Pago_factura-945009686748.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	Pago_factura-945009686748.exe
size	29696 (0x7400)
md5	1c54d766e568675469f45c3fc7df2792

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc0

Rich Header

lib id	version	times used
0	0	24
18	8444	1
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x56112dce
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x2000
SizeOfInitializedData	0x5000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x21c5
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x9000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1f49	0x2000	R-X CODE
.rdata	0x3000	0xf3e	0x1000	R-- IDATA
.data	0x4000	0xab4	0xc00	RW- IDATA
.rsrc	0x5000	0x330f	0x3400	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3000	0x64
RESOURCE	0x5000	0x32d0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x82d4	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x3e66	0xd8
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
UNMAS	#1	12288
POLON	#1	128
DIALOG	#1	128
VERSION	#1	128

module_name	hint	function_name
uxtheme.dll	123	GetThemeTextExtent
uxtheme.dll	124	GetThemeTextMetrics
uxtheme.dll	105	GetThemeFont
uxtheme.dll	121	GetThemeSysSize
uxtheme.dll	53	GetThemeInt
uxtheme.dll	134	GetThemeIntList
uxtheme.dll	100	GetThemeSysBool
uxtheme.dll	42	GetCurrentThemeName
uxtheme.dll	171	IsAppThemed
uxtheme.dll	162	GetThemeSysInt
uxtheme.dll	55	DrawThemeEdge
uxtheme.dll	103	GetThemeEnumValue
uxtheme.dll	136	SetWindowTheme
uxtheme.dll	126	GetWindowTheme
kernel32.dll	437	GetACP
kernel32.dll	1224	DecodePointer
kernel32.dll	536	LoadLibraryA
kernel32.dll	1353	lstrcat
kernel32.dll	205	GetProcAddress
kernel32.dll	771	GetTimeFormatA
kernel32.dll	893	OpenJobObjectW
kernel32.dll	244	CreateMailslotA
kernel32.dll	605	GetLocalTime
kernel32.dll	522	GetLogicalDriveStringsW
kernel32.dll	610	IsBadStringPtrW
kernel32.dll	517	GetSystemDirectoryA
kernel32.dll	588	GetProcessHeap
kernel32.dll	173	CreateDirectoryA
kernel32.dll	1202	SearchPathW
kernel32.dll	1206	WaitForSingleObject
kernel32.dll	469	GetConsoleAliasW
kernel32.dll	29251	eateMailslotA
kernel32.dll	25972	r
kernel32.dll	16761
kernel32.dll	28751	enJobObjectW
kernel32.dll	25970	ss
kernel32.dll	24941	tA
kernel32.dll	25445	tW
kernel32.dll	27763	otA
kernel32.dll	25965
kernel32.dll	29252	iveStringsW
kernel32.dll	20583	trW
kernel32.dll	29289	ectoryA
kernel32.dll	25928	ap
kernel32.dll	29795	oryA
kernel32.dll	87	03 03 47 65 74 54 69 6d 65 46 6f 72 6d 61 74 41 \|..GetTimeFormatA\|
kernel32.dll	27751	eObject
kernel32.dll	27713	iasW
resutils.dll	2	ClusWorkerCreate
resutils.dll	4	ClusWorkerTerminate
resutils.dll	13	ResUtilDupString
resutils.dll	32	ResUtilGetBinaryValue
resutils.dll	3	ClusWorkerStart
resutils.dll	28503	rkerTerminate
resutils.dll	29557	WorkerStart
resutils.dll	26996	lGetBinaryValue
resutils.dll	27715	usWorkerCreate
resutils.dll	25646	ll
user32.dll	2071	LoadAcceleratorsA
user32.dll	1861	DdeInitializeW
user32.dll	1511	BeginPaint
user32.dll	2005	EnumPropsW
user32.dll	2084	MapVirtualKeyW
user32.dll	2298	GetWindowTextW
user32.dll	1586	CloseClipboard
user32.dll	1776	GetPropA
user32.dll	2191	RemovePropA
user32.dll	2095	LockWindowUpdate
user32.dll	2062	IsChild
user32.dll	1851	GetKeyboardState
user32.dll	1741	EndPaint
user32.dll	2072	LoadIconA
user32.dll	29281	dState
user32.dll	25927	tWindowTextW
user32.dll	31337	eW
user32.dll	65	45 07 44 64 65 49 6e 69 74 69 61 6c 69 7a 65 57 \|E.DdeInitializeW\|
user32.dll	12851	.dll
user32.dll	27745	KeyW
user32.dll
user32.dll	100	3b 07 47 65 74 4b 65 79 62 6f 61 72 64 53 74 61 \|;.GetKeyboardSta\| 74 65 \|te \|
user32.dll	25710	owUpdate
user32.dll	28492	adIconA
user32.dll	22387
user32.dll	20590	aint
user32.dll	29554	A
user32.dll	25200	oard

VS_FIXEDFILEINFO

dwSignature	0
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
StrucVersion	0
FileFlagsMask	0
FileFlags	0
FileOS	0
FileType	0
FileSubtype	0

show previews

offset	size	type	comment
0	29696	EXE	10/04/2015 13:46:54	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VS_VERSIONINFO child type "\x00\x00\x00\x00\x00\x00"