parentSpotifySetup.exe
filenameSpotifySetup.unpacked.exe
size752344 (0xb7ad8)
md53d92d13505ad412387a6fb7383fb8969
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x120

Rich Header

lib idversiontimes used
2414011612
24340116153
2424011627
261230266
199411181
2602340664
244401163
2394011617
10200
2612340662
260235062
2612350617
2592340623
255235061
258235061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x56fdcfa5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion14.0
SizeOfCode0x62400
SizeOfInitializedData0x54a00
SizeOfUninitializedData0
AddressOfEntryPoint0x2099e
BaseOfCode0x1000
BaseOfData0x64000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0xbb000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x622750x62400R-X CODE
.rdata0x640000x2b8fe0x2ba00R-- IDATA
.data0x900000x8f300x7c00RW- IDATA
.gfids0x990000x74c0x800R-- IDATA
.tls0x9a00090x200RW- IDATA
.rsrc0x9b0000x1f5280x1f600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x8e9780xb4
RESOURCE0x9b0000x1f528
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x85d440x18
LOAD_CONFIG0x85c880x40
Bound_IAT00
IAT00
Delay_IAT0x8e8240x60
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x49a0000x49a0080x4982680x4644e400x300000
typenamesizecp
ICON#111280
ICON#242640
ICON#396400
ICON#4169360
ICON#5676240
ICON#6256470
GROUP_ICON#1900
VERSION#19000
MANIFEST#115050
module_namehintordfunction_name
KERNEL32.DLLFindClose
KERNEL32.DLLFindFirstFileW
KERNEL32.DLLFindNextFileW
KERNEL32.DLLGetFileAttributesW
KERNEL32.DLLRemoveDirectoryW
KERNEL32.DLLWriteFile
KERNEL32.DLLGetLastError
KERNEL32.DLLSleep
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLGetModuleFileNameW
KERNEL32.DLLMoveFileExW
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLVerSetConditionMask
KERNEL32.DLLGetCommandLineW
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLSetEvent
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLCreateMutexW
KERNEL32.DLLOpenMutexW
KERNEL32.DLLCreateEventW
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLExitProcess
KERNEL32.DLLTerminateProcess
KERNEL32.DLLGetExitCodeProcess
KERNEL32.DLLCreateThread
KERNEL32.DLLCreateProcessW
KERNEL32.DLLOpenProcess
KERNEL32.DLLGetLocalTime
KERNEL32.DLLGetTickCount
KERNEL32.DLLGetVersionExW
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLGetProcAddress
KERNEL32.DLLLoadLibraryExA
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLCreateDirectoryW
KERNEL32.DLLGetComputerNameW
KERNEL32.DLLVerifyVersionInfoW
KERNEL32.DLLCompareStringW
KERNEL32.DLLGetLocaleInfoA
KERNEL32.DLLVirtualQuery
KERNEL32.DLLVirtualProtect
KERNEL32.DLLGetSystemInfo
KERNEL32.DLLHeapSize
KERNEL32.DLLReadConsoleW
KERNEL32.DLLWriteConsoleW
KERNEL32.DLLGetTimeZoneInformation
KERNEL32.DLLSetStdHandle
KERNEL32.DLLFindFirstFileExW
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLSetEnvironmentVariableA
KERNEL32.DLLFreeEnvironmentStringsW
KERNEL32.DLLGetEnvironmentStringsW
KERNEL32.DLLGetOEMCP
KERNEL32.DLLIsValidCodePage
KERNEL32.DLLReadFile
KERNEL32.DLLGetConsoleMode
KERNEL32.DLLGetConsoleCP
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLEnumSystemLocalesW
KERNEL32.DLLGetUserDefaultLCID
KERNEL32.DLLIsValidLocale
KERNEL32.DLLGetTimeFormatW
KERNEL32.DLLGetDateFormatW
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLLocalFree
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLGetFileType
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLGetACP
KERNEL32.DLLGetStdHandle
KERNEL32.DLLGetModuleHandleExW
KERNEL32.DLLLoadLibraryExW
KERNEL32.DLLCreateFileMappingW
KERNEL32.DLLFreeLibrary
KERNEL32.DLLGetTempPathW
KERNEL32.DLLSetFilePointer
KERNEL32.DLLSetEndOfFile
KERNEL32.DLLGetFileSize
KERNEL32.DLLDeleteFileW
KERNEL32.DLLCreateFileW
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLCloseHandle
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLIsProcessorFeaturePresent
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLResetEvent
KERNEL32.DLLWaitForSingleObjectEx
KERNEL32.DLLIsDebuggerPresent
KERNEL32.DLLGetStartupInfoW
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLInitializeSListHead
KERNEL32.DLLEncodePointer
KERNEL32.DLLDecodePointer
KERNEL32.DLLSetLastError
KERNEL32.DLLInitializeCriticalSectionAndSpinCount
KERNEL32.DLLTlsAlloc
KERNEL32.DLLTlsGetValue
KERNEL32.DLLTlsSetValue
KERNEL32.DLLTlsFree
KERNEL32.DLLLCMapStringW
KERNEL32.DLLGetLocaleInfoW
KERNEL32.DLLGetStringTypeW
KERNEL32.DLLGetCPInfo
KERNEL32.DLLSetFilePointerEx
KERNEL32.DLLDeviceIoControl
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLAreFileApisANSI
KERNEL32.DLLFormatMessageA
KERNEL32.DLLRtlUnwind
KERNEL32.DLLRaiseException
ADVAPI32.dllSystemFunction036
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllConvertSidToStringSidW
ADVAPI32.dllLookupAccountNameW
ADVAPI32.dllGetTokenInformation
ADVAPI32.dllOpenProcessToken
ADVAPI32.dllRegSetValueExW
ADVAPI32.dllRegCreateKeyExW
COMCTL32.dllInitCommonControlsEx
GDI32.dllGetStockObject
GDI32.dllGetTextExtentPoint32W
ole32.dllCoInitialize
ole32.dllCoCreateGuid
ole32.dllCoCreateInstance
OLEAUT32.dll2
OLEAUT32.dll6
SHELL32.dllShellExecuteExW
SHELL32.dllSHGetFolderPathW
SHELL32.dllSHChangeNotify
SHELL32.dllShellExecuteW
USER32.dllwsprintfA
USER32.dllwsprintfW
USER32.dllGetDC
USER32.dllSystemParametersInfoW
USER32.dllLoadIconW
USER32.dllLoadCursorW
USER32.dllGetWindowThreadProcessId
USER32.dllFindWindowA
USER32.dllSetWindowLongW
USER32.dllGetWindowLongW
USER32.dllMessageBoxW
USER32.dllAdjustWindowRect
USER32.dllGetMessageW
USER32.dllReleaseDC
USER32.dllGetWindowRect
USER32.dllGetSystemMetrics
USER32.dllSetTimer
USER32.dllGetActiveWindow
USER32.dllSetDlgItemTextW
USER32.dllGetDlgItem
USER32.dllSetWindowPos
USER32.dllShowWindow
USER32.dllCreateWindowExW
USER32.dllRegisterClassExW
USER32.dllDefWindowProcW
USER32.dllPostMessageW
USER32.dllSendMessageTimeoutA
USER32.dllSendMessageW
USER32.dllDispatchMessageW
USER32.dllTranslateMessage

StringTable 000004b0

CompanyNameSpotify Ltd
FileDescriptionSpotifyInstaller
FileVersion0,0,0,0
InternalNameSpotifyInstaller
LegalCopyrightCopyright (c) 2016, Spotify Ltd
OriginalFilenameSpotifyInstaller.exe
ProductNameSpotify
ProductVersion1.0.26.132.ga4e3ccee

VS_FIXEDFILEINFO

FileVersion1.0.26.132
ProductVersion0.0.0.0
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0744960EXE04/01/2016 01:32:21#
15c115HTM#
aef2825647PNG(256 x 256)#
b5e007384BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 752344 bytes (735 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x98268