filenameKawai2003.exe
size2308608 (0x233a00)
md51a309c3321d69e31bd3898488f442440
typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00xa8
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x73757269
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion4.20
SizeOfCode0x119000
SizeOfInitializedData0x1000
SizeOfUninitializedData0x116000
AddressOfEntryPoint0x16a0
BaseOfCode0x117000
BaseOfData0x230000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x234000
SizeOfHeaders0x1000
CheckSum0x124244
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual Basic v5.0

Sections

namevavsizeraw sizeflags
UPX00x10000x1160000x116000RWX CODE
UPX10x1170000x1190000x119000RWX CODE
.rsrc0x2300000x30000x3000RWX CODE
.pb3UPX0x2330000x10000xa00RWX CODE

Data Directory

typevasize
EXPORT00
IMPORT0x2330000x28
RESOURCE0x2300000xde4
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
CUSTOM#10111880001200
CUSTOM#1024921200
CUSTOM#10328881200
CUSTOM#10416721200
CUSTOM#10532561200
CUSTOM#106206241200
CUSTOM#107537801200
CUSTOM#108339521200
CUSTOM#109255441200
ICON#3000122161200
GROUP_ICON#1201200
VERSION#16041200
module_namehintordfunction_name
MSVBVM50.DLL__vbaStrI2
MSVBVM50.DLL_CIcos
MSVBVM50.DLL_adj_fptan
MSVBVM50.DLL__vbaStrI4
MSVBVM50.DLL__vbaVarVargNofree
MSVBVM50.DLL__vbaAryMove
MSVBVM50.DLL__vbaFreeVar
MSVBVM50.DLL__vbaLenBstr
MSVBVM50.DLL__vbaStrVarMove
MSVBVM50.DLL589
MSVBVM50.DLL__vbaFreeVarList
MSVBVM50.DLL__vbaEnd
MSVBVM50.DLL_adj_fdiv_m64
MSVBVM50.DLL622
MSVBVM50.DLL__vbaFreeObjList
MSVBVM50.DLL_adj_fprem1
MSVBVM50.DLL__vbaCopyBytes
MSVBVM50.DLL__vbaStrCat
MSVBVM50.DLL__vbaLsetFixstr
MSVBVM50.DLL__vbaSetSystemError
MSVBVM50.DLL__vbaRecDestruct
MSVBVM50.DLL__vbaHresultCheckObj
MSVBVM50.DLL_adj_fdiv_m32
MSVBVM50.DLL__vbaAryDestruct
MSVBVM50.DLL592
MSVBVM50.DLL__vbaExitProc
MSVBVM50.DLL593
MSVBVM50.DLL594
MSVBVM50.DLL__vbaOnError
MSVBVM50.DLL__vbaObjSet
MSVBVM50.DLL595
MSVBVM50.DLL596
MSVBVM50.DLL_adj_fdiv_m16i
MSVBVM50.DLL__vbaObjSetAddref
MSVBVM50.DLL_adj_fdivr_m16i
MSVBVM50.DLL598
MSVBVM50.DLL__vbaFpR4
MSVBVM50.DLL__vbaStrFixstr
MSVBVM50.DLL520
MSVBVM50.DLL__vbaFpR8
MSVBVM50.DLL__vbaBoolVarNull
MSVBVM50.DLL_CIsin
MSVBVM50.DLL631
MSVBVM50.DLL__vbaVargVarMove
MSVBVM50.DLL__vbaChkstk
MSVBVM50.DLL__vbaFileClose
MSVBVM50.DLL526
MSVBVM50.DLLEVENT_SINK_AddRef
MSVBVM50.DLL__vbaGenerateBoundsError
MSVBVM50.DLL__vbaStrCmp
MSVBVM50.DLL529
MSVBVM50.DLL__vbaVarTstEq
MSVBVM50.DLL__vbaPutOwner3
MSVBVM50.DLL__vbaGet4
MSVBVM50.DLL__vbaI2I4
MSVBVM50.DLL561
MSVBVM50.DLLDllFunctionCall
MSVBVM50.DLL__vbaVarOr
MSVBVM50.DLL__vbaAryConstruct
MSVBVM50.DLL_adj_fpatan
MSVBVM50.DLL__vbaFixstrConstruct
MSVBVM50.DLLEVENT_SINK_Release
MSVBVM50.DLL_CIsqrt
MSVBVM50.DLL__vbaVarAnd
MSVBVM50.DLLEVENT_SINK_QueryInterface
MSVBVM50.DLL__vbaExceptHandler
MSVBVM50.DLL__vbaStrToUnicode
MSVBVM50.DLL_adj_fprem
MSVBVM50.DLL_adj_fdivr_m64
MSVBVM50.DLL__vbaFPException
MSVBVM50.DLL__vbaGetOwner3
MSVBVM50.DLL535
MSVBVM50.DLL__vbaI2Var
MSVBVM50.DLL645
MSVBVM50.DLL_CIlog
MSVBVM50.DLL__vbaErrorOverflow
MSVBVM50.DLL__vbaFileOpen
MSVBVM50.DLL__vbaVar2Vec
MSVBVM50.DLL__vbaNew2
MSVBVM50.DLL648
MSVBVM50.DLL_adj_fdiv_m32i
MSVBVM50.DLL_adj_fdivr_m32i
MSVBVM50.DLL__vbaStrCopy
MSVBVM50.DLL__vbaI4Str
MSVBVM50.DLL__vbaFreeStrList
MSVBVM50.DLL_adj_fdivr_m32
MSVBVM50.DLL_adj_fdiv_r
MSVBVM50.DLL578
MSVBVM50.DLL100
MSVBVM50.DLL__vbaI4Var
MSVBVM50.DLL__vbaVarCmpEq
MSVBVM50.DLL__vbaAryLock
MSVBVM50.DLL__vbaStrToAnsi
MSVBVM50.DLL__vbaVarDup
MSVBVM50.DLL__vbaFpI2
MSVBVM50.DLL__vbaFpI4
MSVBVM50.DLL__vbaR8IntI2
MSVBVM50.DLL617
MSVBVM50.DLL_CIatan
MSVBVM50.DLL__vbaStrMove
MSVBVM50.DLL_allmul
MSVBVM50.DLL__vbaLenVarB
MSVBVM50.DLL_CItan
MSVBVM50.DLL__vbaAryUnlock
MSVBVM50.DLL__vbaFPInt
MSVBVM50.DLL_CIexp
MSVBVM50.DLL__vbaFreeObj
MSVBVM50.DLL__vbaFreeStr
MSVBVM50.DLL581

StringTable 040404B0

CompanyNameCHEN PROGRAM STUDY
LegalTrademarksCPS
ProductNameKawai2003
FileVersion1.00
ProductVersion1.00
InternalNameKAWAI2~1
OriginalFilenameKAWAI2~1.exe

VS_FIXEDFILEINFO

FileVersion1.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
02308608EXE05/20/2031 20:54:01#
15c115HTM#
208329581GIF(768 x 550)#
1046470544GIF(768 x 550)#
24182190641JPG#
52a78104345JPG#
6c25a135090JPG#
8d255118633JPG#
aa207132683JPG#
2218f420616WAV#
2269843246WAV#
22763c1664WAV#
227cc42880WAV#
22880c484WAV#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK