filenameICE Book Reader Rus.exe
size2018304 (0x1ecc00)
md5376aca6d27668754efecad436d3fa1af
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xc8

Rich Header

lib idversiontimes used
1015
1980345
1081681
617201
481681

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x370d108f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x200
SizeOfInitializedData0x1ec800
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1f0000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x1000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Wise Installer Stub

Sections

namevavsizeraw sizeflags
.text0x10000x1fe0x200R-X CODE
.rdata0x20000x2150x400R-- IDATA
.data0x30000x140x200RW- IDATA
.rsrc0x40000x1ec0000x1ec000R-- IDATA

Data Directory

typevasize
EXPORT0x21e00x35
IMPORT0x20440x3c
RESOURCE0x40000x1ebe06
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x20000x44
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
RCDATA#101320
GROUP_ICON#102200
VERSION#15880
module_namehintordfunction_name
KERNEL32.dll53CreateFileMappingA
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll68CreateProcessA
KERNEL32.dll202GetCommandLineA
KERNEL32.dll27CloseHandle
KERNEL32.dll688UnmapViewOfFile
KERNEL32.dll735WriteFile
KERNEL32.dll470MapViewOfFile
KERNEL32.dll87DeleteFileA
KERNEL32.dll355GetTempFileNameA
KERNEL32.dll357GetTempPathA
KERNEL32.dll52CreateFileA
KERNEL32.dll334GetShortPathNameA
KERNEL32.dll292GetModuleFileNameA
USER32.dll684wsprintfA
ordentry_vafunction_name
module_nameSIGNSTUB.EXE
flags0
timestamp1999-04-08 20:24:47
version0.0
ordinal_base1
nFunctions0
nNames0
Names(0)0x2208
Functions(0)0x2208
NameOrdinals(0)0x2208

StringTable 040904E4

CompanyNameHOMEXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
FileDescriptionICE Book Reader Professional Russian Install
oneVersion3XXXXXXXXXXXXX|,LegalCopyrigh�
EXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXX婍￿¸@ÐἎ຺

VS_FIXEDFILEINFO

FileVersion1.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x10001
FileType1
FileSubtype0
offsetsizetypecomment
02018304EXE04/08/1999 20:24:47#
15c115HTM#
Scanning the drive for archives:
1 file, 2018304 bytes (1971 KiB)


--
Type = PE
Physical Size = 2018304
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms
Created = 1999-04-08 20:24:47
Headers Size = 1024
Checksum = 0
Image Size = 2031616
Section Alignment = 4096
File Alignment = 512
Code Size = 512
Initialized Data Size = 2017280
Uninitialized Data Size = 0
Linker Version = 6.0
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 4096
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 1.0.0.0
ProductVersion: 1.0.0.0
CompanyName: HOME
----
Path = .rsrc_1
Size = 2013536
Packed Size = 2013536
Virtual Size = 2013536
Offset = 4768
--
Path = .rsrc_1
Type = zip
ERRORS:
Headers Error
Unconfirmed start of archive
WARNINGS:
There are data after the end of archive
Offset = 327736
Physical Size = 72458
Tail Size = 1613342

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2002-08-28 18:19:20 .....        82332        72422  01.jpg
------------------- ----- ------------ ------------  ------------------------
2002-08-28 18:19:20              82332        72422  1 files

Warnings: 1

Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] invalid VS_VERSIONINFO child type "\x01L\xCD!Th"