNEL32.dll1087ReadFile
KERNEL32.dll591GetLocalTime
KERNEL32.dll126CloseHandle
KERNEL32.dll973MulDiv
KERNEL32.dll804GlobalSize
KERNEL32.dll800GlobalLock
KERNEL32.dll789GlobalAlloc
KERNEL32.dll807GlobalUnlock
KERNEL32.dll287EncodePointer
KERNEL32.dll253DecodePointer
KERNEL32.dll869IsDebuggerPresent
KERNEL32.dll874IsProcessorFeaturePresent
KERNEL32.dll1053QueryPerformanceCounter
KERNEL32.dll520GetCurrentProcessId
KERNEL32.dll524GetCurrentThreadId
USER32.dll704SetCapture
USER32.dll285GetClassInfoExA
USER32.dll337GetKeyNameTextA
USER32.dll825TrackPopupMenu
USER32.dll648RegisterClassExA
USER32.dll489InsertMenuItemA
USER32.dll459GetWindowRect
USER32.dll685ScreenToClient
USER32.dll367GetMessageA
USER32.dll713SetCursor
USER32.dll173DestroyWindow
USER32.dll73ClientToScreen
USER32.dll233EndPaint
USER32.dll57CharUpperA
USER32.dll498IsCharAlphaA
USER32.dll204DrawFrameControl
USER32.dll548LoadImageA
USER32.dll202DrawFocusRect
USER32.dll211DrawTextA
USER32.dll710SetClipboardData
USER32.dll606OpenClipboard
USER32.dll223EmptyClipboard
USER32.dll296GetClipboardData
USER32.dll507IsClipboardFormatAvailable
USER32.dll75CloseClipboard
USER32.dll339GetKeyState
USER32.dll824TrackMouseEvent
USER32.dll546LoadIconA
USER32.dll293GetClientRect
USER32.dll109CreateMenu
USER32.dll724SetFocus
USER32.dll695SendMessageA
USER32.dll14BeginPaint
USER32.dll281GetCapture
USER32.dll831TranslateMessage
USER32.dll353GetMenu
USER32.dll463GetWindowTextA
USER32.dll573MapVirtualKeyA
USER32.dll780SetWindowLongA
USER32.dll495InvalidateRect
USER32.dll16BringWindowToTop
USER32.dll452GetWindowLongA
USER32.dll112CreateWindowExA
USER32.dll311GetDesktopWindow
USER32.dll423GetSysColor
USER32.dll783SetWindowPos
USER32.dll307GetCursorPos
USER32.dll361GetMenuItemInfoA
USER32.dll800ShowWindow
USER32.dll110CreatePopupMenu
USER32.dll271GetActiveWindow
USER32.dll9AppendMenuA
USER32.dll359GetMenuItemCount
USER32.dll623PostMessageA
USER32.dll180DispatchMessageA
USER32.dll3AdjustWindowRectEx
USER32.dll676ReleaseCapture
USER32.dll426GetSystemMetrics
USER32.dll787SetWindowTextA
USER32.dll855UpdateWindow
USER32.dll228EnableWindow
USER32.dll171DestroyMenu
USER32.dll740SetMenuItemInfoA
USER32.dll542LoadCursorA
USER32.dll160DefWindowProcA
GDI32.dll789TextOutA
GDI32.dll568GetStockObject
GDI32.dll550GetObjectA
GDI32.dll671RoundRect
GDI32.dll592GetTextMetricsA
GDI32.dll490GetClipBox
GDI32.dll652Polyline
GDI32.dll480GetCharWidth32A
GDI32.dll80CreateRectRgn
GDI32.dll739SetDCPenColor
GDI32.dll660Rectangle
GDI32.dll48CreateCompatibleBitmap
GDI32.dll475GetCharABCWidthsA
GDI32.dll49CreateCompatibleDC
GDI32.dll722SelectClipRgn
GDI32.dll724SelectObject
GDI32.dll270DeleteObject
GDI32.dll732SetBkMode
GDI32.dll738SetDCBrushColor
GDI32.dll502GetDeviceCaps
GDI32.dll61CreateFontA
GDI32.dll54CreateDIBSection
GDI32.dll267DeleteDC
GDI32.dll771SetTextColor
GDI32.dll609LineTo
GDI32.dll635PatBlt
GDI32.dll19BitBlt
GDI32.dll623MoveToEx
GDI32.dll491GetClipRgn
offsetsizetypecomment
0251392EXE11/28/2013 11:35:28#
15c115HTM#
1629029762PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER