griyeacomours.exe

info
MZ
PE
resources
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	griyeacomours.exe
size	113168 (0x1ba10)
md5	42d38b2738fd34a4d2af3d6c31850954

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
93	4035	6
14	7254	2
11	8047	2
10	8047	11
4	65391	2
11	9782	3
4	9782	1638403
1	0	210
11	8168	28167
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x538df301
PointerToSymbolTable	1
NumberOfSymbols	0x10000
SizeOfOptionalHeader	0xe0
Characteristics	0xf
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x1000000
SizeOfInitializedData	0x5000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x93b8
BaseOfCode	0x1000
BaseOfData	0x100
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	0.257
ImageVersion	0.0
SubsystemVersion	4.2
Reserved1	0
SizeOfImage	0xf000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x580101
LoaderFlags	1
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v5.0/v6.0 (MFC)

Sections

name	va	vsize	raw size	flags
te5t	0x1000	0x8400	0x9011	R-X
.rdata	0xa000	0x1aff	0x2000	RWX IDATA DISCARDABLE SHARED
.dat	0xc000	7	0x1002	RW- IDATA
rsrc	0xd000	0x1cff	0x500	R-- IDATA

Data Directory

type	va	size
EXPORT	0xad00	0
IMPORT	0xac58	0x1178
RESOURCE	0xd000	0x101
EXCEPTION	0	0x10001
SECURITY	0	0
BASERELOC	0	0x601
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0xff
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xa001	0x300
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp	r
DIALOG	#102	3364655611	3471451648	3566875699
DIALOG	#161	302	0	0
DIALOG	#161	0	0	655360
DIALOG	#161	108	0	0
DIALOG	#161	20	0	0
DIALOG	#161	20	0	0
DIALOG	#161	20	0	0
GROUP_CURSOR	#157	20	0	0
VERSION	#1	772	0	0
CURSOR	#2052	748	0	0
BITMAP	#2052	748	0	0
ICON	#2052	748	0	0

module_name	hint	ord	function_name
MFC42		4441
MFC42		2648
MFC42		2055
MFC42		6376
MFC42		3749
MFC42		5065
MFC42		1727
MFC42		5261
MFC42		2446
MFC42		2124
MFC42		5277
MFC42		2982
MFC42		3147
MFC42		3259
MFC42		4465
MFC42		3136
MFC42		3262
MFC42		2985
MFC42		3081
MFC42		2976
MFC42		3830
MFC42		3594
MFC42		3825
MFC42		3079
MFC42		4080
MFC42		4627
MFC42		4425
MFC42		3597
MFC42		324
MFC42		641
MFC42		4234
MFC42		825
MFC42		5810
MFC42		5481
MFC42		2031
MFC42		4863
MFC42		5796
MFC42		5478
MFC42		1971
MFC42		966
MFC42		3570
MFC42		278
MFC42		605
MFC42		4335
MFC42		4411
MFC42		4447
MFC42		4975
MFC42		4919
MFC42		800
MFC42		860
MFC42		540
MFC42		2297
MFC42		2363
MFC42		2358
MFC42		2289
MFC42		2370
MFC42		2642
MFC42		3092
MFC42		4673
MFC42		665
MFC42		1979
MFC42		823
MFC42		3318
MFC42		5186
MFC42		354
MFC42		4837
MFC42		6375
MFC42		4486
MFC42		2554
MFC42		2512
MFC42		5731
MFC42		3927
MFC42		1089
MFC42		5199
MFC42		2396
MFC42		3346
MFC42		5300
MFC42		5302
MFC42		2725
MFC42		4079
MFC42		4698
MFC42		5307
MFC42		5289
MFC42		5714
MFC42		4622
MFC42		4424
MFC42		3738
MFC42		561
MFC42		815
MFC42		6215
MFC42		6400
MFC42		1233
MFC42		1199
MFC42		1247
MFC42		818
MFC42		801
MFC42		3663
MFC42		5450
MFC42		6394
MFC42		5440
MFC42		6383
MFC42		1168
MFC42		6055
MFC42		1776
MFC42		5290
MFC42		3742
MFC42		541
MFC42		567
MFC42		4275
MFC42		755
MFC42		640
MFC42		323
MFC42		470
MFC42		4224
MFC42		613
MFC42		4133
MFC42		4297
MFC42		5794
MFC42		289
MFC42		941
MFC42		2818
MFC42		6143
MFC42		3571
MFC42		3626
MFC42		2414
MFC42		1641
MFC42		1146
MFC42		1640
MFC42		5785
MFC42		2864
MFC42		2379
MFC42		3798
MFC42		5280
MFC42		4353
MFC42		6374
MFC42		5163
MFC42		2385
MFC42		5241
MFC42		4407
MFC42		1775
MFC42		4078
MFC42		6052
MFC42		2514
MFC42		4710
MFC42		4998
MFC42		4853
MFC42		4376
MFC42		4274
MFC42		5265
MFC42		1576
MFC42		3831
MFC42		3922
MFC42		6442
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	183		_controlfp
MSVCRT.dll	271		_initterm
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	143		_acmdln
MSVCRT.dll	585		exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	46		void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	599		fopen
MSVCRT.dll	663		memcpy
MSVCRT.dll	665		memset
MSVCRT.dll	692		srand
MSVCRT.dll	720		time
MSVCRT.dll	241		_ftol
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	678		rand
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	390		_onexit
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	383		GetModuleHandleA
KERNEL32.dll	504		GlobalAlloc
KERNEL32.dll	515		GlobalLock
KERNEL32.dll	522		GlobalUnlock
KERNEL32.dll	381		GetModuleFileNameA
KERNEL32.dll	518		GlobalReAlloc
USER32.dll	524		PtInRect
USER32.dll	440		LoadBitmapA
USER32.dll	403		InvalidateRect
USER32.dll	580		SetCapture
USER32.dll	571		SendMessageA
USER32.dll	446		LoadIconA
USER32.dll	620		SetRect
USER32.dll	553		ReleaseCapture
USER32.dll	372		GetWindowRect
USER32.dll	516		PostQuitMessage
USER32.dll	589		SetCursor
USER32.dll	700		UpdateWindow
USER32.dll	448		LoadImageA
USER32.dll	644		SetWindowRgn
USER32.dll	314		GetMessageA
USER32.dll	682		TranslateMessage
USER32.dll	161		DispatchMessageA
USER32.dll	196		EnableWindow
USER32.dll	442		LoadCursorA
GDI32.dll	18		BitBlt
GDI32.dll	50		CreateDIBSection
GDI32.dll	217		ExtCreateRegion
GDI32.dll	33		CombineRgn
GDI32.dll	143		DeleteObject
GDI32.dll	140		DeleteDC
GDI32.dll	45		CreateCompatibleDC
GDI32.dll	405		GetObjectA
GDI32.dll	526		SelectObject
GDI32.dll		243269652
GDI32.dll		494927880
GDI32.dll		645922836
GDI32.dll		998244364
GDI32.dll		1048576012
GDI32.dll		696254476
GDI32.dll		545259532
GDI32.dll		1988100107
GDI32.dll		2004877326
GDI32.dll		1904214030
GDI32.dll		1887436812
GDI32.dll		25165825
GDI32.dll		176160770
GDI32.dll		847249411
GDI32.dll		1870659605
GDI32.dll		2139095047
GDI32.dll		612368402
GDI32.dll		864026645
GDI32.dll		1182793735
GDI32.dll		1920991235
GDI32.dll		1870659586
GDI32.dll		2038431746
GDI32.dll		1904214025
GDI32.dll		427819026
GDI32.dll		998244354
GDI32.dll		1988100099
GDI32.dll		1702887425
GDI32.dll		1736441874
GDI32.dll		109051928
GDI32.dll		2055208977
GDI32.dll		1350565897
GDI32.dll		880803853
GDI32.dll		914358292
GDI32.dll		629145620
GDI32.dll		1870659594
GDI32.dll		998244370
GDI32.dll		696254484
GDI32.dll		444596241
GDI32.dll		1367343129
GDI32.dll		796917764
GDI32.dll		1602224132
GDI32.dll		2055208981
GDI32.dll		276824088
GDI32.dll		662700036
GDI32.dll		1887436823
GDI32.dll		713031686
GDI32.dll		511705108
GDI32.dll		864026626
GDI32.dll		1937768464
GDI32.dll		8388610
GDI32.dll		1451229185
GDI32.dll		8388609
GDI32.dll		1233125392
GDI32.dll		578813968
GDI32.dll		763363329
GDI32.dll		2139095051
GDI32.dll		1937768471
GDI32.dll		427819014
GDI32.dll		1451229193
GDI32.dll		545259534
GDI32.dll		1719664657
GDI32.dll		1870659601
GDI32.dll		1853882374
GDI32.dll		612368399
GDI32.dll		1384120343
GDI32.dll		109051922
GDI32.dll		1971322899
GDI32.dll		847249425
GDI32.dll		293601296
GDI32.dll		2046820529
GDI32.dll		1879048368
GDI32.dll		1744830640
GDI32.dll		1509949616
GDI32.dll		1375731888
GDI32.dll		1040187568
GDI32.dll		704643248
GDI32.dll		1140850864
GDI32.dll		301990064
GDI32.dll		536871088
GDI32.dll		1073741824
GDI32.dll		1275068594
GDI32.dll		1509949618
GDI32.dll		1811939506
GDI32.dll		2046820530
GDI32.dll		771752115
GDI32.dll		503316658
GDI32.dll		201326770
GDI32.dll		2113929394

ord	entry_va	function_name

module_name	7d 01 47 65 74 4d 6f 64 75 6c 65 46 69 6c 65 4e \|}.GetModuleFileN\| 61 6d 65 41 \|ameA \|
flags	0xb1bc
timestamp	1970-01-01 12:38:06
version	45470.0
ordinal_base	45454
nFunctions	0
nNames	2147488089
Names(2147488089)	0x80000807
Functions(0)	0x80000a58
NameOrdinals(2147488089)	0x800018e8

show previews

offset	size	type	comment
0	54528	EXE	06/03/2014 16:08:33	#
15c1	15	HTM		#
d500	58640	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 113168 bytes (111 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 53880

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 53896

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 53912

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 53928

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 53960

[?] can't find file_offset of VA 0xde91b13c

[?] can't find file_offset of VA 0xd938

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0xe990

[?] can't find file_offset of VA 0xdd58

[?] can't find file_offset of VA 0xe060

[?] can't find file_offset of VA 0xe368

[?] can't find file_offset of VA 0xe670

[?] can't find file_offset of VA 0xe688

[?] can't find file_offset of VA 0xda68

[?] can't find file_offset of VA 0xdd70

[?] can't find file_offset of VA 0xe078

[?] can't find file_offset of VA 0x90af74

[?] can't find file_offset of VA 0x80000807

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x80000807

[?] can't find file_offset of VA 0x80000a58

[?] can't find file_offset of VA 0x800018e8