filenameABECaveMod.exe.vir
size35566267 (0x21eb2bb)
md52050401365f3b39dc59a78cd533bb81d
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
259307957
26130795191
2603079510
253318234
2613182340
2603182317
259318239
2573079511
10139
2603194320
258319431

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x64d8b4fa
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.34
SizeOfCode0x28800
SizeOfInitializedData0x3a800
SizeOfUninitializedData0
AddressOfEntryPoint0xb310
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x78000
SizeOfHeaders0x400
CheckSum0x21f79aa
Subsystem2
DllCharacteristics0xc160
SizeOfStackReserve0x1e8480
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x288000x28800R-X CODE
.rdata0x2a0000x12b160x12c00R-- IDATA
.data0x3d0000x103f80xe00RW- IDATA
.pdata0x4e0000x20c40x2200R-- IDATA
_RDATA0x510000x15c0x200R-- IDATA
.rsrc0x520000x240bc0x24200R-- IDATA
.reloc0x770000x7580x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x3bd0c0x78
RESOURCE0x520000x240bc
EXCEPTION0x4e0000x20c4
SECURITY00
BASERELOC0x770000x758
DEBUG0x394800x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x393400x140
Bound_IAT00
IAT0x2a0000x418
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#18371252
ICON#216701252
ICON#327591252
ICON#456081252
ICON#593211252
ICON#6304431252
ICON#7949451252
GROUP_ICON#01041252
MANIFEST#114231252
module_namehintordfunction_name
USER32.dll118CreateWindowExW
USER32.dll651MessageBoxW
USER32.dll644MessageBoxA
USER32.dll934SystemParametersInfoW
USER32.dll177DestroyIcon
USER32.dll895SetWindowLongPtrW
USER32.dll490GetWindowLongPtrW
USER32.dll307GetClientRect
USER32.dll548InvalidateRect
USER32.dll767ReleaseDC
USER32.dll323GetDC
USER32.dll222DrawTextW
USER32.dll328GetDialogBaseUnits
USER32.dll242EndDialog
USER32.dll184DialogBoxIndirectParamW
USER32.dll657MoveWindow
USER32.dll795SendMessageW
COMCTL32.dll380
KERNEL32.dll760GetStringTypeW
KERNEL32.dll606GetFileAttributesExW
KERNEL32.dll883HeapReAlloc
KERNEL32.dll441FlushFileBuffers
KERNEL32.dll555GetCurrentDirectoryW
KERNEL32.dll942IsValidCodePage
KERNEL32.dll460GetACP
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll1041MulDiv
KERNEL32.dll637GetLastError
KERNEL32.dll1344SetDllDirectoryW
KERNEL32.dll657GetModuleFileNameW
KERNEL32.dll717GetProcAddress
KERNEL32.dll497GetCommandLineW
KERNEL32.dll597GetEnvironmentVariableW
KERNEL32.dll694GetOEMCP
KERNEL32.dll380ExpandEnvironmentStringsW
KERNEL32.dll201CreateDirectoryW
KERNEL32.dll793GetTempPathW
KERNEL32.dll1552WaitForSingleObject
KERNEL32.dll1460Sleep
KERNEL32.dll600GetExitCodeProcess
KERNEL32.dll246CreateProcessW
KERNEL32.dll753GetStartupInfoW
KERNEL32.dll453FreeLibrary
KERNEL32.dll998LoadLibraryExW
KERNEL32.dll1307SetConsoleCtrlHandler
KERNEL32.dll399FindClose
KERNEL32.dll405FindFirstFileExW
KERNEL32.dll148CloseHandle
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll1010LocalFree
KERNEL32.dll449FormatMessageW
KERNEL32.dll1042MultiByteToWideChar
KERNEL32.dll1591WideCharToMultiByte
KERNEL32.dll475GetCPInfo
KERNEL32.dll595GetEnvironmentStringsW
KERNEL32.dll452FreeEnvironmentStringsW
KERNEL32.dll724GetProcessHeap
KERNEL32.dll819GetTimeZoneInformation
KERNEL32.dll885HeapSize
KERNEL32.dll1610WriteConsoleW
KERNEL32.dll1350SetEnvironmentVariableW
KERNEL32.dll1283RtlUnwindEx
KERNEL32.dll1269RtlCaptureContext
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll1476TerminateProcess
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll1136QueryPerformanceCounter
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll906InitializeSListHead
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll1346SetEndOfFile
KERNEL32.dll1380SetLastError
KERNEL32.dll329EnterCriticalSection
KERNEL32.dll992LeaveCriticalSection
KERNEL32.dll291DeleteCriticalSection
KERNEL32.dll902InitializeCriticalSectionAndSpinCount
KERNEL32.dll1494TlsAlloc
KERNEL32.dll1496TlsGetValue
KERNEL32.dll1497TlsSetValue
KERNEL32.dll1495TlsFree
KERNEL32.dll325EncodePointer
KERNEL32.dll1159RaiseException
KERNEL32.dll1279RtlPcToFileHeader
KERNEL32.dll496GetCommandLineA
KERNEL32.dll218CreateFileW
KERNEL32.dll587GetDriveTypeW
KERNEL32.dll611GetFileInformationByHandle
KERNEL32.dll618GetFileType
KERNEL32.dll1091PeekNamedPipe
KERNEL32.dll1473SystemTimeToTzSpecificLocalTime
KERNEL32.dll388FileTimeToSystemTime
KERNEL32.dll629GetFullPathNameW
KERNEL32.dll1247RemoveDirectoryW
KERNEL32.dll422FindNextFileW
KERNEL32.dll1407SetStdHandle
KERNEL32.dll296DeleteFileW
KERNEL32.dll1176ReadFile
KERNEL32.dll755GetStdHandle
KERNEL32.dll1611WriteFile
KERNEL32.dll376ExitProcess
KERNEL32.dll660GetModuleHandleExW
KERNEL32.dll880HeapFree
KERNEL32.dll534GetConsoleMode
KERNEL32.dll1173ReadConsoleW
KERNEL32.dll1365SetFilePointerEx
KERNEL32.dll538GetConsoleOutputCP
KERNEL32.dll616GetFileSizeEx
KERNEL32.dll876HeapAlloc
KERNEL32.dll436FlsAlloc
KERNEL32.dll438FlsGetValue
KERNEL32.dll439FlsSetValue
KERNEL32.dll437FlsFree
KERNEL32.dll170CompareStringW
KERNEL32.dll980LCMapStringW
ADVAPI32.dll523OpenProcessToken
ADVAPI32.dll347GetTokenInformation
ADVAPI32.dll129ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll123ConvertSidToStringSidW
GDI32.dll884SelectObject
GDI32.dll399DeleteObject
GDI32.dll67CreateFontIndirectW
offsetsizetypecomment
15c115HTM#
3ec08837PNG(16 x 16)#
3ef501670PNG(24 x 24)#
3f5d82759PNG(32 x 32)#
400a05608PNG(48 x 48)#
416889321PNG(64 x 64)#
43af430443PNG(128 x 128)#
4b1e094945PNG(256 x 256)#
624c135163642BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 35566267 bytes (34 MiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER