btest.exe

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	btest.exe
size	156672 (0x26400)
md5	2143135f5838498121c97a1fb915c170

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x426511e4
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	2.56
SizeOfCode	0x26000
SizeOfInitializedData	0x1000
SizeOfUninitializedData	0x5b000
AddressOfEntryPoint	0x81640
BaseOfCode	0x5c000
BaseOfData	0x82000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x83000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x5b000	0	RWX UDATA
UPX1	0x5c000	0x26000	0x25800	RWX IDATA
.rsrc	0x82000	0x1000	0xa00	RW- IDATA

Data Directory

type	va	size
EXPORT	0x69000	0x3d6d
IMPORT	0x82624	0x20c
RESOURCE	0x82000	0x624
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#1	308
BITMAP	BMP_CHAINED	180
BITMAP	BMP_NORTH_EAST	180
BITMAP	#300	314
BITMAP	#301	314
BITMAP	#302	318
BITMAP	#303	318
BITMAP	#304	322
BITMAP	#305	314
BITMAP	#306	322
BITMAP	#307	310
BITMAP	#308	326
BITMAP	#309	314
BITMAP	#310	310
BITMAP	#2001	36162
ICON	#1	296
ICON	#2	296
ICON	#3	296
GROUP_CURSOR	#100	20
GROUP_ICON	#200	20
GROUP_ICON	#201	20
GROUP_ICON	#202	20

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			ExitProcess
ADVAPI32.DLL			RegOpenKeyExA
COMCTL32.DLL			InitCommonControls
GDI32.dll			BitBlt
msvcrt.dll			_iob
OLE32.dll			DoDragDrop
SHELL32.DLL			ShellExecuteA
USER32.dll			GetDC
WS2_32.DLL			bind

ord	entry_va	function_name

module_name
flags	0x4dbf0f12
timestamp	2061-09-24 12:43:58
version	13173.31425
ordinal_base	2281629894
nFunctions	3999854995
nNames	2026269478
Names(2026269478)	0xcb26ae82
Functions(3999854995)	0x64268329
NameOrdinals(2026269478)	0x1a40c753

show previews

offset	size	type	comment
0	156672	EXE	04/19/2005 14:12:52	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] refusing to read CURDIRENTRY beyond resource size

[!] refusing to read ICODIRENTRY beyond resource size

[?] can't find file_offset of VA 0x159ac826

[?] can't find file_offset of VA 0x64268329

[?] can't find file_offset of VA 0x1a40c753

[?] can't find file_offset of VA 0xcb26ae82

[?] can't find file_offset of VA 0x64268329

[?] can't find file_offset of VA 0x1a40c753