adobe_flash.exe - ShipDemo.exe

info
MZ
PE
resources
strings
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	adobe_flash.exe
size	135168 (0x21000)
md5	34ba06135068ef24415227b5ab56b8bd

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
0	0	4
19	8034	6
14	7299	1
11	8047	2
10	8047	11
4	8047	2
11	9782	3
4	9782	9
1	0	196
11	8168	11
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x53afc8da
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.10
SizeOfCode	0x4000
SizeOfInitializedData	0x1c000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3dfc
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x21000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3376	0x4000	R-X CODE
.rdata	0x5000	0x130a	0x2000	R-- IDATA
.data	0x7000	0x254	0x1000	RW- IDATA
.rsrc	0x8000	0x18bf5	0x19000	R-- IDATA SHARED

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x5d18	0x8c
RESOURCE	0x8000	0x18bf8
EXCEPTION	0x1000	0xb64e
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0x70
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp	r
ICON	#1	9640	1252	0
MENU	#128	264	1252	0
DIALOG	#100	222	1252	0
STRING	#9	44	1252	0
STRING	#3585	48	1252	0
STRING	#3603	310	1252	0
STRING	#3604	60	1252	0
STRING	#3605	96	1252	0
STRING	#3606	84	1252	0
STRING	#3697	58	1252	0
STRING	#3825	164	1252	0
STRING	#3826	62	1252	0
ACCELERATORS	#128	80	1252	0
RCDATA	#56	9459208	1252	0
GROUP_ICON	#1	20	1252	0
VERSION	#1	792	1252	0
VERSION	#1	0	4	589824
VERSION	#1	0	0	0
VERSION	#1	2147484304	0	0
VERSION	#1	35127296	236290048	36700160
VERSION	#1	6	2147483832	9
VERSION	#1	2147483832	9	2147483920
VERSION	#1	46137344	32768	0
VERSION	#1	10	2147483944	14
VERSION	#1	65536	134	2147484016
VERSION	#1	0	0	4
VERSION	#1	688128	19398656	950272
VERSION	#1	4	65536	100
VERSION	#1	19398656	950272	20971520
VERSION	#1	2147483992	0	0
VERSION	#1	3	2147483760	4
VERSION	#1	2415919192	3	2147483760
VERSION	#1	1032	33816	808
VERSION	#1	4283276308	4283276308	4283276308
VERSION	#1	161792	979584	167936
VERSION	#1	2147484040	0	0
VERSION	#1	3426604290	950689025	332288584

id	lang	string
128	2052	潜艇代码演示
57344	2052	潜艇代码演示
57345	2052	就绪
57632	2052	删除被选对象删除
57633	2052	全部删除全部删除
57634	2052	复制被选对象并将其置于剪贴板上复制
57635	2052	剪切被选对象并将其置于剪贴板上剪切
57636	2052	查找指定的正文查找
57637	2052	插入剪贴板内容粘贴
57640	2052	重复上一步操作重复
57641	2052	用不同的正文替换指定的正文替换
57642	2052	选择整个文档选择全部
57643	2052	撤消最后一步操作撤消
57644	2052	重新执行先前已撤消的操作重新执行
57653	2052	将活动的窗口分隔成窗格分隔
57664	2052	显示程序信息，版本号和版权关于
57665	2052	退出应用程序；提示保存文档退出
57680	2052	切换到下一个窗格下一窗格
57681	2052	切换回前一个窗格前一窗格
59136	2052	扩展名
59137	2052	大写
59138	2052	数字
59139	2052	滚动
59140	2052	改写
59141	2052	记录
61184	2052	改变窗口大小
61185	2052	改变窗口位置
61186	2052	将窗口缩小成图标
61187	2052	把窗口放大到最大尺寸
61188	2052	切换到下一个文档窗口
61189	2052	切换到先前的文档窗口
61190	2052	关闭活动的窗口并提示保存所有文档
61202	2052	把窗口恢复到正常大小
61203	2052	激活任务表

module_name	hint	ord	function_name
MFC42.DLL		2385
MFC42.DLL		5163
MFC42.DLL		6374
MFC42.DLL		4353
MFC42.DLL		5290
MFC42.DLL		3798
MFC42.DLL		4837
MFC42.DLL		4441
MFC42.DLL		2648
MFC42.DLL		2055
MFC42.DLL		6376
MFC42.DLL		3749
MFC42.DLL		5065
MFC42.DLL		1727
MFC42.DLL		2446
MFC42.DLL		2124
MFC42.DLL		5277
MFC42.DLL		2982
MFC42.DLL		3147
MFC42.DLL		3259
MFC42.DLL		4465
MFC42.DLL		3136
MFC42.DLL		3262
MFC42.DLL		2985
MFC42.DLL		3081
MFC42.DLL		2976
MFC42.DLL		3830
MFC42.DLL		3831
MFC42.DLL		3825
MFC42.DLL		3079
MFC42.DLL		4080
MFC42.DLL		4627
MFC42.DLL		4424
MFC42.DLL		3742
MFC42.DLL		640
MFC42.DLL		818
MFC42.DLL		1081
MFC42.DLL		823
MFC42.DLL		323
MFC42.DLL		715
MFC42.DLL		567
MFC42.DLL		415
MFC42.DLL		5597
MFC42.DLL		4275
MFC42.DLL		1233
MFC42.DLL		5261
MFC42.DLL		755
MFC42.DLL		470
MFC42.DLL		613
MFC42.DLL		5785
MFC42.DLL		1640
MFC42.DLL		289
MFC42.DLL		2379
MFC42.DLL		2818
MFC42.DLL		540
MFC42.DLL		5875
MFC42.DLL		800
MFC42.DLL		537
MFC42.DLL		6170
MFC42.DLL		5605
MFC42.DLL		2753
MFC42.DLL		6453
MFC42.DLL		6199
MFC42.DLL		1175
MFC42.DLL		924
MFC42.DLL		4160
MFC42.DLL		1842
MFC42.DLL		4242
MFC42.DLL		5241
MFC42.DLL		2390
MFC42.DLL		3059
MFC42.DLL		5100
MFC42.DLL		5103
MFC42.DLL		4467
MFC42.DLL		4303
MFC42.DLL		3350
MFC42.DLL		5012
MFC42.DLL		975
MFC42.DLL		5472
MFC42.DLL		3403
MFC42.DLL		2879
MFC42.DLL		2878
MFC42.DLL		4151
MFC42.DLL		4077
MFC42.DLL		5237
MFC42.DLL		5282
MFC42.DLL		2649
MFC42.DLL		1665
MFC42.DLL		4436
MFC42.DLL		674
MFC42.DLL		366
MFC42.DLL		4457
MFC42.DLL		5252
MFC42.DLL		5981
MFC42.DLL		4427
MFC42.DLL		4274
MFC42.DLL		6375
MFC42.DLL		4486
MFC42.DLL		2554
MFC42.DLL		2512
MFC42.DLL		5731
MFC42.DLL		3922
MFC42.DLL		1089
MFC42.DLL		5199
MFC42.DLL		2396
MFC42.DLL		3346
MFC42.DLL		5300
MFC42.DLL		5302
MFC42.DLL		2725
MFC42.DLL		4079
MFC42.DLL		4698
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		5714
MFC42.DLL		4622
MFC42.DLL		3738
MFC42.DLL		561
MFC42.DLL		815
MFC42.DLL		6215
MFC42.DLL		6117
MFC42.DLL		2621
MFC42.DLL		5265
MFC42.DLL		4376
MFC42.DLL		4853
MFC42.DLL		4998
MFC42.DLL		4710
MFC42.DLL		2514
MFC42.DLL		6052
MFC42.DLL		1775
MFC42.DLL		5280
MFC42.DLL		4425
MFC42.DLL		3597
MFC42.DLL		324
MFC42.DLL		641
MFC42.DLL		4234
MFC42.DLL		1576
MFC42.DLL		4407
MFC42.DLL		1776
MFC42.DLL		4078
MFC42.DLL		6055
MFC42.DLL		2408
MFC42.DLL		1146
MFC42.DLL		1641
MFC42.DLL		2096
MFC42.DLL		2414
MFC42.DLL		3626
MFC42.DLL		3571
MFC42.DLL		825
MFC42.DLL		3663
MFC42.DLL		686
MFC42.DLL		2723
MFC42.DLL		384
MFC42.DLL		1168
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	183		_controlfp
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	271		_initterm
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	143		_acmdln
MSVCRT.dll	585		exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	46		void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	692		srand
MSVCRT.dll	720		time
MSVCRT.dll	678		rand
MSVCRT.dll	599		fopen
MSVCRT.dll	402		_purecall
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	390		_onexit
KERNEL32.dll	293		GetModuleFileNameW
KERNEL32.dll	294		GetModuleHandleA
KERNEL32.dll	55		CreateFileW
KERNEL32.dll	450		LoadLibraryA
KERNEL32.dll	336		GetStartupInfoA
KERNEL32.dll	318		GetProcAddress
KERNEL32.dll	27		CloseHandle
KERNEL32.dll	274		GetFileSize
USER32.dll	657		UpdateWindow
USER32.dll	68		CopyRect
USER32.dll	326		GetSystemMetrics
USER32.dll	183		EnableWindow
USER32.dll	405		KillTimer
USER32.dll	377		IntersectRect
USER32.dll	410		LoadCursorA
USER32.dll	408		LoadBitmapA
USER32.dll	594		SetTimer
GDI32.dll	17		BitBlt
GDI32.dll	41		CreateCompatibleBitmap
GDI32.dll	42		CreateCompatibleDC
COMCTL32.dll	39		ImageList_Draw
COMCTL32.dll	30		ImageList_AddMasked

StringTable 041d04e3

Comments
CompanyName
FileDescription	ShipDemo
FileVersion	1, 0, 0, 1
InternalName	ShipDemo
LegalCopyright	(C) 2014
LegalTrademarks
OriginalFilename	ShipDemo.exe
PrivateBuild
ProductName	ShipDemo
ProductVersion	1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	135168	EXE	06/29/2014 08:05:46	#
15c1	15	HTM		#
b2c4	76907	JPG		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 36865 entries in directory, but got EOF on 12704-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33816

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 42424

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33048

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33006

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32828

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32832

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33094

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32844

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32880

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32868

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32842

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32948

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32846

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32864

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32804

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36564

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33039

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 98064

[?] too many errors getting resource data, stopped on 135 of 12704

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0xef2

[?] can't find file_offset of VA 0xe148000

[?] can't find file_offset of VA 0x800000a0

[?] can't find file_offset of VA 0x6

[?] can't find file_offset of VA 0x380001

[?] can't find file_offset of VA 0x80000110

[?] can't find file_offset of VA 0x4

[?] can't find file_offset of VA 0x80000158

[?] can't find file_offset of VA 0x1100000

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0xa8000

[?] can't find file_offset of VA 0x10

[?] can't find file_offset of VA 0x90000058

[?] can't find file_offset of VA 0x2

[?] can't find file_offset of VA 0x804

[?] can't find file_offset of VA 0xff4d9c14

[?] can't find file_offset of VA 0xef180

[?] can't find file_offset of VA 0x1

[?] can't find file_offset of VA 0x19e3f885

[?] can't find file_offset of VA 0x100604c

[?] can't find file_offset of VA 0x1005da4

[?] can't find file_offset of VA 0x0

adobe_flash.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 041d04e3

VS_FIXEDFILEINFO

adobe_flash.exe
-