calc_upx.exe - CALC.EXE - Windows Calculator

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	calc_upx.exe
size	348672 (0x55200)
md5	2489a3887515e6902700adfd613d0c7f

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
149	21022	9
1	0	367
147	21022	29
132	21022	129
131	21022	25
148	21022	1
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x48ccbd34
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x3f000
SizeOfInitializedData	0x17000
SizeOfUninitializedData	0x66000
AddressOfEntryPoint	0xa52e0
BaseOfCode	0x67000
BaseOfData	0xa6000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	5.256
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xbd000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x66000	0	RWX UDATA
UPX1	0x67000	0x3f000	0x3e600	RWX IDATA
.rsrc	0xa6000	0x17000	0x16800	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xbc44c	0x310
RESOURCE	0xa6000	0x1644c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xbc75c	0x10
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xa54cc	0x48
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x49bac	0x40
CLR_Header	0	0

show previews

type	name	size
IMAGE	#157	7465
IMAGE	#165	4086
IMAGE	#170	4234
IMAGE	#175	4625
IMAGE	#180	4873
IMAGE	#204	3048
IMAGE	#208	3052
IMAGE	#212	3217
IMAGE	#216	3338
IMAGE	#217	4191
IMAGE	#218	4229
IMAGE	#219	4110
IMAGE	#220	4065
IMAGE	#961	3235
IMAGE	#981	470
IMAGE	#982	587
IMAGE	#983	518
IMAGE	#3000	5344
IMAGE	#3015	4154
IMAGE	#3045	4815
IMAGE	#3051	6038
IMAGE	#3060	4290
IMAGE	#3075	4815
IMAGE	#3091	4550
IMAGE	#3100	1545
IMAGE	#3102	1518
IMAGE	#3103	853
IMAGE	#3104	593
IMAGE	#3106	3398
IMAGE	#3107	3605
IMAGE	#3108	3508
IMAGE	#3109	3761
MUI	#1	280
WEVT_TEMPLATE	#1	4750
BITMAP	IDT_BTN_STR_STATISTICS	1064
BITMAP	#965	1064
BITMAP	#975	1064
BITMAP	#977	1064
BITMAP	#979	1064
BITMAP	#980	1064
BITMAP	#985	1064
BITMAP	#3105	2740
ICON	#1	744
ICON	#2	296
ICON	#3	1640
ICON	#4	744
ICON	#5	296
ICON	#6	3752
ICON	#7	2216
ICON	#8	1384
ICON	#9	60175
ICON	#10	9640
ICON	#11	4264
ICON	#12	1128
ICON	#13	1640
ICON	#14	744
ICON	#15	296
ICON	#16	3752
ICON	#17	2216
ICON	#18	1384
ICON	#19	60175
ICON	#20	9640
ICON	#21	4264
ICON	#22	1128
ICON	#23	872
GROUP_ICON	SC	146
GROUP_ICON	#232	34
GROUP_ICON	#233	20
GROUP_ICON	#234	146
VERSION	#1	888
MANIFEST	#1	1167

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		VirtualFree
KERNEL32.DLL		ExitProcess
ADVAPI32.dll		EventWrite
COMCTL32.dll	410
GDI32.dll		LineTo
gdiplus.dll		GdipFree
msvcrt.dll		time
ntdll.dll		WinSqmAddToStream
ole32.dll		CoInitialize
OLEAUT32.dll	2
RPCRT4.dll		UuidCreate
SHELL32.dll	165
SHLWAPI.dll	225
USER32.dll		GetDC
WINMM.dll		timeGetTime

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Calculator
FileVersion	6.1.6801.0 (winmain_win7m3.080913-2030)
InternalName	CALC
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	CALC.EXE
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.6801.0

VS_FIXEDFILEINFO

FileVersion	6.1.6801.0
ProductVersion	6.1.6801.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	348672	EXE	09/14/2008 07:28:52	#
15c1	15	HTM		#
41fd0	60175	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x51e84

[?] can't find file_offset of VA 0x53bb0

[?] can't find file_offset of VA 0x54ba8

[?] can't find file_offset of VA 0x55c34

[?] can't find file_offset of VA 0x56e48

[?] can't find file_offset of VA 0x58154

[?] can't find file_offset of VA 0x58d3c

[?] can't find file_offset of VA 0x59928

[?] can't find file_offset of VA 0x5a5bc

[?] can't find file_offset of VA 0x5b2c8

[?] can't find file_offset of VA 0x5c328

[?] can't find file_offset of VA 0x5d3b0

[?] can't find file_offset of VA 0x5e3c0

[?] can't find file_offset of VA 0x5f3a4

[?] can't find file_offset of VA 0x60048

[?] can't find file_offset of VA 0x60220

[?] can't find file_offset of VA 0x6046c

[?] can't find file_offset of VA 0x60674

[?] can't find file_offset of VA 0x61b54

[?] can't find file_offset of VA 0x62b90

[?] can't find file_offset of VA 0x63e60

[?] can't find file_offset of VA 0x655f8

[?] can't find file_offset of VA 0x666bc

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] refusing to read ICODIRENTRY beyond resource size

[?] can't find file_offset of VA 0x49bac

calc_upx.exe- CALC.EXE - Windows Calculator