2014-05 rechnung.9847559832.PDF.exe

info
MZ
PE
resources
strings
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	2014-05 rechnung.9847559832.PDF.exe
size	194568 (0x2f808)
md5	242ce522d7b0d26c408b875b5b6ce371

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
93	4035	10
14	7299	2
11	8047	2
10	8047	11
4	8047	2
126	9782	3
4	9782	3
1	0	271
11	8168	10
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x537079f1
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x4000
SizeOfInitializedData	0x5000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4582
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xa000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
\|text	0x1000	0x3e72	0x4000	R-X CODE
.rdata	0x5000	0x1c36	0x2000	R-- IDATA
.data	0x7000	0xf17	0xe00	RW- IDATA
.rsrc	0x8000	0x14b8	0x2000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x64e8	0xa0
RESOURCE	0x8000	0x1430
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5000	0x461
Delay_IAT	0	0
CLR_Header	0	0
	0	0x65000000

show previews

type	name	size	cp	r
MENU	#128	302	0	0
DIALOG	#100	214	0	0
DIALOG	#130	194	0	0
DIALOG	#133	254	0	0
STRING	#9	132	0	0
STRING	#3585	50	0	0
STRING	#3601	230	0	0
STRING	#3602	192	0	0
STRING	#3603	310	0	0
STRING	#3604	60	0	0
STRING	#3605	96	0	0
STRING	#3606	84	0	0
STRING	#3697	58	0	0
STRING	#3825	164	0	0
STRING	#3826	62	0	0
STRING	#3841	58	0	0
ACCELERATORS	#128	112	0	0
VERSION	#1	3688857186	3358762196	4116982970
VERSION	#1 / #3499128181	2445140366	2139212097	918142188
VERSION	#1 / #3499128181	1439244701	2777364542	1504616502
VERSION	#1	4015182869	1347835136	3230002315
#241	#128	14	0	0

id	lang	string
128	2052	cluster Cluste Cluster.Document Cluste Document
57344	2052	cluster
57345	2052	就绪
57600	2052	建立新文档新建
57601	2052	打开一个现有文档打开
57602	2052	关闭活动文档关闭
57603	2052	保存活动文档保存
57604	2052	将活动文档以一个新文件名保存另存为
57605	2052	改变打印选项页面设置
57606	2052	改变打印机及打印选项打印设置
57607	2052	打印活动文档打印
57609	2052	显示整页打印预览
57616	2052	打开该文档
57617	2052	打开该文档
57618	2052	打开该文档
57619	2052	打开该文档
57620	2052	打开该文档
57621	2052	打开该文档
57622	2052	打开该文档
57623	2052	打开该文档
57624	2052	打开该文档
57625	2052	打开该文档
57626	2052	打开该文档
57627	2052	打开该文档
57628	2052	打开该文档
57629	2052	打开该文档
57630	2052	打开该文档
57631	2052	打开该文档
57632	2052	删除被选对象删除
57633	2052	全部删除全部删除
57634	2052	复制被选对象并将其置于剪贴板上复制
57635	2052	剪切被选对象并将其置于剪贴板上剪切
57636	2052	查找指定的正文查找
57637	2052	插入剪贴板内容粘贴
57640	2052	重复上一步操作重复
57641	2052	用不同的正文替换指定的正文替换
57642	2052	选择整个文档选择全部
57643	2052	撤消最后一步操作撤消
57644	2052	重新执行先前已撤消的操作重新执行
57653	2052	将活动的窗口分隔成窗格分隔
57664	2052	显示程序信息，版本号和版权关于
57665	2052	退出应用程序；提示保存文档退出
57680	2052	切换到下一个窗格下一窗格
57681	2052	切换回前一个窗格前一窗格
59136	2052	扩展名
59137	2052	大写
59138	2052	数字
59139	2052	滚动
59140	2052	改写
59141	2052	记录
61184	2052	改变窗口大小
61185	2052	改变窗口位置
61186	2052	将窗口缩小成图标
61187	2052	把窗口放大到最大尺寸
61188	2052	切换到下一个文档窗口
61189	2052	切换到先前的文档窗口
61190	2052	关闭活动的窗口并提示保存所有文档
61202	2052	把窗口恢复到正常大小
61203	2052	激活任务表
61445	2052	关闭打印预览模式取消预阅

module_name	hint	ord	function_name
MFC42u.DLL		1089
MFC42u.DLL		5193
MFC42u.DLL		2388
MFC42u.DLL		3341
MFC42u.DLL		5296
MFC42u.DLL		5298
MFC42u.DLL		2717
MFC42u.DLL		4074
MFC42u.DLL		4692
MFC42u.DLL		5303
MFC42u.DLL		5285
MFC42u.DLL		5710
MFC42u.DLL		2977
MFC42u.DLL		3142
MFC42u.DLL		3254
MFC42u.DLL		4459
MFC42u.DLL		3131
MFC42u.DLL		3257
MFC42u.DLL		2980
MFC42u.DLL		3076
MFC42u.DLL		2971
MFC42u.DLL		3825
MFC42u.DLL		3826
MFC42u.DLL		3820
MFC42u.DLL		3074
MFC42u.DLL		4075
MFC42u.DLL		4616
MFC42u.DLL		4418
MFC42u.DLL		3733
MFC42u.DLL		561
MFC42u.DLL		825
MFC42u.DLL		815
MFC42u.DLL		617
MFC42u.DLL		6211
MFC42u.DLL		5297
MFC42u.DLL		5208
MFC42u.DLL		296
MFC42u.DLL		986
MFC42u.DLL		520
MFC42u.DLL		823
MFC42u.DLL		4154
MFC42u.DLL		6113
MFC42u.DLL		2613
MFC42u.DLL		1131
MFC42u.DLL		5261
MFC42u.DLL		4370
MFC42u.DLL		4847
MFC42u.DLL		4992
MFC42u.DLL		4704
MFC42u.DLL		2506
MFC42u.DLL		6048
MFC42u.DLL		4073
MFC42u.DLL		1767
MFC42u.DLL		4401
MFC42u.DLL		5237
MFC42u.DLL		2377
MFC42u.DLL		5157
MFC42u.DLL		6370
MFC42u.DLL		4347
MFC42u.DLL		5276
MFC42u.DLL		3793
MFC42u.DLL		4831
MFC42u.DLL		4435
MFC42u.DLL		2640
MFC42u.DLL		2047
MFC42u.DLL		6372
MFC42u.DLL		3744
MFC42u.DLL		5059
MFC42u.DLL		1720
MFC42u.DLL		5257
MFC42u.DLL		2438
MFC42u.DLL		2116
MFC42u.DLL		5273
MFC42u.DLL		4621
MFC42u.DLL		4419
MFC42u.DLL		3592
MFC42u.DLL		324
MFC42u.DLL		641
MFC42u.DLL		4229
MFC42u.DLL		1817
MFC42u.DLL		4233
MFC42u.DLL		4690
MFC42u.DLL		3053
MFC42u.DLL		3060
MFC42u.DLL		6332
MFC42u.DLL		2502
MFC42u.DLL		2534
MFC42u.DLL		5239
MFC42u.DLL		5736
MFC42u.DLL		1739
MFC42u.DLL		5573
MFC42u.DLL		3167
MFC42u.DLL		5649
MFC42u.DLL		4414
MFC42u.DLL		4947
MFC42u.DLL		4852
MFC42u.DLL		2391
MFC42u.DLL		4381
MFC42u.DLL		3449
MFC42u.DLL		3193
MFC42u.DLL		6076
MFC42u.DLL		6171
MFC42u.DLL		4617
MFC42u.DLL		4420
MFC42u.DLL		338
MFC42u.DLL		652
MFC42u.DLL		4817
MFC42u.DLL		4608
MFC42u.DLL		4607
MFC42u.DLL		1937
MFC42u.DLL		4268
MFC42u.DLL		3917
MFC42u.DLL		4893
MFC42u.DLL		5070
MFC42u.DLL		4335
MFC42u.DLL		4343
MFC42u.DLL		4717
MFC42u.DLL		4884
MFC42u.DLL		4525
MFC42u.DLL		4539
MFC42u.DLL		4537
MFC42u.DLL		4520
MFC42u.DLL		4523
MFC42u.DLL		4518
MFC42u.DLL		4958
MFC42u.DLL		4955
MFC42u.DLL		4103
MFC42u.DLL		6051
MFC42u.DLL		1768
MFC42u.DLL		5236
MFC42u.DLL		5286
MFC42u.DLL		3743
MFC42u.DLL		1719
MFC42u.DLL		4426
MFC42u.DLL		623
MFC42u.DLL		813
MFC42u.DLL		540
MFC42u.DLL		304
MFC42u.DLL		560
MFC42u.DLL		800
MFC42u.DLL		5256
MFC42u.DLL		3688
MFC42u.DLL		3621
MFC42u.DLL		3658
MFC42u.DLL		668
MFC42u.DLL		613
MFC42u.DLL		629
MFC42u.DLL		1967
MFC42u.DLL		2406
MFC42u.DLL		4290
MFC42u.DLL		1634
MFC42u.DLL		4056
MFC42u.DLL		310
MFC42u.DLL		1763
MFC42u.DLL		1565
MFC42u.DLL		1972
MFC42u.DLL		2762
MFC42u.DLL		537
MFC42u.DLL		4128
MFC42u.DLL		4292
MFC42u.DLL		289
MFC42u.DLL		356
MFC42u.DLL		922
MFC42u.DLL		6168
MFC42u.DLL		5784
MFC42u.DLL		858
MFC42u.DLL		4124
MFC42u.DLL		5679
MFC42u.DLL		5568
MFC42u.DLL		2914
MFC42u.DLL		2527
MFC42u.DLL		2708
MFC42u.DLL		2371
MFC42u.DLL		1165
MFC42u.DLL		472
MFC42u.DLL		1965
MFC42u.DLL		5168
MFC42u.DLL		2286
MFC42u.DLL		2354
MFC42u.DLL		665
MFC42u.DLL		1971
MFC42u.DLL		3313
MFC42u.DLL		5180
MFC42u.DLL		354
MFC42u.DLL		1834
MFC42u.DLL		4237
MFC42u.DLL		2715
MFC42u.DLL		2382
MFC42u.DLL		3054
MFC42u.DLL		5094
MFC42u.DLL		5097
MFC42u.DLL		4461
MFC42u.DLL		4298
MFC42u.DLL		3345
MFC42u.DLL		5006
MFC42u.DLL		975
MFC42u.DLL		5468
MFC42u.DLL		3398
MFC42u.DLL		2874
MFC42u.DLL		2873
MFC42u.DLL		4146
MFC42u.DLL		4072
MFC42u.DLL		5233
MFC42u.DLL		5278
MFC42u.DLL		2641
MFC42u.DLL		1658
MFC42u.DLL		4430
MFC42u.DLL		4421
MFC42u.DLL		796
MFC42u.DLL		674
MFC42u.DLL		554
MFC42u.DLL		529
MFC42u.DLL		366
MFC42u.DLL		807
MFC42u.DLL		2486
MFC42u.DLL		2619
MFC42u.DLL		2618
MFC42u.DLL		5996
MFC42u.DLL		2109
MFC42u.DLL		4158
MFC42u.DLL		6617
MFC42u.DLL		4451
MFC42u.DLL		5248
MFC42u.DLL		5727
MFC42u.DLL		2504
MFC42u.DLL		2546
MFC42u.DLL		4480
MFC42u.DLL		6371
MFC42u.DLL		4269
MFC42u.DLL		4604
MFC42u.DLL		4606
MFC42u.DLL		4583
MFC42u.DLL		4609
MFC42u.DLL		1569
MSVCRT.dll	139		__wgetmainargs
MSVCRT.dll	271		_initterm
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	390		_onexit
MSVCRT.dll	46		void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCRT.dll	183		_controlfp
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	694		strcat
MSVCRT.dll	599		fopen
MSVCRT.dll	585		exit
MSVCRT.dll	241		_ftol
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	678		rand
MSVCRT.dll	692		srand
MSVCRT.dll	720		time
MSVCRT.dll	487		_wcmdln
KERNEL32.dll	440		GetStartupInfoW
KERNEL32.dll	386		GetModuleHandleW
KERNEL32.dll	323		GetCurrentProcessId
KERNEL32.dll	382		GetModuleFileNameW
KERNEL32.dll	646		OpenProcess
USER32.dll	445		LoadCursorW
USER32.dll	589		SetCursor
USER32.dll	700		UpdateWindow
USER32.dll	196		EnableWindow
GDI32.dll	502		Rectangle
GDI32.dll	71		CreatePen
GDI32.dll	148		Ellipse
OLEAUT32.dll		9
PSAPI.DLL	15		GetModuleFileNameExW

show previews

offset	size	type	comment
0	40960	EXE	05/12/2014 07:36:17	#
15c1	15	HTM		#
a000	15679	JPG		#
dd3f	137929	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 194568 bytes (191 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 45577 entries in directory, but got EOF on 14494-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 40109 entries in directory, but got EOF on 5529-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 48643 entries in directory, but got EOF on 16602-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "\xB6\xDD" on UTF-16LE

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 107701

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 41512 entries in directory, but got EOF on 2365-th.

[?] can't find file_offset of VA 0x13106633

[?] can't find file_offset of VA 0x7d76ad97

[?] can't find file_offset of VA 0x8948ace2

[?] can't find file_offset of VA 0xff0c75ff

[?] can't find file_offset of VA 0x0