filename93[1].exe
size342016 (0x53800)
md52248c83531b381e2f49cba879bb226be
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1492102240
13121022125
1473072911
10249
1322102234
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x56add40c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x19a00
SizeOfInitializedData0x39a00
SizeOfUninitializedData0
AddressOfEntryPoint0x7820
BaseOfCode0x1000
BaseOfData0x1c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0xab000
SizeOfHeaders0x400
CheckSum0xa005d9d
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.porn0x10000x5100x600R-X CODE
.text0x20000x1923e0x19400R-X CODE
.rdata0x1c0000xbc9e0xbe00R-- IDATA
.data0x280000x550340x2400RW- IDATA
.cats0x7e0000x4800x600R-- IDATA
.rsrc0x7f0000x2b1380x2b200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x267f40x78
RESOURCE0x7f0000x2b138
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x263100x40
Bound_IAT00
IAT0x1c0000x3e0
Delay_IAT00
CLR_Header00
typenamesizecp
GROUP_CURSOR#131758931252
MANIFEST#13811252
module_namehintordfunction_name
USER32.dll553OpenIcon
USER32.dll573PrivateExtractIconsA
USER32.dll613ReleaseDC
USER32.dll289GetDC
USER32.dll631SendMessageA
USER32.dll818wsprintfA
USER32.dll655SetDlgItemTextA
USER32.dll218EndDialog
USER32.dll163DestroyIcon
USER32.dll626SendDlgItemMessageA
USER32.dll297GetDlgItemTextA
USER32.dll171DialogBoxParamA
USER32.dll480IsWindowVisible
USER32.dll806WaitForInputIdle
USER32.dll379GetSysColor
USER32.dll565PostMessageA
USER32.dll668SetMenu
USER32.dll658SetFocus
USER32.dll486LoadBitmapA
USER32.dll492LoadIconA
USER32.dll53CharToOemA
USER32.dll545OemToCharA
USER32.dll273GetClassNameA
USER32.dll57CharUpperA
USER32.dll412GetWindowRect
USER32.dll356GetParent
USER32.dll521MapWindowPoints
USER32.dll109CreateWindowExA
USER32.dll785UpdateWindow
USER32.dll714SetWindowTextA
USER32.dll488LoadCursorA
USER32.dll588RegisterClassExA
USER32.dll707SetWindowLongA
USER32.dll405GetWindowLongA
USER32.dll155DefWindowProcA
USER32.dll562PeekMessageA
USER32.dll345GetMessageA
USER32.dll764TranslateMessage
USER32.dll174DispatchMessageA
USER32.dll276GetClientRect
USER32.dll85CopyRect
USER32.dll475IsWindow
USER32.dll526MessageBoxA
USER32.dll735ShowWindow
USER32.dll295GetDlgItem
USER32.dll216EnableWindow
USER32.dll248FindWindowExA
USER32.dll820wvsprintfA
USER32.dll54CharToOemBuffA
USER32.dll505LoadStringA
USER32.dll710SetWindowPos
USER32.dll416GetWindowTextA
USER32.dll398GetWindow
USER32.dll382GetSystemMetrics
USER32.dll546OemToCharBuffA
USER32.dll166DestroyWindow
SHELL32.dll290ShellExecuteW
SHELL32.dll207SHGetMalloc
SHELL32.dll223SHGetSpecialFolderLocation
SHELL32.dll123SHBrowseForFolderW
SHELL32.dll189SHGetFileInfoW
SHELL32.dll215SHGetPathFromIDListW
SHELL32.dll195SHGetFolderPathW
SHELL32.dll225SHGetSpecialFolderPathW
SHELL32.dll286ShellExecuteA
SHELL32.dll127SHChangeNotify
ADVAPI32.dll341GetSidIdentifierAuthority
ADVAPI32.dll356GetUserNameA
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll331GetSecurityDescriptorOwner
GDI32.dll49CreateDCA
GDI32.dll53CreateDIBSection
GDI32.dll54CreateDIBitmap
GDI32.dll61CreateFontIndirectA
GDI32.dll64CreateFontIndirectW
GDI32.dll73CreatePalette
GDI32.dll74CreatePatternBrush
GDI32.dll75CreatePen
GDI32.dll79CreateRectRgn
GDI32.dll80CreateRectRgnIndirect
GDI32.dll84CreateSolidBrush
GDI32.dll164DPtoLP
GDI32.dll227DeleteDC
GDI32.dll230DeleteObject
GDI32.dll291EnumFontFamiliesA
GDI32.dll294EnumFontFamiliesW
GDI32.dll306ExtCreatePen
GDI32.dll311ExtTextOutA
GDI32.dll426GetBkMode
GDI32.dll440GetCharWidthA
GDI32.dll445GetCharWidthW
GDI32.dll458GetDIBits
GDI32.dll459GetDeviceCaps
GDI32.dll473GetFontData
GDI32.dll496GetMapMode
GDI32.dll502GetNearestColor
GDI32.dll507GetObjectA
GDI32.dll512GetPaletteEntries
GDI32.dll516GetPixel
GDI32.dll48CreateCompatibleDC
GDI32.dll525GetStockObject
GDI32.dll534GetTextCharset
GDI32.dll541GetTextExtentPoint32A
GDI32.dll542GetTextExtentPoint32W
GDI32.dll543GetTextExtentPointA
GDI32.dll546GetTextFaceA
GDI32.dll548GetTextFaceW
GDI32.dll549GetTextMetricsA
GDI32.dll572OffsetClipRgn
GDI32.dll582PatBlt
GDI32.dll584Pie
GDI32.dll598Polygon
GDI32.dll599Polyline
GDI32.dll604RealizePalette
GDI32.dll605RectInRegion
GDI32.dll607Rectangle
GDI32.dll616ResizePalette
GDI32.dll629SelectClipRgn
GDI32.dll631SelectObject
GDI32.dll632SelectPalette
GDI32.dll638SetBkColor
GDI32.dll639SetBkMode
GDI32.dll642SetBrushOrgEx
GDI32.dll660SetMapMode
GDI32.dll666SetPaletteEntries
GDI32.dll670SetPolyFillMode
GDI32.dll671SetROP2
GDI32.dll672SetRectRgn
GDI32.dll676SetTextAlign
GDI32.dll678SetTextColor
GDI32.dll47CreateCompatibleBitmap
GDI32.dll41CreateBitmap
GDI32.dll34CombineRgn
GDI32.dll26Chord
GDI32.dll19BitBlt
GDI32.dll11Arc
GDI32.dll524GetRgnBox
GDI32.dll503GetNearestPaletteIndex
GDI32.dll602PtVisible
GDI32.dll509GetObjectW
GDI32.dll50CreateDCW
GDI32.dll550GetTextMetricsW
GDI32.dll570MoveToEx
GDI32.dll566LineTo
GDI32.dll312ExtTextOutW
GDI32.dll455GetDCOrgEx
GDI32.dll606RectVisible
GDI32.dll448GetClipBox
GDI32.dll65CreateFontW
GDI32.dll43CreateBitmapIndirect
GDI32.dll701UpdateColors
GDI32.dll698TranslateCharsetInfo
GDI32.dll697TextOutW
GDI32.dll696TextOutA
GDI32.dll692StretchDIBits
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll717HeapCreate
KERNEL32.dll1260VirtualFree
KERNEL32.dll719HeapFree
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll581GetProcAddress
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1222TlsFree
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll370GetCPInfo
KERNEL32.dll360GetACP
KERNEL32.dll567GetOEMCP
KERNEL32.dll778IsValidCodePage
KERNEL32.dll1202Sleep
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll281ExitProcess
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll516GetLocaleInfoA
KERNEL32.dll269EnumSystemLocalesA
KERNEL32.dll780IsValidLocale
KERNEL32.dll614GetStringTypeA
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll617GetStringTypeW
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll352FreeEnvironmentStringsA
KERNEL32.dll472GetEnvironmentStrings
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll1135SetHandleCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll659GetTickCount
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll1048RtlUnwind
KERNEL32.dll945RaiseException
KERNEL32.dll811LCMapStringA
KERNEL32.dll813LCMapStringW
KERNEL32.dll828LoadLibraryA
KERNEL32.dll724HeapSize
KERNEL32.dll410GetConsoleCP
KERNEL32.dll428GetConsoleMode
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll97CompareStringA
KERNEL32.dll100CompareStringW
KERNEL32.dll1110SetEnvironmentVariableA
KERNEL32.dll1306WriteConsoleA
KERNEL32.dll432GetConsoleOutputCP
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll1159SetStdHandle
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll228DosDateTimeToFileTime
KERNEL32.dll514GetLastError
KERNEL32.dll82CloseHandle
KERNEL32.dll1130SetFileTime
KERNEL32.dll862MoveFileA
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll499GetFileType
KERNEL32.dll136CreateFileA
KERNEL32.dll143CreateFileW
KERNEL32.dll960ReadFile
KERNEL32.dll612GetStdHandle
KERNEL32.dll1139SetLastError
KERNEL32.dll1317WriteFile
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll722HeapReAlloc
KERNEL32.dll715HeapAlloc
KERNEL32.dll661GetTimeFormatA
KERNEL32.dll454GetDateFormatA
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll390GetCommandLineA
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll209DeleteCriticalSection
offsetsizetypecomment
0342016EXE01/31/2016 09:29:48#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[!] refusing to read CURDIRENTRY beyond resource size