filenamenorascan.exe
size8336415 (0x7f341f)
md5383235df69eca94853389e6c729604e8
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1272912
1180476
14729918
10804743
10896615
9521902
93217917
10197
4990442
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ee068e3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x17000
SizeOfInitializedData0xa000
SizeOfUninitializedData0
AddressOfEntryPoint0x13cfc
BaseOfCode0x1000
BaseOfData0x18000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x23000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Armadillo v4.x

Sections

namevavsizeraw sizeflags
.text0x10000x16b4a0x17000R-X CODE
.rdata0x180000x1cf40x2000R-- IDATA
.data0x1a0000x56440x5000RW- IDATA
.rsrc0x200000x2bd00x3000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x18b880xb4
RESOURCE0x200000x18a4
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x180000x328
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#137521252
DIALOG#112381252
DIALOG#113381252
DIALOG#1311221252
DIALOG#132381252
GROUP_ICON#800201252
VERSION#18001252
MANIFEST#19711252
module_namehintordfunction_name
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll479GetVersionExA
KERNEL32.dll478GetVersion
KERNEL32.dll404GetPrivateProfileStringA
KERNEL32.dll437GetStringTypeW
KERNEL32.dll434GetStringTypeA
KERNEL32.dll550IsBadCodePtr
KERNEL32.dll553IsBadReadPtr
KERNEL32.dll829SetUnhandledExceptionFilter
KERNEL32.dll350GetFileType
KERNEL32.dll433GetStdHandle
KERNEL32.dll793SetHandleCount
KERNEL32.dll335GetEnvironmentStringsW
KERNEL32.dll333GetEnvironmentStrings
KERNEL32.dll238FreeEnvironmentStringsW
KERNEL32.dll237FreeEnvironmentStringsA
KERNEL32.dll866UnhandledExceptionFilter
KERNEL32.dll395GetOEMCP
KERNEL32.dll245GetACP
KERNEL32.dll252GetCPInfo
KERNEL32.dll571LCMapStringW
KERNEL32.dll331GetDriveTypeA
KERNEL32.dll556IsBadWritePtr
KERNEL32.dll528HeapReAlloc
KERNEL32.dll885VirtualAlloc
KERNEL32.dll888VirtualFree
KERNEL32.dll520HeapCreate
KERNEL32.dll522HeapDestroy
KERNEL32.dll336GetEnvironmentVariableA
KERNEL32.dll264GetCommandLineA
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll612MoveFileA
KERNEL32.dll124DeleteFileA
KERNEL32.dll716RtlUnwind
KERNEL32.dll776SetEnvironmentVariableA
KERNEL32.dll69CreateDirectoryA
KERNEL32.dll524HeapFree
KERNEL32.dll518HeapAlloc
KERNEL32.dll519HeapCompact
KERNEL32.dll849TerminateProcess
KERNEL32.dll175ExitProcess
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll613MoveFileExA
KERNEL32.dll234FormatMessageA
KERNEL32.dll788SetFileTime
KERNEL32.dll924WritePrivateProfileStringA
KERNEL32.dll629OpenFile
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll782SetFileAttributesA
KERNEL32.dll778SetErrorMode
KERNEL32.dll363GetLocalTime
KERNEL32.dll353GetFullPathNameA
KERNEL32.dll619MultiByteToWideChar
KERNEL32.dll905WideCharToMultiByte
KERNEL32.dll459GetTempPathA
KERNEL32.dll429GetShortPathNameA
KERNEL32.dll338GetExitCodeProcess
KERNEL32.dll312GetCurrentDirectoryA
KERNEL32.dll767SetCurrentDirectoryA
KERNEL32.dll96CreateProcessA
KERNEL32.dll841Sleep
KERNEL32.dll944lstrcatA
KERNEL32.dll959lstrlenA
KERNEL32.dll906WinExec
KERNEL32.dll584LoadLibraryA
KERNEL32.dll408GetProcAddress
KERNEL32.dll239FreeLibrary
KERNEL32.dll325GetDiskFreeSpaceA
KERNEL32.dll494GlobalAlloc
KERNEL32.dll505GlobalLock
KERNEL32.dll512GlobalUnlock
KERNEL32.dll501GlobalFree
KERNEL32.dll46CloseHandle
KERNEL32.dll784SetFilePointer
KERNEL32.dll919WriteFile
KERNEL32.dll683ReadFile
KERNEL32.dll77CreateFileA
KERNEL32.dll361GetLastError
KERNEL32.dll201FindFirstFileA
KERNEL32.dll197FindClose
KERNEL32.dll489GetWindowsDirectoryA
KERNEL32.dll570LCMapStringA
KERNEL32.dll441GetSystemDirectoryA
USER32.dll158DialogBoxParamA
USER32.dll225ExitWindowsEx
USER32.dll422IsIconic
USER32.dll515PostQuitMessage
USER32.dll142DefWindowProcA
USER32.dll15BringWindowToTop
USER32.dll513PostMessageA
USER32.dll198EndDialog
USER32.dll419IsDlgButtonChecked
USER32.dll56CheckDlgButton
USER32.dll275GetDlgItemTextA
USER32.dll565SendDlgItemMessageA
USER32.dll296GetLastActivePopup
USER32.dll533RegisterClassA
USER32.dll441LoadCursorA
USER32.dll445LoadIconA
USER32.dll2AdjustWindowRectEx
USER32.dll362GetWindow
USER32.dll570SendMessageA
USER32.dll346GetSysColor
USER32.dll560ScreenToClient
USER32.dll372GetWindowRect
USER32.dll273GetDlgItem
USER32.dll200EndPaint
USER32.dll13BeginPaint
USER32.dll255GetClientRect
USER32.dll226FillRect
USER32.dll59CheckRadioButton
USER32.dll597SetFocus
USER32.dll325GetParent
USER32.dll698UpdateWindow
USER32.dll433IsWindowVisible
USER32.dll403InvalidateRect
USER32.dll85CreateDialogParamA
USER32.dll532RedrawWindow
USER32.dll511PeekMessageA
USER32.dll314GetMessageA
USER32.dll417IsDialogMessageA
USER32.dll681TranslateMessage
USER32.dll161DispatchMessageA
USER32.dll594SetDlgItemTextA
USER32.dll645SetWindowTextA
USER32.dll642SetWindowPos
USER32.dll657ShowWindow
USER32.dll153DestroyWindow
USER32.dll96CreateWindowExA
USER32.dll366GetWindowLongA
USER32.dll430IsWindowEnabled
USER32.dll27CallWindowProcA
USER32.dll706ValidateRect
USER32.dll639SetWindowLongA
USER32.dll252GetClassNameA
USER32.dll478MessageBoxA
USER32.dll196EnableWindow
USER32.dll573SendMessageTimeoutA
USER32.dll725wsprintfA
USER32.dll349GetSystemMetrics
USER32.dll188DrawTextA
USER32.dll227FindWindowA
GDI32.dll425GetSystemPaletteEntries
GDI32.dll69CreatePalette
GDI32.dll533SetBkColor
GDI32.dll221ExtTextOutA
GDI32.dll363GetDeviceCaps
GDI32.dll534SetBkMode
GDI32.dll3AddFontResourceA
GDI32.dll504RemoveFontResourceA
GDI32.dll421GetStockObject
GDI32.dll140DeleteDC
GDI32.dll143DeleteObject
GDI32.dll18BitBlt
GDI32.dll526SelectObject
GDI32.dll44CreateCompatibleBitmap
GDI32.dll45CreateCompatibleDC
GDI32.dll499RealizePalette
GDI32.dll527SelectPalette
GDI32.dll63CreateHalftonePalette
GDI32.dll48CreateDIBPatternBrush
GDI32.dll80CreateSolidBrush
GDI32.dll537SetBrushOrgEx
GDI32.dll568SetStretchBltMode
GDI32.dll58CreateFontIndirectA
GDI32.dll572SetTextColor
GDI32.dll586StretchDIBits
ADVAPI32.dll466RegDeleteValueA
ADVAPI32.dll426OpenProcessToken
ADVAPI32.dll333LookupPrivilegeValueA
ADVAPI32.dll28AdjustTokenPrivileges
ADVAPI32.dll461RegCreateKeyExA
ADVAPI32.dll460RegCreateKeyA
ADVAPI32.dll457RegCloseKey
ADVAPI32.dll481RegOpenKeyA
ADVAPI32.dll505RegSetValueExA
ADVAPI32.dll491RegQueryValueA
ADVAPI32.dll482RegOpenKeyExA
ADVAPI32.dll492RegQueryValueExA
SHELL32.dll121SHBrowseForFolderA
SHELL32.dll195SHGetSpecialFolderLocation
SHELL32.dll188SHGetPathFromIDListA
SHELL32.dll183SHGetMalloc
SHELL32.dll263ShellExecuteA
ole32.dll237OleInitialize
ole32.dll16CoCreateInstance
ole32.dll46CoGetMalloc
ole32.dll260OleUninitialize
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dll10VerQueryValueA
VERSION.dll4VerFindFileA
COMCTL32.dll17

StringTable 040904b0

Comments
CompanyName
FileDescription
FileVersion2, 0, 0, 43
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductNameNora Antimalware Scanner Install Program
ProductVersion2, 0, 0, 43
SpecialBuild

VS_FIXEDFILEINFO

FileVersion2.0.0.43
ProductVersion2.0.0.43
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0139264EXE12/08/2011 07:36:03#
15c115HTM#
220008197151BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 8336415 bytes (8142 KiB)


--
Type = bzip2
ERRORS:
There are data after the end of archive
Offset = 139909
Physical Size = 18863
Tail Size = 8177643
Streams = 1
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    .....        49800        18863  data~
------------------- ----- ------------ ------------  ------------------------
                                 49800        18863  1 files

Warnings: 1

Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK