ZeuS_binary_386ccdfda5fc1335ade1e964de2552be.exe - X3D.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ZeuS_binary_386ccdfda5fc1335ade1e964de2552be.exe
size	203264 (0x31a00)
md5	386ccdfda5fc1335ade1e964de2552be

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x55a75a32
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	2.50
SizeOfCode	0xda00
SizeOfInitializedData	0x24400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0xf000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x35000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.code	0x1000	0x2ba1	0x2c00	R-X CODE
.text	0x4000	0xad34	0xae00	R-X CODE
.rdata	0xf000	0x1665	0x1800	R-- IDATA
.data	0x11000	0x22444	0x21e00	RW- IDATA
.rsrc	0x34000	0x5bc	0x600	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3233c	0xb4
RESOURCE	0x34000	0x5bc
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x32590	0x1a0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	696	0
MANIFEST	#1	611	0

module_name	hint	function_name
MSVCRT.dll	665	memset
MSVCRT.dll	664	memmove
MSVCRT.dll	663	memcpy
MSVCRT.dll	587	fabs
MSVCRT.dll	577	ceil
MSVCRT.dll	657	malloc
MSVCRT.dll	597	floor
MSVCRT.dll	606	free
MSVCRT.dll	588	fclose
MSVCRT.dll	599	fopen
MSVCRT.dll	610	fseek
MSVCRT.dll	742	wcslen
MSVCRT.dll	679	realloc
MSVCRT.dll	112	__p__iob
MSVCRT.dll	222	_fileno
MSVCRT.dll	427	_setmode
MSVCRT.dll	576	calloc
MSVCRT.dll	605	fread
MSVCRT.dll	590	ferror
MSVCRT.dll	612	ftell
MSVCRT.dll	238	_fstat
MSVCRT.dll	589	feof
MSVCRT.dll	676	qsort
MSVCRT.dll	600	fprintf
MSVCRT.dll	57	_CIlog
MSVCRT.dll	608	frexp
MSVCRT.dll	661	memchr
MSVCRT.dll	482	_vsnwprintf
KERNEL32.dll	506	GetModuleHandleW
KERNEL32.dll	676	HeapCreate
KERNEL32.dll	1118	VirtualAlloc
KERNEL32.dll	677	HeapDestroy
KERNEL32.dll	261	ExitProcess
KERNEL32.dll	550	GetProcessHeap
KERNEL32.dll	674	HeapAlloc
KERNEL32.dll	678	HeapFree
KERNEL32.dll	758	LoadLibraryA
KERNEL32.dll	546	GetProcAddress
KERNEL32.dll	333	FreeLibrary
KERNEL32.dll	590	GetSystemPowerStatus
KERNEL32.dll	1175	WriteFile
KERNEL32.dll	68	CloseHandle
KERNEL32.dll	697	InitializeCriticalSection
KERNEL32.dll	1084	TlsAlloc
KERNEL32.dll	761	LoadLibraryW
KERNEL32.dll	635	GetVersionExW
KERNEL32.dll	1067	Sleep
KERNEL32.dll	681	HeapReAlloc
COMCTL32.DLL		InitCommonControls
COMCTL32.DLL		InitCommonControlsEx
COMCTL32.DLL		ImageList_Destroy
USER32.DLL		DestroyWindow
USER32.DLL		GetWindow
USER32.DLL		SetActiveWindow
USER32.DLL		RemovePropW
USER32.DLL		SendMessageW
USER32.DLL		UnregisterClassW
USER32.DLL		DestroyAcceleratorTable
USER32.DLL		LoadIconW
USER32.DLL		LoadCursorW
USER32.DLL		SetCursorPos
USER32.DLL		LoadImageW
USER32.DLL		SetCursor
USER32.DLL		GetWindowLongW
USER32.DLL		GetParent
USER32.DLL		MapWindowPoints
USER32.DLL		MoveWindow
USER32.DLL		SystemParametersInfoW
USER32.DLL		GetWindowRect
USER32.DLL		GetSystemMetrics
USER32.DLL		GetKeyState
USER32.DLL		SetCapture
USER32.DLL		PostMessageW
USER32.DLL		GetCursorPos
USER32.DLL		ReleaseCapture
USER32.DLL		DestroyIcon
USER32.DLL		FillRect
GDI32.DLL		DeleteObject
GDI32.DLL		GetStockObject
GDI32.DLL		GetObjectType
GDI32.DLL		GetObjectW
GDI32.DLL		CreateCompatibleDC
GDI32.DLL		GetDIBits
GDI32.DLL		DeleteDC
GDI32.DLL		CreateDIBSection
GDI32.DLL		SelectObject
GDI32.DLL		BitBlt
GDI32.DLL		CreateBitmap
GDI32.DLL		SetPixel
OLE32.DLL		RevokeDragDrop
OLE32.DLL		CoInitialize
WSOCK32.DLL		closesocket
WSOCK32.DLL		WSACleanup
WSOCK32.DLL		WSAStartup
WINMM.DLL		timeBeginPeriod
WINMM.DLL		timeEndPeriod

StringTable 040904b0

CompanyName	Xara Ltd.
FileDescription	X3D Application
FileVersion	6.00
InternalName	X3D
LegalCopyright	Copyright Xara Ltd © 1997-2002
OriginalFilename	X3D.exe
ProductName	X3D Application
ProductVersion	6.00

VS_FIXEDFILEINFO

FileVersion	6.0.0.0
ProductVersion	6.0.0.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	203264	EXE	07/16/2015 07:16:02	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

ZeuS_binary_386ccdfda5fc1335ade1e964de2552be.exe-

MZ Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

ZeuS_binary_386ccdfda5fc1335ade1e964de2552be.exe
-