exesax-gui.exe

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	exesax-gui.exe
size	36352 (0x8e00)
md5	20de5e27034bf1035e8db9dff4b895ab

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x450eedfc
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	2.56
SizeOfCode	0x5200
SizeOfInitializedData	0x8a00
SizeOfUninitializedData	0xe00
AddressOfEntryPoint	0x1290
BaseOfCode	0x1000
BaseOfData	0x7000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xe000
SizeOfHeaders	0x400
CheckSum	0xc269
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MingWin32 GCC 3.x

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x5074	0x5200	R-X CODE IDATA
.data	0x7000	0x40	0x200	RW- IDATA
.rdata	0x8000	0xbe0	0xc00	R-- IDATA
.bss	0x9000	0xd50	0	RW- UDATA
.idata	0xa000	0x64c	0x800	RW- IDATA
.rsrc	0xb000	0x21a0	0x2200	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa000	0x64c
RESOURCE	0xb000	0x21a0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
BITMAP	LOGO	4984
ICON	#1	744
ICON	#2	296
DIALOG	EXESAXDIALOG	758
DIALOG	REPORTDIALOG	608
STRING	#626	314
STRING	#632	114
STRING	#638	106
GROUP_ICON	ICON	34

id	lang	string
10000	1033	The file was encrypted successfully.
10001	1033	The input file was not found.
10002	1033	The output file could not be created.
10003	1033	Failed to encrypt EXE file. Reason:
10100	1033	Open input .exe
10101	1033	Set name of encrypted .exe
10200	1033	cave (end of code section)
10201	1033	new section

module_name	hint	function_name
COMDLG32.DLL	9	GetOpenFileNameA
COMDLG32.DLL	11	GetSaveFileNameA
KERNEL32.dll	1	AddAtomA
KERNEL32.dll	155	ExitProcess
KERNEL32.dll	175	FindAtomA
KERNEL32.dll	220	GetAtomNameA
KERNEL32.dll	236	GetCommandLineA
KERNEL32.dll	335	GetModuleHandleA
KERNEL32.dll	362	GetProcAddress
KERNEL32.dll	384	GetStartupInfoA
KERNEL32.dll	522	LoadLibraryA
KERNEL32.dll	736	SetUnhandledExceptionFilter
msvcrt.dll	39	__getmainargs
msvcrt.dll	60	__p__environ
msvcrt.dll	62	__p__fmode
msvcrt.dll	80	__set_app_type
msvcrt.dll	111	_assert
msvcrt.dll	121	_cexit
msvcrt.dll	233	_iob
msvcrt.dll	350	_onexit
msvcrt.dll	388	_setmode
msvcrt.dll	445	_vsnprintf
msvcrt.dll	533	abort
msvcrt.dll	540	atexit
msvcrt.dll	545	calloc
msvcrt.dll	557	fclose
msvcrt.dll	560	fflush
msvcrt.dll	568	fopen
msvcrt.dll	569	fprintf
msvcrt.dll	574	fread
msvcrt.dll	575	free
msvcrt.dll	579	fseek
msvcrt.dll	581	ftell
msvcrt.dll	583	fwrite
msvcrt.dll	626	malloc
msvcrt.dll	632	memcpy
msvcrt.dll	634	memset
msvcrt.dll	639	printf
msvcrt.dll	647	rand
msvcrt.dll	648	realloc
msvcrt.dll	656	signal
msvcrt.dll	659	sprintf
msvcrt.dll	665	strcmp
USER32.dll	146	DialogBoxParamA
USER32.dll	181	EndDialog
USER32.dll	252	GetDlgItem
USER32.dll	348	GetWindowTextA
USER32.dll	405	LoadIconA
USER32.dll	415	LoadStringA
USER32.dll	430	MessageBoxA
USER32.dll	464	PostQuitMessage
USER32.dll	502	SendMessageA
USER32.dll	568	SetWindowTextA

show previews

offset	size	type	comment
0	36352	EXE	09/18/2006 19:05:32	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK