quickstart.exe.vir

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	quickstart.exe.vir
size	1199104 (0x124c00)
md5	2fad69503166bf30ed15b64daa1b116d

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
147	21022	2
149	21022	1
131	21022	20
1	0	74
123	50727	7
132	21022	3
148	21022	1
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5028bf88
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x1200
SizeOfInitializedData	0x123600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x19dc
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x128000
SizeOfHeaders	0x400
CheckSum	0x133da3
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1076	0x1200	R-X CODE
.rdata	0x3000	0xa04	0xc00	R-- IDATA
.data	0x4000	0x53c	0x200	RW- IDATA
.rsrc	0x5000	0x121868	0x121a00	R-- IDATA
.reloc	0x127000	0xd44	0xe00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x335c	0x64
RESOURCE	0x5000	0x121868
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x127000	0x24c
DEBUG	0x3160	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x3230	0x40
Bound_IAT	0	0
IAT	0x3000	0x138
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	1640	1252
ICON	#2	744	1252
ICON	#3	296	1252
ICON	#4	3752	1252
ICON	#5	2216	1252
ICON	#6	1384	1252
ICON	#7	270376	1252
ICON	#8	9640	1252
ICON	#9	4264	1252
ICON	#10	1128	1252
ICON	#11	1640	1252
ICON	#12	744	1252
ICON	#13	296	1252
ICON	#14	3752	1252
ICON	#15	2216	1252
ICON	#16	1384	1252
ICON	#17	270376	1252
ICON	#18	9640	1252
ICON	#19	4264	1252
ICON	#20	1128	1252
ICON	#21	1640	1252
ICON	#22	744	1252
ICON	#23	296	1252
ICON	#24	3752	1252
ICON	#25	2216	1252
ICON	#26	1384	1252
ICON	#27	270376	1252
ICON	#28	9640	1252
ICON	#29	4264	1252
ICON	#30	1128	1252
ICON	#31	1640	1252
ICON	#32	744	1252
ICON	#33	296	1252
ICON	#34	3752	1252
ICON	#35	2216	1252
ICON	#36	1384	1252
ICON	#37	270376	1252
ICON	#38	9640	1252
ICON	#39	4264	1252
ICON	#40	1128	1252
DIALOG	#103	246	1252
STRING	#7	126	1252
STRING	#8	40	1252
ACCELERATORS	#109	16	1252
GROUP_ICON	#1	146	1252
GROUP_ICON	#2	146	1252
GROUP_ICON	#107	146	1252
GROUP_ICON	#108	146	1252
MANIFEST	#1	598	1252

id	lang	string
103	1031	SoQuickStart
109	1031	QUICKSTART
111	1031	StarOffice 6.0 QuickStart
112	1031	Exit

module_name	hint	function_name
SHELL32.dll	290	Shell_NotifyIconA
KERNEL32.dll	595	GetSystemTimeAsFileTime
KERNEL32.dll	1067	Sleep
KERNEL32.dll	1157	WinExec
KERNEL32.dll	501	GetModuleFileNameA
KERNEL32.dll	503	GetModuleHandleA
KERNEL32.dll	703	InterlockedCompareExchange
KERNEL32.dll	572	GetStartupInfoA
KERNEL32.dll	1079	TerminateProcess
KERNEL32.dll	426	GetCurrentProcess
KERNEL32.dll	1096	UnhandledExceptionFilter
KERNEL32.dll	1055	SetUnhandledExceptionFilter
KERNEL32.dll	726	IsDebuggerPresent
KERNEL32.dll	857	QueryPerformanceCounter
KERNEL32.dll	618	GetTickCount
KERNEL32.dll	430	GetCurrentThreadId
KERNEL32.dll	427	GetCurrentProcessId
KERNEL32.dll	706	InterlockedExchange
MSVCR90.dll	253	_acmdln
MSVCR90.dll	516	_initterm
MSVCR90.dll	517	_initterm_e
MSVCR90.dll	316	_configthreadlocale
MSVCR90.dll	227	__setusermatherr
MSVCR90.dll	267	_adjust_fdiv
MSVCR90.dll	203	__p__commode
MSVCR90.dll	207	__p__fmode
MSVCR90.dll	1228	exit
MSVCR90.dll	224	__set_app_type
MSVCR90.dll	331	_crt_debugger_hook
MSVCR90.dll	67	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR90.dll	998	_unlock
MSVCR90.dll	150	__dllonexit
MSVCR90.dll	630	_lock
MSVCR90.dll	796	_onexit
MSVCR90.dll	352	_decode_pointer
MSVCR90.dll	371	_except_handler4_common
MSVCR90.dll	523	_invoke_watson
MSVCR90.dll	319	_controlfp_s
MSVCR90.dll	1375	strrchr
MSVCR90.dll	549	_ismbblead
MSVCR90.dll	102	_XcptFilter
MSVCR90.dll	380	_exit
MSVCR90.dll	300	_cexit
MSVCR90.dll	159	__getmainargs
MSVCR90.dll	277	_amsg_exit
MSVCR90.dll	137	__argc
MSVCR90.dll	138	__argv
MSVCR90.dll	1371	strncpy
MSVCR90.dll	873	_snprintf
MSVCR90.dll	362	_encode_pointer
USER32.dll	542	PostMessageA
USER32.dll	720	TrackPopupMenuEx
USER32.dll	634	SetForegroundWindow
USER32.dll	281	GetCursorPos
USER32.dll	149	DefWindowProcA
USER32.dll	564	RegisterClassExA
USER32.dll	466	LoadCursorA
USER32.dll	470	LoadIconA
USER32.dll	585	RegisterWindowMessageA
USER32.dll	240	FindWindowA
USER32.dll	160	DestroyWindow
USER32.dll	165	DialogBoxParamA
USER32.dll	544	PostQuitMessage
USER32.dll	101	CreatePopupMenu
USER32.dll	420	InsertMenuItemA
USER32.dll	670	SetTimer
USER32.dll	211	EndDialog
USER32.dll	103	CreateWindowExA
USER32.dll	696	ShowWindow
USER32.dll	745	UpdateWindow
USER32.dll	367	GetSystemMetrics
USER32.dll	472	LoadImageA
USER32.dll	606	SendMessageA
USER32.dll	241	FindWindowExA

show previews

offset	size	type	comment
0	1199104	EXE	08/13/2012 08:49:12	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK