filenamePATCH.exe
size1344000 (0x148200)
md52e00d2cfbd2a81f009b88c75eae4718c
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Hacktool-283 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xc0

Rich Header

lib idversiontimes used
198078144
18844416
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a01a5e2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.12
SizeOfCode0x4600
SizeOfInitializedData0x143800
SizeOfUninitializedData0
AddressOfEntryPoint0x34ce
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x15b000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

dUP2 (diablo2oo2)

Sections

namevavsizeraw sizeflags
.text0x10000x45d20x4600RWX CODE
.rdata0x60000xda00xe00R-- IDATA
.data0x70000x105fc0x600RW- IDATA
.rsrc0x180000x1423180x142400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x62200xa0
RESOURCE0x180000x142318
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x60000x220
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#5042681252
BITMAPBTN_ABOUT_DOWN30021252
BITMAPBTN_ABOUT_OK_DOWN30021252
BITMAPBTN_ABOUT_OK_OVER30021252
BITMAPBTN_ABOUT_OK_UP30021252
BITMAPBTN_ABOUT_OVER30021252
BITMAPBTN_ABOUT_UP30021252
BITMAPBTN_EXIT_DOWN30021252
BITMAPBTN_EXIT_OVER30021252
BITMAPBTN_EXIT_UP30021252
BITMAPBTN_PATCH_DOWN30021252
BITMAPBTN_PATCH_OVER30021252
BITMAPBTN_PATCH_UP30021252
BITMAP#15350621252
ICON#132401252
DIALOG#16081252
DIALOG#21921252
DIALOG#31761252
STRING#15161252
STRING#26561252
STRING#37641252
RCDATA#15121252
RCDATA#27041252
RCDATA#31601252
RCDATA#4473251252
RCDATA#597331252
RCDATA#6481252
RCDATA#74961252
RCDATA#86760161252
GROUP_CURSOR#1201252
GROUP_CURSOR#2201252
GROUP_ICON#500201252
MANIFEST#19371252
idlangstring
00---START PATCHING---
10---PATCHING DONE---
20[OFFSET PATCH]
30[SEARCH & REPLACE PATCH]
40[REGISTRY PATCH]
50[EXPORT FILE]
60[TEXT PATCH]
80Inline patch failed!
90Inline patch OK!
100nothing patched!
110file patched!
120...done!
130Backup file:
140Copy to clipboard
150<-Back to releaseinfo
160Can not find the file. Search the file?
170File is in use -> using rename method
180Can not access the file. Maybe it's in use... Please close the file before patching! Try to access the file again now?
190loading file:
200Can not open file!
220No PE Signature found!
230Inline patch already applied
240unicode text detected
300CRC32 check OK!
320Wrong filesize or already patched!
330Filesize OK!
340Filesize check skipped!
350CRC32 check failed!
360CRC32 check skipped!
370Byte not found!File is already patched!
380Can't find pattern!Trying next one...
390Registry patch failed!
400Registry patch OK!
410File already exist. Overwrite?
420overwriting existing file
430Failed to export file!
440setting file attributes
450executing file
460deleting file
470File export OK!
module_namehintordfunction_name
user32.dll601TrackPopupMenu
user32.dll584ShowWindow
user32.dll573SetWindowTextA
user32.dll572SetWindowRgn
user32.dll618UpdateWindow
user32.dll568SetWindowLongA
user32.dll534SetFocus
user32.dll531SetDlgItemTextA
user32.dll521SetClassLongA
user32.dll518SetCapture
user32.dll571SetWindowPos
user32.dll509SendMessageA
user32.dll493ReleaseCapture
user32.dll481RegisterClassExA
user32.dll479RedrawWindow
user32.dll475PtInRect
user32.dll455OffsetRect
user32.dll433MessageBoxA
user32.dll418LoadStringA
user32.dll408LoadIconA
user32.dll404LoadCursorA
user32.dll402LoadBitmapA
user32.dll387IsDlgButtonChecked
user32.dll372InvalidateRect
user32.dll371IntersectRect
user32.dll343GetWindowRect
user32.dll338GetWindowLongA
user32.dll323GetSystemMetrics
user32.dll301GetParent
user32.dll265GetKeyState
user32.dll252GetDlgItemTextA
user32.dll58CloseClipboard
user32.dll175EmptyClipboard
user32.dll456OpenClipboard
user32.dll524SetClipboardData
user32.dll233GetClientRect
user32.dll446MoveWindow
user32.dll250GetDlgItem
user32.dll249GetDlgCtrlID
user32.dll245GetDC
user32.dll244GetCursorPos
user32.dll221GetCapture
user32.dll216GetActiveWindow
user32.dll180EndDialog
user32.dll178EnableWindow
user32.dll170DrawTextA
user32.dll144DialogBoxParamA
user32.dll131DefWindowProcA
user32.dll86CreateWindowExA
user32.dll85CreatePopupMenu
user32.dll50CheckDlgButton
user32.dll21CallWindowProcA
user32.dll6AppendMenuA
kernel32.dll763WriteFile
kernel32.dll39CompareStringA
kernel32.dll634SetCurrentDirectoryA
kernel32.dll53CreateDirectoryA
kernel32.dll421GlobalAlloc
kernel32.dll432GlobalLock
kernel32.dll439GlobalUnlock
kernel32.dll199FlushFileBuffers
kernel32.dll798lstrlenW
kernel32.dll797lstrlenA
kernel32.dll793lstrcpyA
kernel32.dll791lstrcmpiA
kernel32.dll789lstrcmpA
kernel32.dll787lstrcatA
kernel32.dll752WideCharToMultiByte
kernel32.dll748WaitForSingleObject
kernel32.dll735VirtualFree
kernel32.dll733VirtualAlloc
kernel32.dll723UnmapViewOfFile
kernel32.dll35CloseHandle
kernel32.dll46CopyFileA
kernel32.dll61CreateFileA
kernel32.dll62CreateFileMappingA
kernel32.dll79CreateProcessA
kernel32.dll86CreateThread
kernel32.dll105DeleteFileA
kernel32.dll155ExitProcess
kernel32.dll157ExpandEnvironmentStringsA
kernel32.dll192FindResourceA
kernel32.dll209FreeLibrary
kernel32.dll230GetCommandLineA
kernel32.dll254GetCurrentDirectoryA
kernel32.dll279GetFileAttributesA
kernel32.dll284GetFileSize
kernel32.dll306GetModuleFileNameA
kernel32.dll308GetModuleHandleA
kernel32.dll339GetProcAddress
kernel32.dll388GetTempPathA
kernel32.dll490LoadLibraryA
kernel32.dll495LoadResource
kernel32.dll512MapViewOfFile
kernel32.dll518MoveFileA
kernel32.dll525MultiByteToWideChar
kernel32.dll602RtlMoveMemory
kernel32.dll604RtlZeroMemory
kernel32.dll640SetEndOfFile
kernel32.dll641SetEnvironmentVariableA
kernel32.dll647SetFileAttributesA
kernel32.dll649SetFilePointer
kernel32.dll698SizeofResource
kernel32.dll699Sleep
shell32.dll217ShellExecuteA
gdi32.dll39CreateDIBSection
gdi32.dll47CreateFontIndirectA
gdi32.dll69CreateSolidBrush
gdi32.dll103ExtCreateRegion
gdi32.dll221GetStockObject
gdi32.dll12BitBlt
gdi32.dll33CreateCompatibleBitmap
gdi32.dll34CreateCompatibleDC
gdi32.dll362TextOutA
gdi32.dll345SetTextColor
gdi32.dll309SetBkMode
gdi32.dll308SetBkColor
gdi32.dll302SelectObject
gdi32.dll294RoundRect
gdi32.dll286RemoveFontResourceA
gdi32.dll235GetTextExtentPointA
gdi32.dll3AddFontResourceA
comctl32.dll84InitCommonControls
advapi32.dll439RegCloseKey
advapi32.dll443RegCreateKeyExA
advapi32.dll463RegOpenKeyA
advapi32.dll474RegQueryValueExA
comdlg32.dll12GetSaveFileNameA
comdlg32.dll10GetOpenFileNameA
offsetsizetypecomment
01344000EXE05/06/2009 14:59:46#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK