filename | zoek.exe | |
---|---|---|
size | 2038755 (0x1f1be3) | |
md5 | 294dbd73a55af616b18771026b499b53 | |
type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x50 |
blocks_in_file | 2 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0xf |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0x1a |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0x200 |
DOS stub
00000000: ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 |........!..L.!..| 00000010: 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 |This program mus| 00000020: 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 |t be run under W| 00000030: 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 |in32..$7........| 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001c0:
PE Header
Packer / Compiler
UPX v0.89.6 - v1.02 / v1.05 - v1.22 This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
UPX0 | 0x1000 | 0x18000 | 0 | RWX UDATA | |
UPX1 | 0x19000 | 0x6000 | 0x5a00 | RWX IDATA | |
.rsrc | 0x1f000 | 0x2000 | 0x1c00 | RW- IDATA |
Data Directory
type | va | size | |
---|---|---|---|
EXPORT | 0 | 0 | |
IMPORT | 0x208b0 | 0x1a4 | |
RESOURCE | 0x1f000 | 0x18b0 | |
EXCEPTION | 0 | 0 | |
SECURITY | 0 | 0 | |
BASERELOC | 0 | 0 | |
DEBUG | 0 | 0 | |
ARCHITECTURE | 0 | 0 | |
GLOBALPTR | 0 | 0 | |
TLS | 0 | 0 | |
LOAD_CONFIG | 0 | 0 | |
Bound_IAT | 0 | 0 | |
IAT | 0 | 0 | |
Delay_IAT | 0 | 0 | |
CLR_Header | 0 | 0 |
id | lang | string |
---|---|---|
96 | 1049 | 18 11 55 bf b8 fb 7b 6e 66 57 b0 04 10 80 3d 99 |..U...{nfW....=.| 3e 12 73 0a 65 ba 78 26 aa 0a ee 12 dc 05 ff 63 |>.s.e.x&.......c| 71 89 50 0c 80 60 14 ef f6 05 94 08 74 32 c0 04 |q.P..`......t2..| 3c 06 bf 8b 41 0c 3b 01 5b 91 a3 c2 2c 0b f2 ac |<...A.;.[...,...| 36 32 2c 8e 16 0b 80 4a 62 8d da b3 25 80 61 38 |62,....Jb...%.a8| f1 46 b7 a8 06 ea 43 df 2d 53 61 8b dc 24 31 8c |.F....C.-Sa..$1.| d8 ba 2a 8b e0 3c ae dc 05 ea 58 b3 65 15 98 69 |..*..<....X.e..i| 3b ee 42 f4 0a f1 8b 85 a2 9a 07 f6 0c b3 fd 8d |;.B.............| 43 04 8a 53 03 1c 9b a6 a3 9c 16 83 8c 0c 36 06 |C..S..........6.| 0d 9e 08 a0 c6 c8 20 23 0a a2 0c ed 72 32 d6 2a |...... #....r2.*| f1 0c 10 a8 0d 32 76 32 14 ac 34 18 b0 20 23 83 |.....2v2..4.. #.| 8c 0d 1a b2 1c 32 32 c8 c8 b4 1e b6 20 8c 9d 8c |.....22..... ...| 0d b8 52 22 bc 0c 26 08 b7 ca 9c c0 5e c4 2c 07 |..R"..&.....^.,.| 29 5e 20 cd e4 1a 59 a8 79 b2 43 16 5a f8 0a 7c |)^ ...Y.y.C.Z..|| 7d f6 21 83 30 e1 7e 0d 04 80 27 63 13 32 82 84 |}.!.0.~...'c.2..| 7c 0a 88 27 23 27 63 0c 0e 8c 12 90 13 c2 20 63 ||..'#'c....... c| 34 16 94 04 96 1b 04 ef 11 8a 2e a1 c0 86 f9 75 |4..............u| 45 25 90 0b 0d 04 13 b5 23 c5 c8 7e 21 2a 50 08 |E%......#..~!*P.| 22 f7 c6 0e e3 64 21 04 65 a3 35 f4 bf e9 60 c5 |"....d!.e.5...`.| 1c 2f 1d 74 1c 57 8b fb 8b 35 70 a3 5e aa 77 08 |./.t.W...5p.^.w.| 83 e7 07 55 fd df d3 ee 1c 80 ef be 7b 8b 2d 6c |...U........{.-l| 12 73 3a ff 0d 38 3a 78 10 a1 34 86 d9 95 e3 67 |.s:..8:x..4....g| 0a 05 0f b6 96 8a 6e c8 e8 b7 3a 39 01 5a ac cb |......n...:9.Z..| d3 e0 0b f0 aa fe 77 ad 86 3f 72 c6 8b fe 83 eb |......w..?r.....| 10 c1 ee 10 4f 94 b9 e6 4d 20 12 4c d6 f7 d2 d8 |....O...M .L....| 06 0c 00 84 f3 fa 74 25 90 b7 9d 0b 5f 65 eb 65 |......t%...._e.e| 5e 08 73 39 07 2c 2b 40 ea 5f b3 d8 49 14 30 60 |^.s9.,+@._..I.0`| 7a 52 5d d2 0d 2f 0f 08 72 c7 88 95 28 29 45 81 |zR]../..r...()E.| fd 1e 79 a0 da a6 c7 10 b8 0d e2 d5 68 ab b2 7d |..y.........h..}| 6f 8c 33 ed 66 08 f5 c7 84 11 6e 38 6f 1c 92 89 |o.3.f.....n8o...| 1c 89 35 50 04 dc 61 89 44 66 90 e0 3a 8a 4b 3b |..5P..a.Df..:.K;| 80 fb c0 5c 13 11 fc 11 75 fc f5 13 c7 04 9c 40 |...\....u......@| db 40 dd 1e 43 81 fb a6 7c f0 07 9c 3c e9 36 02 |.@..C...|...<.6.| 7d 10 17 09 00 01 18 c8 20 27 87 07 18 20 cf 3d |}....... '... .=| 72 72 08 20 c7 05 64 66 2a f7 9d ad |rr. ..df*... | |
112 | 1049 | c0 68 58 5d 04 96 79 68 17 bb 5e f7 83 63 b9 01 |.hX]..yh..^..c..| 28 ba 2d 68 67 38 8d 86 03 3a 26 e7 1f bd 70 c6 |(.-hg8...:&...p.| 7e 27 eb 7c 9c 05 08 1e 7c f3 69 3e 4f b3 51 68 |~'.|....|.i>O.Qh| 05 d4 10 a5 60 bb 44 11 e4 68 61 1e 00 4e 80 ed |....`.D..ha..N..| de 27 48 7e 16 a1 48 0e 6b c0 57 3b 4f b0 c0 24 |.'H~..H.k.W;O..$| bc 68 34 64 41 04 03 78 d8 27 62 94 ce 83 14 38 |.h4dA..x.'b....8| 30 2b 74 c8 dc 9c 11 0c 01 a7 51 8b 40 1e 84 74 |0+t.......Q.@..t| 30 05 61 ae 83 85 b7 67 05 83 26 83 e2 1f b9 05 |0.a....g..&.....| ca c0 96 80 43 05 16 1c 53 22 59 ba 2b 42 4e 20 |....C...S"Y.+BN | 04 b7 f2 a5 99 04 ee 04 83 e5 0f 05 c5 04 b0 b7 |................| 1f da 81 7c 9f a8 77 07 83 09 20 20 76 36 48 b6 |...|..w... v6H.| 6f 11 be 3b ef 76 5a 6d 03 ad 19 6e a6 03 04 bd |o..;.vZm...n....| 0c d2 c3 6e 6f 6d db 82 03 b4 47 7b 03 55 c5 84 |...nom....G{.U..| 24 77 1d f0 7e a3 a6 df 13 73 13 8b 14 1f f8 4c |$w..~....s.....L| e0 e1 e2 ee 94 24 47 12 72 ed c7 96 5d 4d e5 3e |.....$G.r...]M.>| a3 26 14 b9 13 0c fe 20 56 c5 e8 de 52 ba 0a 13 |.&..... V...R...| 34 08 1b 0a 50 81 ba b4 14 77 b1 a8 eb 2a f8 7f |4...P....w...*..| 83 c2 17 05 01 03 78 1c 5a 81 8b 0b 1f cc 05 b8 |......x.Z.......| 86 59 97 89 03 44 1b c4 ad c3 a8 33 4c 38 89 d5 |.Y...D.....3L8..| 3e 4d f7 05 b4 aa 94 b2 c0 14 27 ba 9d 20 fb 60 |>M........'.. .`| 41 eb 35 ed 3b 5c 50 72 c5 32 dd ad 03 29 23 eb |A.5.;\Pr.2...)#.| e2 03 69 0c b5 1c d0 ad 43 7a 01 42 df 5b ed d6 |..i.....Cz.B.[..| 6a e3 e1 6f 78 04 e3 92 11 bb d9 85 dd 8b ef 96 |j..ox...........| 89 7c 06 ff 04 75 15 75 7c 10 56 c9 5b 4e 02 73 |.|...u.u|.V.[N.s| 3c 6d 16 70 ad 87 02 72 c4 fc 56 50 03 b5 b0 d5 | |
128 | 1049 | ff 7f 32 ec 3b bf 76 05 0f 5d 83 06 c7 2b 25 be |..2.;.v..]...+%.| e8 2b bd 55 06 f7 f2 3b 75 f0 13 6f e0 8b f0 29 |.+.U...;u..o...)| c6 e1 b7 ae 08 1a 2b 22 3b f2 77 1f ba ff 04 d0 |......+";.w.....| 4c 54 21 48 cf 51 6e 6b 4b 4d d1 60 7f e8 02 43 |LT!H.QnkKM.`...C| 1b 50 8e c3 78 1f 3d 90 20 40 ec 43 07 18 07 e3 |.P..x.=. @.C....| 4e 75 e5 46 75 14 42 83 73 31 4c c7 7d f0 60 66 |Nu.Fu.B.s1L.}.`f| 4c 1b 16 50 4b 46 aa 15 67 3d ab 87 88 65 50 df |L..PKF..g=...eP.| 35 d3 26 4d c0 3b a3 27 68 74 ea a9 6b f4 31 db |5.&M.;.'ht..k.1.| 18 58 df c4 3c 41 cb 0d c7 61 b9 c0 eb 55 1b ac |.X.. |
144 | 1049 | 8b ec dd 0e af 19 23 bd 19 89 8d 0b 67 6d 28 b8 |......#.....gm(.| dc 56 46 c8 6b 50 fc 76 ec d6 00 64 c8 a8 f8 fe |.VF.kP.v...d....| b0 4d d4 1c 07 bd d1 c1 c0 22 3b eb 0f 8f 55 e7 |.M.......";...U.| dd 77 98 03 7d ec f0 e3 7a 04 6a 70 db f4 ae 8c |.w..}...z.jp....| b8 01 45 c8 46 56 2b 4d 3d 4d c0 66 7a 58 e8 8c |..E.FV+M=M.fzX..| 50 07 64 02 b4 43 fa 0d 23 b8 46 5d 8b a8 55 f0 |P.d..C..#.F]..U.| 2b 5d c8 42 5a b4 dc ff 0b 3b c2 76 23 2b c2 5f |+].BZ....;.v#+._| 6f 96 5c d8 f0 c7 55 03 d1 eb 0b 03 c0 07 3b 02 |o.\...U.......;.| 99 2b 02 a9 68 8d 36 64 c0 72 ff 5a c4 db a5 c2 |.+..h.6d.r.Z....| 6d d3 84 ec 76 b2 aa 73 05 45 ec d2 ff 5b c2 2b |m...v..s.E...[.+| d8 af a2 dc 89 1c b2 8b 7d c0 47 3c 74 24 62 8b |........}.G |
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.DLL | LoadLibraryA | ||
KERNEL32.DLL | GetProcAddress | ||
KERNEL32.DLL | ExitProcess | ||
ADVAPI32.DLL | RegCloseKey | ||
COMCTL32.DLL | 17 | ||
GDI32.DLL | DeleteObject | ||
OLE32.DLL | OleInitialize | ||
SHELL32.DLL | SHGetMalloc | ||
USER32.DLL | SetMenu |
Scanning the drive for archives: 1 file, 2038755 bytes (1991 KiB) -- Type = zip Physical Size = 2038755 Embedded Stub Size = 31232 Comment = ;The comment below contains SFX script commands Setup=pevz.exe exec cmd.exe /c zoek-install.bat TempMode Silent=1 Overwrite=1 Date Time Attr Size Compressed Name ------------------- ----- ------------ ------------ ------------------------ 2012-06-16 23:48:24 ....A 719 334 z0.scf 2018-02-21 21:18:04 ....A 13869 2658 z1.scf 2018-05-10 11:07:18 ....A 818116 125573 z2.scf 2012-02-09 09:41:04 ....A 161792 151538 z3.scf 2012-02-09 09:41:04 ....A 154232 76434 z5.scf 2011-01-12 12:51:14 ....A 69632 35692 z6.scf 2018-02-05 01:47:00 ....A 6754 1988 z7.scf 2014-02-13 23:59:26 ....A 24064 21483 z8.scf 2012-02-09 09:41:04 ....A 30720 28139 z9.scf 2000-08-31 09:00:00 ....A 98816 44581 za.scf 2012-09-25 19:06:28 ....A 217088 102561 zb.scf 2006-05-14 10:25:10 ....A 476672 235763 zc.scf 2014-02-11 22:10:18 ....A 388608 305772 zd.scf 2005-07-04 02:11:00 ....A 57344 20839 ze.scf 2012-02-09 09:41:04 ....A 256512 254589 PEVZ.EXE 2018-05-10 11:41:28 ....A 6073 1691 zoek-install.bat 2007-02-03 09:40:16 ....A 10134 3943 zf.scf 2015-02-12 23:16:44 ....A 20480 8061 zg.scf 2018-04-15 22:57:10 ....A 533851 127746 zh.scf 2018-04-06 19:25:20 ....A 167936 78388 zi.scf 2006-05-14 11:25:10 ....A 476672 235763 zj.scf 2009-11-10 20:09:46 ....A 157184 79559 zk.scf 2014-05-20 14:11:28 ....A 68096 62217 ZAScan.exe ------------------- ----- ------------ ------------ ------------------------ 2018-05-10 11:41:28 4215364 2005312 23 files
![]() |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[!] string size(8752) > stringtable size(556). truncated to 554
[!] cannot convert "U\xBF\xB8\xFB{nfW\xB0\x04\x10\x80=\x99>\x12"... to UTF-16
[!] string size(53632) > stringtable size(982). truncated to 980
[!] cannot convert "X]\x04\x96yh\x17\xBB^\xF7\x83c\xB9\x01(\xBA"... to UTF-16
[!] string size(65534) > stringtable size(512). truncated to 510
[!] cannot convert "2\xEC;\xBFv\x05\x0F]\x83\x06\xC7+%\xBE\xE8+"... to UTF-16
[!] string size(121110) > stringtable size(566). truncated to 564
[!] cannot convert "\xDD\x0E\xAF\x19#\xBD\x19\x89\x8D\vgm(\xB8\xDCV"... to UTF-16