filenameevrika.exe
size279552 (0x44400)
md533baa5e1c85f265e08e5744965889c51
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
225206173
203655019
10131
2292061733
220206171
219206171
15101
222206171

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x52988e2e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x10000
SizeOfInitializedData0x55e00
SizeOfUninitializedData0
AddressOfEntryPoint0xf640
BaseOfCode0x1000
BaseOfData0x11000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x68000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xff0b0x10000R-X CODE
.rdata0x110000x28ee0x2a00R-- IDATA
.data0x140000x22bc80xe00RW- IDATA
.rsrc0x370000x2e8700x2ea00R-- IDATA
.reloc0x660000x1c940x1e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x12f400x42
IMPORT0x12f840x64
RESOURCE0x370000x2e870
EXCEPTION00
SECURITY00
BASERELOC0x660000x1530
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x110000x1d0
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAPTABLE123280
BITMAPTOOLBAR622480
ICON#1297620
ICON#2676240
ICON#396400
ICON#442640
ICON#524400
ICON#611280
GROUP_ICONAPPLICATION900
MANIFEST#13810
module_namehintordfunction_name
MSIMG32.dll2GradientFill
MSIMG32.dllAlphaBlend
KERNEL32.dll807GlobalUnlock
KERNEL32.dll789GlobalAlloc
KERNEL32.dll800GlobalLock
KERNEL32.dll804GlobalSize
KERNEL32.dll973MulDiv
KERNEL32.dll126CloseHandle
KERNEL32.dll591GetLocalTime
KERNEL32.dll1087ReadFile
KERNEL32.dll1486WriteFile
KERNEL32.dll1258SetFilePointer
KERNEL32.dll185CreateFileA
KERNEL32.dll610GetModuleHandleA
KERNEL32.dll817HeapFree
KERNEL32.dll335ExitProcess
KERNEL32.dll672GetProcessHeap
KERNEL32.dll813HeapAlloc
USER32.dll546LoadIconA
USER32.dll293GetClientRect
USER32.dll339GetKeyState
USER32.dll704SetCapture
USER32.dll285GetClassInfoExA
USER32.dll337GetKeyNameTextA
USER32.dll825TrackPopupMenu
USER32.dll648RegisterClassExA
USER32.dll489InsertMenuItemA
USER32.dll459GetWindowRect
USER32.dll685ScreenToClient
USER32.dll367GetMessageA
USER32.dll713SetCursor
USER32.dll173DestroyWindow
USER32.dll73ClientToScreen
USER32.dll233EndPaint
USER32.dll57CharUpperA
USER32.dll498IsCharAlphaA
USER32.dll204DrawFrameControl
USER32.dll548LoadImageA
USER32.dll202DrawFocusRect
USER32.dll211DrawTextA
USER32.dll710SetClipboardData
USER32.dll606OpenClipboard
USER32.dll223EmptyClipboard
USER32.dll296GetClipboardData
USER32.dll507IsClipboardFormatAvailable
USER32.dll75CloseClipboard
USER32.dll109CreateMenu
USER32.dll724SetFocus
USER32.dll695SendMessageA
USER32.dll14BeginPaint
USER32.dll281GetCapture
USER32.dll831TranslateMessage
USER32.dll353GetMenu
USER32.dll463GetWindowTextA
USER32.dll573MapVirtualKeyA
USER32.dll780SetWindowLongA
USER32.dll495InvalidateRect
USER32.dll16BringWindowToTop
USER32.dll452GetWindowLongA
USER32.dll112CreateWindowExA
USER32.dll160DefWindowProcA
USER32.dll311GetDesktopWindow
USER32.dll423GetSysColor
USER32.dll783SetWindowPos
USER32.dll307GetCursorPos
USER32.dll361GetMenuItemInfoA
USER32.dll800ShowWindow
USER32.dll110CreatePopupMenu
USER32.dll271GetActiveWindow
USER32.dll9AppendMenuA
USER32.dll359GetMenuItemCount
USER32.dll623PostMessageA
USER32.dll180DispatchMessageA
USER32.dll3AdjustWindowRectEx
USER32.dll676ReleaseCapture
USER32.dll426GetSystemMetrics
USER32.dll787SetWindowTextA
USER32.dll855UpdateWindow
USER32.dll228EnableWindow
USER32.dll171DestroyMenu
USER32.dll740SetMenuItemInfoA
USER32.dll542LoadCursorA
USER32.dll824TrackMouseEvent
GDI32.dll568GetStockObject
GDI32.dll550GetObjectA
GDI32.dll671RoundRect
GDI32.dll592GetTextMetricsA
GDI32.dll490GetClipBox
GDI32.dll652Polyline
GDI32.dll480GetCharWidth32A
GDI32.dll80CreateRectRgn
GDI32.dll739SetDCPenColor
GDI32.dll660Rectangle
GDI32.dll48CreateCompatibleBitmap
GDI32.dll475GetCharABCWidthsA
GDI32.dll49CreateCompatibleDC
GDI32.dll722SelectClipRgn
GDI32.dll724SelectObject
GDI32.dll270DeleteObject
GDI32.dll732SetBkMode
GDI32.dll738SetDCBrushColor
GDI32.dll502GetDeviceCaps
GDI32.dll61CreateFontA
GDI32.dll54CreateDIBSection
GDI32.dll491GetClipRgn
GDI32.dll623MoveToEx
GDI32.dll19BitBlt
GDI32.dll635PatBlt
GDI32.dll609LineTo
GDI32.dll771SetTextColor
GDI32.dll267DeleteDC
GDI32.dll789TextOutA
ordentry_vafunction_name
10xf590exit
module_nameevrika.exe
flags0
timestamp2013-11-29 12:53:01
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x12f6c
Functions(1)0x12f68
NameOrdinals(1)0x12f70
offsetsizetypecomment
0279552EXE11/29/2013 12:53:02#
15c115HTM#
13e9029762PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER