bootstrapper.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	bootstrapper.exe
size	877056 (0xd6200)
md5	277eff8d23f1e171ba4bb6518de41d72

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
259	26715	23
261	26715	206
260	26715	24
199	41118	6
260	28427	18
259	28427	26
261	28427	150
261	28105	34
260	28105	105
257	26715	15
1	0	246
265	28614	6
255	28614	1
151	0	1
258	28614	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5f0ee966
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.25
SizeOfCode	0x97e00
SizeOfInitializedData	0x40800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x6e4f1
BaseOfCode	0x1000
BaseOfData	0x99000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xdb000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x97c32	0x97e00	R-X CODE
.rdata	0x99000	0x210d4	0x21200	R-- IDATA
.data	0xbb000	0x469c	0x2000	RW- IDATA
.rsrc	0xc0000	0x13ca8	0x13e00	R-- IDATA
.reloc	0xd4000	0x6efc	0x7000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xb90c0	0xa0
RESOURCE	0xc0000	0x13ca8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xd4000	0x6efc
DEBUG	0xb44d0	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xb45f8	0x18
LOAD_CONFIG	0xb4540	0x40
Bound_IAT	0	0
IAT	0x99000	0x338
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x4b66f4	0x4b66fc	0x4bec20	0x499458	0	0x300000

show previews

type	name	size
ICON	#1	1128
ICON	#2	2440
ICON	#3	4264
ICON	#4	9640
ICON	#5	62693
GROUP_ICON	#101	76
MANIFEST	#1	381

module_name	hint	ord	function_name
KERNEL32.dll	692		GetProcessHeap
KERNEL32.dll	1300		SetEnvironmentVariableW
KERNEL32.dll	426		FreeEnvironmentStringsW
KERNEL32.dll	567		GetEnvironmentStringsW
KERNEL32.dll	663		GetOEMCP
KERNEL32.dll	434		GetACP
KERNEL32.dll	907		IsValidCodePage
KERNEL32.dll	782		GetTimeZoneInformation
KERNEL32.dll	846		HeapSize
KERNEL32.dll	1354		SetStdHandle
KERNEL32.dll	844		HeapReAlloc
KERNEL32.dll	221		CreatePipe
KERNEL32.dll	1553		WriteConsoleW
KERNEL32.dll	340		EnumSystemLocalesW
KERNEL32.dll	786		GetUserDefaultLCID
KERNEL32.dll	909		IsValidLocale
KERNEL32.dll	415		FlushFileBuffers
KERNEL32.dll	841		HeapFree
KERNEL32.dll	837		HeapAlloc
KERNEL32.dll	490		GetConsoleCP
KERNEL32.dll	1136		ReadConsoleW
KERNEL32.dll	508		GetConsoleMode
KERNEL32.dll	471		GetCommandLineW
KERNEL32.dll	470		GetCommandLineA
KERNEL32.dll	1554		WriteFile
KERNEL32.dll	350		ExitProcess
KERNEL32.dll	631		GetModuleHandleExW
KERNEL32.dll	351		ExitThread
KERNEL32.dll	362		FileTimeToSystemTime
KERNEL32.dll	1417		SystemTimeToTzSpecificLocalTime
KERNEL32.dll	559		GetDriveTypeW
KERNEL32.dll	229		CreateProcessW
KERNEL32.dll	1122		RaiseException
KERNEL32.dll	1235		RtlUnwind
KERNEL32.dll	1495		WaitForSingleObject
KERNEL32.dll	1284		SetConsoleTitleW
KERNEL32.dll	422		FormatMessageA
KERNEL32.dll	975		LocalFree
KERNEL32.dll	134		CloseHandle
KERNEL32.dll	195		CreateFileA
KERNEL32.dll	609		GetLastError
KERNEL32.dll	796		GetVolumeInformationA
KERNEL32.dll	1555		WriteFileEx
KERNEL32.dll	722		GetStdHandle
KERNEL32.dll	1282		SetConsoleTextAttribute
KERNEL32.dll	514		GetConsoleScreenBufferInfo
KERNEL32.dll	1501		WaitNamedPipeA
KERNEL32.dll	572		GetExitCodeProcess
KERNEL32.dll	1339		SetNamedPipeHandleState
KERNEL32.dll	305		EnterCriticalSection
KERNEL32.dll	957		LeaveCriticalSection
KERNEL32.dll	864		InitializeCriticalSectionEx
KERNEL32.dll	272		DeleteCriticalSection
KERNEL32.dll	1408		SleepEx
KERNEL32.dll	1473		VerSetConditionMask
KERNEL32.dll	1102		QueryPerformanceFrequency
KERNEL32.dll	735		GetSystemDirectoryA
KERNEL32.dll	427		FreeLibrary
KERNEL32.dll	629		GetModuleHandleA
KERNEL32.dll	686		GetProcAddress
KERNEL32.dll	961		LoadLibraryA
KERNEL32.dll	1476		VerifyVersionInfoA
KERNEL32.dll	1405		Sleep
KERNEL32.dll	1101		QueryPerformanceCounter
KERNEL32.dll	775		GetTickCount
KERNEL32.dll	1496		WaitForSingleObjectEx
KERNEL32.dll	353		ExpandEnvironmentStringsA
KERNEL32.dll	590		GetFileType
KERNEL32.dll	1139		ReadFile
KERNEL32.dll	1058		PeekNamedPipe
KERNEL32.dll	1493		WaitForMultipleObjects
KERNEL32.dll	1330		SetLastError
KERNEL32.dll	588		GetFileSizeEx
KERNEL32.dll	1007		MultiByteToWideChar
KERNEL32.dll	1534		WideCharToMultiByte
KERNEL32.dll	539		GetCurrentThread
KERNEL32.dll	773		GetThreadTimes
KERNEL32.dll	529		GetCurrentDirectoryW
KERNEL32.dll	203		CreateFileW
KERNEL32.dll	277		DeleteFileW
KERNEL32.dll	373		FindClose
KERNEL32.dll	379		FindFirstFileExW
KERNEL32.dll	396		FindNextFileW
KERNEL32.dll	578		GetFileAttributesExW
KERNEL32.dll	583		GetFileInformationByHandle
KERNEL32.dll	601		GetFullPathNameW
KERNEL32.dll	1209		RemoveDirectoryW
KERNEL32.dll	1296		SetEndOfFile
KERNEL32.dll	1315		SetFilePointerEx
KERNEL32.dll	35		AreFileApisANSI
KERNEL32.dll	632		GetModuleHandleW
KERNEL32.dll	1000		MoveFileExW
KERNEL32.dll	423		FormatMessageW
KERNEL32.dll	1415		SwitchToThread
KERNEL32.dll	540		GetCurrentThreadId
KERNEL32.dll	863		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	191		CreateEventW
KERNEL32.dll	1438		TlsAlloc
KERNEL32.dll	1440		TlsGetValue
KERNEL32.dll	1441		TlsSetValue
KERNEL32.dll	1439		TlsFree
KERNEL32.dll	745		GetSystemTimeAsFileTime
KERNEL32.dll	301		EncodePointer
KERNEL32.dll	265		DecodePointer
KERNEL32.dll	155		CompareStringW
KERNEL32.dll	945		LCMapStringW
KERNEL32.dll	613		GetLocaleInfoW
KERNEL32.dll	727		GetStringTypeW
KERNEL32.dll	449		GetCPInfo
KERNEL32.dll	1453		UnhandledExceptionFilter
KERNEL32.dll	1389		SetUnhandledExceptionFilter
KERNEL32.dll	535		GetCurrentProcess
KERNEL32.dll	1420		TerminateProcess
KERNEL32.dll	902		IsProcessorFeaturePresent
KERNEL32.dll	1302		SetEvent
KERNEL32.dll	1222		ResetEvent
KERNEL32.dll	867		InitializeSListHead
KERNEL32.dll	895		IsDebuggerPresent
KERNEL32.dll	720		GetStartupInfoW
KERNEL32.dll	536		GetCurrentProcessId
KERNEL32.dll	243		CreateThread
KERNEL32.dll	428		FreeLibraryAndExitThread
KERNEL32.dll	628		GetModuleFileNameW
KERNEL32.dll	963		LoadLibraryExW
KERNEL32.dll	299		DuplicateHandle
USER32.dll	499		GetWindowThreadProcessId
USER32.dll	273		FindWindowA
ADVAPI32.dll	193		CryptAcquireContextA
ADVAPI32.dll	213		CryptGetHashParam
ADVAPI32.dll	210		CryptGenRandom
ADVAPI32.dll	196		CryptCreateHash
ADVAPI32.dll	217		CryptHashData
ADVAPI32.dll	315		GetCurrentHwProfileA
ADVAPI32.dll	199		CryptDestroyHash
ADVAPI32.dll	200		CryptDestroyKey
ADVAPI32.dll	219		CryptImportKey
ADVAPI32.dll	203		CryptEncrypt
ADVAPI32.dll	220		CryptReleaseContext
WS2_32.dll		17
WS2_32.dll		10
WS2_32.dll	150		getaddrinfo
WS2_32.dll		57
WS2_32.dll		8
WS2_32.dll		1
WS2_32.dll		18
WS2_32.dll		151
WS2_32.dll		116
WS2_32.dll		115
WS2_32.dll	58		WSAIoctl
WS2_32.dll		112
WS2_32.dll		21
WS2_32.dll		15
WS2_32.dll		9
WS2_32.dll		7
WS2_32.dll		6
WS2_32.dll		5
WS2_32.dll		4
WS2_32.dll		2
WS2_32.dll		16
WS2_32.dll		23
WS2_32.dll		111
WS2_32.dll		19
WS2_32.dll		3
WS2_32.dll		14
WS2_32.dll		20
WS2_32.dll		13
WS2_32.dll	149		freeaddrinfo
WLDAP32.dll		35
WLDAP32.dll		33
WLDAP32.dll		32
WLDAP32.dll		27
WLDAP32.dll		26
WLDAP32.dll		22
WLDAP32.dll		79
WLDAP32.dll		50
WLDAP32.dll		45
WLDAP32.dll		60
WLDAP32.dll		211
WLDAP32.dll		46
WLDAP32.dll		217
WLDAP32.dll		143
WLDAP32.dll		30
WLDAP32.dll		41
WLDAP32.dll		200
WLDAP32.dll		301
CRYPT32.dll	53		CertFindCertificateInStore
CRYPT32.dll	64		CertFreeCertificateContext
CRYPT32.dll	227		CryptStringToBinaryA
CRYPT32.dll	4		CertAddCertificateContextToStore
CRYPT32.dll	74		CertGetNameStringA
CRYPT32.dll	44		CertEnumCertificatesInStore
CRYPT32.dll	18		CertCloseStore
CRYPT32.dll	200		CryptQueryObject
CRYPT32.dll	27		CertCreateCertificateChainEngine
CRYPT32.dll	62		CertFreeCertificateChainEngine
CRYPT32.dll	69		CertGetCertificateChain
CRYPT32.dll	89		CertOpenStore
CRYPT32.dll	61		CertFreeCertificateChain
Normaliz.dll			IdnToAscii

show previews

offset	size	type	comment
0	877056	EXE	07/15/2020 11:32:54	#
15c1	15	HTM		#
bf9f0	62693	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0xbec20