7bcf08a5efd57426dc61e2c8bd6ef526e487b9b6.bin - Selection.exe

info
MZ
PE
resources
strings
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	7bcf08a5efd57426dc61e2c8bd6ef526e487b9b6.bin
size	201216 (0x31200)
md5	2d22ce41a5af9d807837c50ee168b040

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
125	50727	35
109	50727	144
110	50727	55
93	4035	39
1	0	248
95	4035	2
114	50727	5
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x5bbbc936
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x23000
SizeOfInitializedData	0xf000
SizeOfUninitializedData	0x22000
AddressOfEntryPoint	0x45940
BaseOfCode	0x23000
BaseOfData	0x46000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xa6000
SizeOfHeaders	0x1000
CheckSum	0x31711
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX Modified >> *$igBy Ahmed18

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x22000	0	RWX UDATA
UPX1	0x23000	0x23000	0x22c00	RWX IDATA
.rsrc	0x46000	0x60000	0xe200	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x53c7c	0x424
RESOURCE	0x46000	0xdc7c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x45af4	0x18
LOAD_CONFIG	0x45b14	0x48
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x445b0c	0x445b14	0x41f29c	0	0	0

show previews

type	name	size	cp
TXT	#7423	51404	1252
TXT	#7424	12279	1252
BITMAP	#911	1864	1252
BITMAP	#912	844	1252
BITMAP	#913	4136	1252
ICON	#1	1128	1252
ICON	#2	9664	1252
ICON	#3	9640	1252
ICON	#4	4264	1252
ICON	#5	10344	1252
ICON	#6	16936	1252
MENU	#109	74	1252
DIALOG	#103	258	1252
DIALOG	#129	514	1252
DIALOG	#4828	138	1252
DIALOG	#4829	178	1252
DIALOG	#4830	754	1252
DIALOG	#4831	522	1252
DIALOG	#4832	502	1252
DIALOG	#8622	492	1252
DIALOG	#8623	624	1252
DIALOG	#8624	3380	1252
DIALOG	#8625	718	1252
DIALOG	#8626	912	1252
DIALOG	#9397	976	1252
DIALOG	#9398	408	1252
DIALOG	#9399	572	1252
DIALOG	#9400	374	1252
DIALOG	#9401	240	1252
STRING	#7	60	1252
ACCELERATORS	#775	16	1252
ACCELERATORS	#776	40	1252
ACCELERATORS	#777	24	1252
GROUP_ICON	#101	90	1252
VERSION	#1	1128	1252
MANIFEST	#1	1217	1252

lang

string

1033

11 ce 9a ab ff 86 ff ff  66 18 86 59 97 a2 2d 7f  |........f..Y..-.|
86 31 85 6c a8 6b 56 64  d3 da 80 90 f5 6d 64 da  |.1.l.kVd.....md.|
9a 34 ff ff 7f fb 5e 81  fc fc e3 04 50 b0 03 c3  |.4....^.....P...|
31 24 a0 74 40 d7 6a 31  ec 39 d6 64              |1$.t@.j1.9.d    |

module_name	ord	function_name
ADVAPI32.dll		RegCloseKey
AUTHZ.dll		AuthzInitializeResourceManager
COMCTL32.dll		InitCommonControlsEx
comdlg32.dll		FindTextA
GDI32.dll		DPtoLP
gdiplus.dll		GdiplusStartup
iphlpapi.dll		GetPerAdapterInfo
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		ExitProcess
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
mscms.dll		GetColorDirectoryW
MSIMG32.dll		GradientFill
ole32.dll		CoInitialize
OLEAUT32.dll	8
SHELL32.dll		SHGetMalloc
SHLWAPI.dll		AssocCreate
TAPI32.dll		phoneGetLamp
USER32.dll		GetDC
USERENV.dll		UnregisterGPNotification
WS2_32.dll	9

StringTable 040904b0

LegalCopyright	BreakPoint Software, Inc. Copyright 2015
InternalName	Selection
PrivateBuild	5.3.4.365
CompanyName	BreakPoint Software, Inc.
LegalTrademarks	BreakPoint Software, Inc. Copyright 2015
Languages	English
Assembly Version	5.3.4.365
FileVersion	5.3.4.365
OriginalFilename	Selection.exe
Comments	Bitmap Considering
FileDescription	Bitmap Considering
ProductName	Selection
ProductVersion	5.3.4.365

VS_FIXEDFILEINFO

FileVersion	5.3.4.365
ProductVersion	5.3.4.365
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	201216	EXE	10/08/2018 21:16:38	#
15c1	15	HTM		#
23c38	9664	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x227c8

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] string size(105506) > stringtable size(60). truncated to 58

[!] cannot convert "\x9A\xAB\xFF\x86\xFF\xFFf\x18\x86Y\x97\xA2-\x7F\x861"... to UTF-16

[?] can't find file_offset of VA 0x1f29c

7bcf08a5efd57426dc61e2c8bd6ef526e487b9b6.bin-