yelaw.exe.not - 7zsfx.exe - Trend Micro AntiVirus Plus AntiSpyware

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	yelaw.exe.not
size	102478 (0x1904e)
md5	2cb85c25d4ec6df289bc042bd893a2fa

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
61	9466	46
96	3349	51
95	2190	1
6	1735	1
10	8168	92
90	3077	1
28	9178	85
18	8444	15

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4cccdfff
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x800
SizeOfInitializedData	0xb000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1670
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x16000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x7b0	0x800	R-X CODE
.rdata�	0x2000	0xb4c	0xc00	R-- IDATA
.dataI	0x3000	0x903a	0x2200	RW- IDATA
.rsrc@	0xd000	0x81a0	0x8200	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x21b4	0xb4
RESOURCE	0xd000	0x81a0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2000	0x1b4
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	9640
ICON	#8	4264
ICON	#9	1128
MENU	#1	5140
DIALOG	#81	200
GROUP_ICON	#1	132
VERSION	#1	1156
MANIFEST	#1	658

module_name	hint	function_name
msvcrt.dll	434	abort
msvcrt.dll	482	fflush
msvcrt.dll	521	free
msvcrt.dll	238	_adjust_fdiv
msvcrt.dll	453	exit
msvcrt.dll	522	fwrite
msvcrt.dll	266	_except_handler3
msvcrt.dll	48	_XcptFilter
msvcrt.dll	448	calloc
msvcrt.dll	192	__set_app_type
msvcrt.dll	506	fputs
msvcrt.dll	534	sinh
msvcrt.dll	559	strcpy
msvcrt.dll	241	_controlfp
msvcrt.dll	86	__getmainargs
msvcrt.dll	137	__p__commode
msvcrt.dll	531	signal
msvcrt.dll	350	_snprintf
msvcrt.dll	597	strrchr
msvcrt.dll	393	_vsnprintf
msvcrt.dll	207	__setusermatherr
msvcrt.dll	330	_initterm
msvcrt.dll	110	__p___initenv
msvcrt.dll	172	__p__fmode
msvcrt.dll	307	_exit
comdlg32.dll	36	GetOpenFileNameA
kernel32.dll	382	LCMapStringW
kernel32.dll	211	GetSystemTimeAsFileTime
kernel32.dll	241	GetWindowsDirectoryA
kernel32.dll	179	GetNumberFormatA
kernel32.dll	340	IsValidCodePage
kernel32.dll	116	GetFullPathNameA
kernel32.dll	25	CopyFileA
kernel32.dll	243	InterlockedDecrement
kernel32.dll	191	GetSystemDirectoryW
kernel32.dll	322	IsBadCodePtr
kernel32.dll	64	CreateDirectoryA
kernel32.dll	160	GetLocaleInfoW
kernel32.dll	80	GetCurrentThreadId
kernel32.dll	81	GetFileType
kernel32.dll	412	VirtualProtect
kernel32.dll	283	InterlockedExchange
user32.dll	47	EmptyClipboard
user32.dll	302	SetCursor
user32.dll	275	PtInRect
user32.dll	216	GetSubMenu
user32.dll	354	SetDlgItemTextA
user32.dll	120	GetDlgItem
user32.dll	157	GetFocus
user32.dll	31	CreatePopupMenu
user32.dll	101	GetClientRect
user32.dll	9	CheckMenuItem
user32.dll	398	SetRect
user32.dll	255	GetWindowPlacement
gdi32.dll	35	GetNearestPaletteIndex
gdi32.dll	93	GetTextExtentPoint32A
gdi32.dll	95	GetTextExtentPointA
gdi32.dll	22	GetDCOrgEx
gdi32.dll	13	CreateCompatibleBitmap
gdi32.dll	17	GetBrushOrgEx
gdi32.dll	79	GetObjectW
gdi32.dll	139	TranslateCharsetInfo
gdi32.dll	137	PatBlt
advapi32.dll	349	OpenServiceW
advapi32.dll	393	RegDeleteKeyA
advapi32.dll	290	OpenSCManagerA
advapi32.dll	396	RegFlushKey
advapi32.dll	98	EqualSid
advapi32.dll	170	GetUserNameA
advapi32.dll	23	AllocateAndInitializeSid
advapi32.dll	215	LookupPrivilegeValueW
advapi32.dll	245	OpenProcessToken
advapi32.dll	486	RevertToSelf
advapi32.dll	305	OpenServiceA
advapi32.dll	136	FreeSid
advapi32.dll	441	RegOpenKeyExA
advapi32.dll	358	OpenThreadToken
advapi32.dll	58	CryptHashData
advapi32.dll	38	CryptGenRandom
advapi32.dll	213	LookupPrivilegeValueA
comctl32.dll	103	ImageList_Remove
comctl32.dll	27	ImageList_AddMasked
comctl32.dll	73	ImageList_DragEnter
comctl32.dll	222	InitCommonControlsEx
comctl32.dll	127	ImageList_Replace
comctl32.dll	75	ImageList_GetIconSize
comctl32.dll	212	ImageList_SetDragCursorImage
comctl32.dll	175	ImageList_SetBkColor
ole32.dll	300	PropVariantClear
ole32.dll	285	OleFlushClipboard
ole32.dll	100	CoRegisterMessageFilter
ole32.dll	88	CoInitializeSecurity
ole32.dll	82	CoGetMalloc
ole32.dll	298	OleGetClipboard
ole32.dll	24	CoCreateGuid
ole32.dll	181	GetRunningObjectTable
ole32.dll	375	RevokeDragDrop
ole32.dll	225	IIDFromString
ole32.dll	427	StringFromIID
ole32.dll	139	CoRevokeClassObject
ole32.dll	343	ReleaseStgMedium

StringTable 040904E4

Comments
CompanyName	Trend Micro Inc.
FileDescription	Trend Micro AntiVirus Plus AntiSpyware
FileVersion	17.50.0.1366
InternalName	7zsfx.exe
LegalCopyright	Copyright (C) 1995-2012 Trend Micro Incorporated. All rights reserved.
LegalTrademarks	Copyright (C) Trend Micro Inc.
OriginalFilename	7zsfx.exe
PrivateBuild	Build 1366 - 7/29/2009
ProductName	Trend Micro Internet Security
ProductVersion	17.50
SpecialBuild	1366

VS_FIXEDFILEINFO

FileVersion	18.50.0.1366
ProductVersion	18.50.0.1366
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	48128	EXE	10/31/2010 03:18:23	#
15c1	15	HTM		#
bc00	54350	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 102478 bytes (101 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

yelaw.exe.not-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904E4

VS_FIXEDFILEINFO

yelaw.exe.not
-