filenameclipsrv.exe
size33280 (0x8200)
md534cbe729f38138217f9c80212a2a0c82
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1540351
93403513
10177
95403524
9440351
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x48025285
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x7200
SizeOfInitializedData0x1600
SizeOfUninitializedData0
AddressOfEntryPoint0x6d2b
BaseOfCode0x1000
BaseOfData0x9000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0xe4e5
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.1 EXE / v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x710e0x7200R-X CODE
.data0x90000xbbc0x200RW- IDATA
.rsrc0xa0000x9c00xa00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x71a80x8c
RESOURCE0xa0000x9c0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12e00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x25b80x40
Bound_IAT0x2480x90
IAT0x10000x2c8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
STRING#12680
STRING#92000
GROUP_ICON#1000200
VERSION#19000
idlangstring
11033&Text
21033&Bitmap
31033&Picture
41033&Sylk
51033&DIF
61033T&IFF
71033&OEM Text
81033&DIB Bitmap
91033Pal&ette
101033Pe&n Data
111033&RIFF
121033&Wave Audio
131033&Unicode Text
141033&Enhanced Metafile
1281033O&wner display
1291033Disp&lay Text
1301033Displa&y Bitmap
1311033Display Pict&ure
1421033Display En&hanced Metafile
module_namehintordfunction_name
NDdeApi.dll501
NDdeApi.dll509
msvcrt.dll78_XcptFilter
msvcrt.dll200_cexit
msvcrt.dll656exit
msvcrt.dll110__initenv
msvcrt.dll109__getmainargs
msvcrt.dll315_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll237_except_handler3
msvcrt.dll246_exit
msvcrt.dll197_c_exit
msvcrt.dll761sprintf
msvcrt.dll214_controlfp
ADVAPI32.dll484RegOpenKeyExA
ADVAPI32.dll281GetTokenInformation
ADVAPI32.dll317IsValidSecurityDescriptor
ADVAPI32.dll306InitializeSecurityDescriptor
ADVAPI32.dll246GetLengthSid
ADVAPI32.dll305InitializeAcl
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll561SetSecurityDescriptorDacl
ADVAPI32.dll266GetSecurityDescriptorLength
ADVAPI32.dll408MakeSelfRelativeSD
ADVAPI32.dll431OpenThreadToken
ADVAPI32.dll426OpenProcessToken
ADVAPI32.dll507RegSetValueExA
ADVAPI32.dll475RegEnumValueA
ADVAPI32.dll468RegDeleteValueW
ADVAPI32.dll264GetSecurityDescriptorDacl
ADVAPI32.dll228GetAce
ADVAPI32.dll550SetFileSecurityW
ADVAPI32.dll508RegSetValueExW
ADVAPI32.dll525RevertToSelf
ADVAPI32.dll467RegDeleteValueA
ADVAPI32.dll571SetServiceStatus
ADVAPI32.dll515RegisterServiceCtrlHandlerA
ADVAPI32.dll577StartServiceCtrlDispatcherA
ADVAPI32.dll462RegCreateKeyExA
ADVAPI32.dll458RegCloseKey
KERNEL32.dll82CreateFileW
KERNEL32.dll130DeleteFileW
KERNEL32.dll360GetLastError
KERNEL32.dll269GetComputerNameA
KERNEL32.dll940lstrcmpW
KERNEL32.dll615MultiByteToWideChar
KERNEL32.dll586LocalAlloc
KERNEL32.dll952lstrlenW
KERNEL32.dll79CreateFileA
KERNEL32.dll468GetTickCount
KERNEL32.dll488GetWindowsDirectoryA
KERNEL32.dll951lstrlenA
KERNEL32.dll945lstrcpyA
KERNEL32.dll939lstrcmpA
KERNEL32.dll946lstrcpyW
KERNEL32.dll911WriteFile
KERNEL32.dll500GlobalFree
KERNEL32.dll503GlobalHandle
KERNEL32.dll493GlobalAlloc
KERNEL32.dll511GlobalUnlock
KERNEL32.dll504GlobalLock
KERNEL32.dll508GlobalSize
KERNEL32.dll129DeleteFileA
KERNEL32.dll936lstrcatA
KERNEL32.dll507GlobalReAlloc
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll317GetCurrentThread
KERNEL32.dll898WideCharToMultiByte
KERNEL32.dll822SetUnhandledExceptionFilter
KERNEL32.dll590LocalFree
KERNEL32.dll942lstrcmpiA
KERNEL32.dll374GetModuleHandleA
KERNEL32.dll49CloseHandle
KERNEL32.dll92CreateMutexA
KERNEL32.dll894WaitForSingleObject
KERNEL32.dll691ReleaseMutex
KERNEL32.dll678ReadFile
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll842TerminateProcess
KERNEL32.dll859UnhandledExceptionFilter
KERNEL32.dll777SetFilePointer
GDI32.dll556SetMapMode
GDI32.dll520SaveDC
GDI32.dll373GetEnhMetaFileHeader
GDI32.dll478PatBlt
GDI32.dll527SelectObject
GDI32.dll39CreateBitmap
GDI32.dll45CreateCompatibleDC
GDI32.dll40CreateBitmapIndirect
GDI32.dll558SetMetaFileBitsEx
GDI32.dll69CreatePalette
GDI32.dll547SetEnhMetaFileBits
GDI32.dll363GetDIBits
GDI32.dll500RealizePalette
GDI32.dll528SelectPalette
GDI32.dll51CreateDIBitmap
GDI32.dll569SetStretchBltMode
GDI32.dll513RestoreDC
GDI32.dll483PlayMetaFile
GDI32.dll576SetViewportOrgEx
GDI32.dll481PlayEnhMetaFile
GDI32.dll579SetWindowExtEx
GDI32.dll411GetPaletteEntries
GDI32.dll586StretchBlt
GDI32.dll575SetViewportExtEx
GDI32.dll422GetStockObject
GDI32.dll57CreateFontA
GDI32.dll143DeleteObject
GDI32.dll140DeleteDC
GDI32.dll331GetBitmapBits
GDI32.dll370GetEnhMetaFileBits
GDI32.dll406GetObjectA
GDI32.dll400GetMetaFileBitsEx
USER32.dll268GetDC
USER32.dll554ReleaseDC
USER32.dll226FillRect
USER32.dll188DrawTextA
USER32.dll191DrawTextW
USER32.dll439LoadCursorA
USER32.dll589SetCursor
USER32.dll654ShowCursor
USER32.dll204EnumClipboardFormats
USER32.dll259GetClipboardFormatNameW
USER32.dll457LoadStringW
USER32.dll571SendMessageA
USER32.dll538RegisterClipboardFormatA
USER32.dll513PostQuitMessage
USER32.dll134DdeUninitialize
USER32.dll124DdeNameService
USER32.dll586SetClipboardData
USER32.dll142DefWindowProcA
USER32.dll104DdeAddData
USER32.dll133DdeUnaccessData
USER32.dll115DdeFreeDataHandle
USER32.dll103DdeAccessData
USER32.dll109DdeCreateDataHandle
USER32.dll539RegisterClipboardFormatW
USER32.dll499OpenClipboard
USER32.dll66CloseClipboard
USER32.dll121DdeInitializeA
USER32.dll96CreateWindowExA
USER32.dll616SetProcessWindowStation
USER32.dll504OpenWindowStationA
USER32.dll534RegisterClassA
USER32.dll443LoadIconA
USER32.dll691UnregisterClassA
USER32.dll161DispatchMessageA
USER32.dll682TranslateMessage
USER32.dll314GetMessageA
USER32.dll123DdeKeepStringHandle
USER32.dll106DdeCmpStringHandles
USER32.dll116DdeFreeStringHandle
USER32.dll128DdeQueryStringA
USER32.dll125DdePostAdvise
USER32.dll120DdeImpersonateClient
USER32.dll110DdeCreateStringHandleA
USER32.dll111DdeCreateStringHandleW
USER32.dll728wsprintfA
USER32.dll118DdeGetLastError
USER32.dll117DdeGetData
USER32.dll729wsprintfW
USER32.dll193EmptyClipboard
USER32.dll75CountClipboardFormats
USER32.dll415IsClipboardFormatAvailable
USER32.dll257GetClipboardData

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows NT DDE Server
FileVersion5.1.2600.5512 (xpsp.080413-2105)
InternalNameCLIPSRV.EXE
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCLIPSRV.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.5512

VS_FIXEDFILEINFO

FileVersion5.1.2600.5512
ProductVersion5.1.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
033280EXE04/13/2008 18:35:49#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x248