ABC_Signed.PWC - PACKAGE.EXE

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ABC_Signed.PWC
size	106496 (0x1a000)
md5	39ea0530d10a8a1da9ef5cc50a93a89f

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc8

Rich Header

lib id	version	times used
93	2067	3
1	0	1
96	3077	1
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x43270e52
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x1a00
SizeOfInitializedData	0x19e00
SizeOfUninitializedData	0x200
AddressOfEntryPoint	0x8098
BaseOfCode	0x8000
BaseOfData	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x20000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x400
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

NeoLite v2.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x200	0x200	RW- UDATA
.rdata	0x2000	0x200	0x200	R-- IDATA
.rsrc	0x3000	0x4398	0x1800	R-- IDATA
.neolit	0x8000	0x1868	0x1868	RWX CODE
.SEFCMD	0xa000	0x4000	0x4000	R-- IDATA
.PTData	0xe000	0x11800	0x11800	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8000	0x3c
RESOURCE	0x3000	0x1800
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x803c	0x10
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#4	308
CURSOR	#5	180
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
CURSOR	#9	308
CURSOR	#10	308
CURSOR	#11	308
CURSOR	#12	308
CURSOR	#13	308
CURSOR	#14	308
CURSOR	#15	308
CURSOR	#16	308
CURSOR	#17	308
CURSOR	#18	308
CURSOR	#19	308
BITMAP	#30994	184
BITMAP	#30996	324
ICON	#1	744
ICON	#2	296
ICON	#3	1640
STRING	#3841	130
STRING	#3842	42
STRING	#3843	402
STRING	#3857	1250
STRING	#3858	794
STRING	#3859	732
STRING	#3865	172
STRING	#3867	1220
STRING	#3868	612
STRING	#3887	66
GROUP_CURSOR	#30977	34
GROUP_CURSOR	#30998	20
GROUP_CURSOR	#30999	20
GROUP_CURSOR	#31000	20
GROUP_CURSOR	#31001	20
GROUP_CURSOR	#31002	20
GROUP_CURSOR	#31003	20
GROUP_CURSOR	#31004	20
GROUP_CURSOR	#31005	20
GROUP_CURSOR	#31006	20
GROUP_CURSOR	#31007	20
GROUP_CURSOR	#31008	20
GROUP_CURSOR	#31009	20
GROUP_CURSOR	#31010	20
GROUP_CURSOR	#31011	20
GROUP_ICON	#1	48
VERSION	#1	852

module_name	hint	function_name
USER32.dll	478	MessageBoxA
kernel32.dll	398	LoadLibraryA
kernel32.dll	277	GetProcAddress

StringTable 040904b0

CompanyName	New Boundary Technologies, Inc.
FileDescription	PrismXL Package
FileVersion	7.1.0.14
InternalName	PrismXL Package
LegalCopyright	© 1997-2005 New Boundary Technologies
OriginalFilename	PACKAGE.EXE
ProductName	PrismXL Software Family
ProductVersion	7.1.0.14
SpecialBuild	1

VS_FIXEDFILEINFO

FileVersion	7.1.0.14
ProductVersion	7.1.0.14
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	106496	EXE	09/13/2005 17:37:22	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x48f0

[?] can't find file_offset of VA 0x49c8

[?] can't find file_offset of VA 0x4b10

[?] can't find file_offset of VA 0x4c58

[?] can't find file_offset of VA 0x4da0

[?] can't find file_offset of VA 0x4ee8

[?] can't find file_offset of VA 0x5030

[?] can't find file_offset of VA 0x5178

[?] can't find file_offset of VA 0x52c0

[?] can't find file_offset of VA 0x5408

[?] can't find file_offset of VA 0x5550

[?] can't find file_offset of VA 0x5698

[?] can't find file_offset of VA 0x57e0

[?] can't find file_offset of VA 0x5928

[?] can't find file_offset of VA 0x5a70

[?] can't find file_offset of VA 0x5bb8

[?] can't find file_offset of VA 0x5c70

[?] can't find file_offset of VA 0x5db4

[?] can't find file_offset of VA 0x5e38

[?] can't find file_offset of VA 0x5e64

[?] can't find file_offset of VA 0x5ff8

[?] can't find file_offset of VA 0x6864

[?] can't find file_offset of VA 0x6588

[?] can't find file_offset of VA 0x64dc

[?] can't find file_offset of VA 0x6b80

[?] can't find file_offset of VA 0x7044

[?] can't find file_offset of VA 0x72a8

[?] can't find file_offset of VA 0x49a4

[?] can't find file_offset of VA 0x5164

[?] can't find file_offset of VA 0x4afc

[?] can't find file_offset of VA 0x501c

[?] can't find file_offset of VA 0x4ed4

[?] can't find file_offset of VA 0x57cc

[?] can't find file_offset of VA 0x4d8c

[?] can't find file_offset of VA 0x53f4

[?] can't find file_offset of VA 0x4c44

[?] can't find file_offset of VA 0x52ac

[?] can't find file_offset of VA 0x553c

[?] can't find file_offset of VA 0x5684

[?] can't find file_offset of VA 0x5914

[?] can't find file_offset of VA 0x5a5c

[?] can't find file_offset of VA 0x5ba4

ABC_Signed.PWC-