| filename | 2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe | |
|---|---|---|
| size | 163840 (0x28000) | |
| md5 | 4320fecf4c53849d9333b3a60bb80736 | |
| type | PE32 executable (GUI) Intel 80386, for MS Windows | |
| mimetype | application/x-dosexec | |
| clamav | Win.Trojan.Agent-813182 FOUND | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x90 |
| blocks_in_file | 3 |
| num_relocs | 0 |
| header_paragraphs | 4 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0 |
| reserved0 | 0 |
| oem_id | 0 |
| oem_info | 0 |
| reserved2 | 0 |
| reserved3 | 0 |
| reserved4 | 0 |
| reserved5 | 0 |
| reserved6 | 0 |
| lfanew | 0xf8 |
Rich Header
| lib id | version | times used |
|---|---|---|
| 93 | 4035 | 10 |
| 11 | 8047 | 1 |
| 14 | 7299 | 3 |
| 10 | 8047 | 11 |
| 4 | 8047 | 2 |
| 11 | 9782 | 3 |
| 4 | 9782 | 3 |
| 1 | 0 | 285 |
| 11 | 8168 | 6 |
| 6 | 1735 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| .text | 0x1000 | 0x44b5 | 0x5000 | R-X CODE | |
| .rdata | 0x6000 | 0x175e | 0x2000 | R-- IDATA | |
| .data | 0x8000 | 0xb65 | 0x1000 | RW- IDATA | |
| .rsrc | 0x9000 | 0x1e654 | 0x1f000 | R-- CODE IDATA |
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0x6f08 | 0xa0 | |
| RESOURCE | 0x9000 | 0x1e654 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0 | 0 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0x6000 | 0x460 | |
| Delay_IAT | 0x2040 | 0x256 | |
| CLR_Header | 0 | 0 |
| id | lang | string |
|---|---|---|
| 128 | 2052 | LPR_Location LPR_Lo LPRLocation.Document LPR_Lo Document |
| 32771 | 2052 | 确定图象中的车牌区域! |
| 57344 | 2052 | LPR_Location |
| 57345 | 2052 | 就绪 |
| 57600 | 2052 | 建立新文档 新建 |
| 57601 | 2052 | 打开一个现有文档 打开 |
| 57602 | 2052 | 关闭活动文档 关闭 |
| 57603 | 2052 | 保存活动文档 保存 |
| 57604 | 2052 | 将活动文档以一个新文件名保存 另存为 |
| 57616 | 2052 | 打开该文档 |
| 57617 | 2052 | 打开该文档 |
| 57618 | 2052 | 打开该文档 |
| 57619 | 2052 | 打开该文档 |
| 57620 | 2052 | 打开该文档 |
| 57621 | 2052 | 打开该文档 |
| 57622 | 2052 | 打开该文档 |
| 57623 | 2052 | 打开该文档 |
| 57624 | 2052 | 打开该文档 |
| 57625 | 2052 | 打开该文档 |
| 57626 | 2052 | 打开该文档 |
| 57627 | 2052 | 打开该文档 |
| 57628 | 2052 | 打开该文档 |
| 57629 | 2052 | 打开该文档 |
| 57630 | 2052 | 打开该文档 |
| 57631 | 2052 | 打开该文档 |
| 57632 | 2052 | 删除被选对象 删除 |
| 57633 | 2052 | 全部删除 全部删除 |
| 57634 | 2052 | 复制被选对象并将其置于剪贴板上 复制 |
| 57635 | 2052 | 剪切被选对象并将其置于剪贴板上 剪切 |
| 57636 | 2052 | 查找指定的正文 查找 |
| 57637 | 2052 | 插入剪贴板内容 粘贴 |
| 57640 | 2052 | 重复上一步操作 重复 |
| 57641 | 2052 | 用不同的正文替换指定的正文 替换 |
| 57642 | 2052 | 选择整个文档 选择全部 |
| 57643 | 2052 | 撤消最后一步操作 撤消 |
| 57644 | 2052 | 重新执行先前已撤消的操作 重新执行 |
| 57653 | 2052 | 将活动的窗口分隔成窗格 分隔 |
| 57664 | 2052 | 显示程序信息，版本号和版权 关于 |
| 57665 | 2052 | 退出应用程序；提示保存文档 退出 |
| 57680 | 2052 | 切换到下一个窗格 下一窗格 |
| 57681 | 2052 | 切换回前一个窗格 前一窗格 |
| 59136 | 2052 | 扩展名 |
| 59137 | 2052 | 大写 |
| 59138 | 2052 | 数字 |
| 59139 | 2052 | 滚动 |
| 59140 | 2052 | 改写 |
| 59141 | 2052 | 记录 |
| 59142 | 2052 | processing file: |
| 59392 | 2052 | 显示或隐藏工具栏 显隐工具栏 |
| 59393 | 2052 | 显示或隐藏状态栏 显隐状态栏 |
| 61184 | 2052 | 改变窗口大小 |
| 61185 | 2052 | 改变窗口位置 |
| 61186 | 2052 | 将窗口缩小成图标 |
| 61187 | 2052 | 把窗口放大到最大尺寸 |
| 61188 | 2052 | 切换到下一个文档窗口 |
| 61189 | 2052 | 切换到先前的文档窗口 |
| 61190 | 2052 | 关闭活动的窗口并提示保存所有文档 |
| 61202 | 2052 | 把窗口恢复到正常大小 |
| 61203 | 2052 | 激活任务表 |
| module_name | hint | ord | function_name |
|---|---|---|---|
| MFC42.DLL | 3259 | ||
| MFC42.DLL | 4465 | ||
| MFC42.DLL | 3136 | ||
| MFC42.DLL | 3262 | ||
| MFC42.DLL | 2985 | ||
| MFC42.DLL | 3081 | ||
| MFC42.DLL | 2976 | ||
| MFC42.DLL | 3830 | ||
| MFC42.DLL | 3831 | ||
| MFC42.DLL | 3825 | ||
| MFC42.DLL | 3079 | ||
| MFC42.DLL | 4080 | ||
| MFC42.DLL | 4622 | ||
| MFC42.DLL | 4424 | ||
| MFC42.DLL | 3738 | ||
| MFC42.DLL | 561 | ||
| MFC42.DLL | 815 | ||
| MFC42.DLL | 617 | ||
| MFC42.DLL | 6215 | ||
| MFC42.DLL | 5301 | ||
| MFC42.DLL | 5214 | ||
| MFC42.DLL | 296 | ||
| MFC42.DLL | 986 | ||
| MFC42.DLL | 520 | ||
| MFC42.DLL | 4159 | ||
| MFC42.DLL | 6117 | ||
| MFC42.DLL | 2621 | ||
| MFC42.DLL | 1134 | ||
| MFC42.DLL | 5265 | ||
| MFC42.DLL | 4376 | ||
| MFC42.DLL | 4853 | ||
| MFC42.DLL | 4998 | ||
| MFC42.DLL | 4710 | ||
| MFC42.DLL | 2514 | ||
| MFC42.DLL | 6052 | ||
| MFC42.DLL | 4078 | ||
| MFC42.DLL | 1775 | ||
| MFC42.DLL | 4407 | ||
| MFC42.DLL | 5241 | ||
| MFC42.DLL | 2385 | ||
| MFC42.DLL | 5163 | ||
| MFC42.DLL | 6374 | ||
| MFC42.DLL | 4353 | ||
| MFC42.DLL | 5280 | ||
| MFC42.DLL | 3798 | ||
| MFC42.DLL | 4837 | ||
| MFC42.DLL | 4441 | ||
| MFC42.DLL | 2648 | ||
| MFC42.DLL | 2055 | ||
| MFC42.DLL | 6376 | ||
| MFC42.DLL | 3749 | ||
| MFC42.DLL | 5065 | ||
| MFC42.DLL | 1727 | ||
| MFC42.DLL | 5261 | ||
| MFC42.DLL | 2446 | ||
| MFC42.DLL | 2124 | ||
| MFC42.DLL | 5277 | ||
| MFC42.DLL | 4627 | ||
| MFC42.DLL | 4425 | ||
| MFC42.DLL | 3597 | ||
| MFC42.DLL | 324 | ||
| MFC42.DLL | 641 | ||
| MFC42.DLL | 4234 | ||
| MFC42.DLL | 540 | ||
| MFC42.DLL | 800 | ||
| MFC42.DLL | 1825 | ||
| MFC42.DLL | 4238 | ||
| MFC42.DLL | 4696 | ||
| MFC42.DLL | 3058 | ||
| MFC42.DLL | 3065 | ||
| MFC42.DLL | 6336 | ||
| MFC42.DLL | 2510 | ||
| MFC42.DLL | 2542 | ||
| MFC42.DLL | 5243 | ||
| MFC42.DLL | 5740 | ||
| MFC42.DLL | 1746 | ||
| MFC42.DLL | 5577 | ||
| MFC42.DLL | 3172 | ||
| MFC42.DLL | 5653 | ||
| MFC42.DLL | 4420 | ||
| MFC42.DLL | 4953 | ||
| MFC42.DLL | 4858 | ||
| MFC42.DLL | 2399 | ||
| MFC42.DLL | 4387 | ||
| MFC42.DLL | 3454 | ||
| MFC42.DLL | 3198 | ||
| MFC42.DLL | 6080 | ||
| MFC42.DLL | 6175 | ||
| MFC42.DLL | 4623 | ||
| MFC42.DLL | 4426 | ||
| MFC42.DLL | 652 | ||
| MFC42.DLL | 338 | ||
| MFC42.DLL | 4823 | ||
| MFC42.DLL | 3147 | ||
| MFC42.DLL | 6329 | ||
| MFC42.DLL | 5651 | ||
| MFC42.DLL | 3127 | ||
| MFC42.DLL | 3616 | ||
| MFC42.DLL | 2652 | ||
| MFC42.DLL | 665 | ||
| MFC42.DLL | 1979 | ||
| MFC42.DLL | 3176 | ||
| MFC42.DLL | 860 | ||
| MFC42.DLL | 354 | ||
| MFC42.DLL | 1669 | ||
| MFC42.DLL | 1920 | ||
| MFC42.DLL | 4262 | ||
| MFC42.DLL | 4589 | ||
| MFC42.DLL | 4588 | ||
| MFC42.DLL | 4899 | ||
| MFC42.DLL | 4370 | ||
| MFC42.DLL | 4892 | ||
| MFC42.DLL | 5076 | ||
| MFC42.DLL | 4341 | ||
| MFC42.DLL | 4349 | ||
| MFC42.DLL | 4889 | ||
| MFC42.DLL | 4531 | ||
| MFC42.DLL | 4545 | ||
| MFC42.DLL | 4543 | ||
| MFC42.DLL | 4526 | ||
| MFC42.DLL | 4529 | ||
| MFC42.DLL | 4524 | ||
| MFC42.DLL | 4963 | ||
| MFC42.DLL | 4960 | ||
| MFC42.DLL | 4108 | ||
| MFC42.DLL | 6055 | ||
| MFC42.DLL | 1776 | ||
| MFC42.DLL | 5240 | ||
| MFC42.DLL | 5290 | ||
| MFC42.DLL | 3748 | ||
| MFC42.DLL | 1725 | ||
| MFC42.DLL | 4432 | ||
| MFC42.DLL | 517 | ||
| MFC42.DLL | 784 | ||
| MFC42.DLL | 5260 | ||
| MFC42.DLL | 3693 | ||
| MFC42.DLL | 3626 | ||
| MFC42.DLL | 2414 | ||
| MFC42.DLL | 4133 | ||
| MFC42.DLL | 4297 | ||
| MFC42.DLL | 5788 | ||
| MFC42.DLL | 1641 | ||
| MFC42.DLL | 6131 | ||
| MFC42.DLL | 6216 | ||
| MFC42.DLL | 4723 | ||
| MFC42.DLL | 1842 | ||
| MFC42.DLL | 4242 | ||
| MFC42.DLL | 2723 | ||
| MFC42.DLL | 2390 | ||
| MFC42.DLL | 3059 | ||
| MFC42.DLL | 5100 | ||
| MFC42.DLL | 5103 | ||
| MFC42.DLL | 4467 | ||
| MFC42.DLL | 4303 | ||
| MFC42.DLL | 3350 | ||
| MFC42.DLL | 5012 | ||
| MFC42.DLL | 975 | ||
| MFC42.DLL | 5472 | ||
| MFC42.DLL | 3403 | ||
| MFC42.DLL | 2879 | ||
| MFC42.DLL | 2878 | ||
| MFC42.DLL | 4151 | ||
| MFC42.DLL | 4077 | ||
| MFC42.DLL | 5237 | ||
| MFC42.DLL | 5282 | ||
| MFC42.DLL | 2649 | ||
| MFC42.DLL | 1665 | ||
| MFC42.DLL | 4436 | ||
| MFC42.DLL | 4427 | ||
| MFC42.DLL | 796 | ||
| MFC42.DLL | 674 | ||
| MFC42.DLL | 554 | ||
| MFC42.DLL | 529 | ||
| MFC42.DLL | 366 | ||
| MFC42.DLL | 807 | ||
| MFC42.DLL | 2494 | ||
| MFC42.DLL | 2627 | ||
| MFC42.DLL | 2626 | ||
| MFC42.DLL | 5186 | ||
| MFC42.DLL | 6000 | ||
| MFC42.DLL | 2117 | ||
| MFC42.DLL | 4163 | ||
| MFC42.DLL | 6625 | ||
| MFC42.DLL | 4457 | ||
| MFC42.DLL | 5252 | ||
| MFC42.DLL | 1576 | ||
| MFC42.DLL | 2982 | ||
| MFC42.DLL | 5714 | ||
| MFC42.DLL | 5289 | ||
| MFC42.DLL | 5307 | ||
| MFC42.DLL | 4698 | ||
| MFC42.DLL | 4079 | ||
| MFC42.DLL | 2725 | ||
| MFC42.DLL | 5302 | ||
| MFC42.DLL | 5300 | ||
| MFC42.DLL | 3346 | ||
| MFC42.DLL | 2396 | ||
| MFC42.DLL | 5199 | ||
| MFC42.DLL | 1089 | ||
| MFC42.DLL | 3922 | ||
| MFC42.DLL | 5731 | ||
| MFC42.DLL | 2512 | ||
| MFC42.DLL | 2554 | ||
| MFC42.DLL | 4486 | ||
| MFC42.DLL | 6375 | ||
| MFC42.DLL | 4274 | ||
| MFC42.DLL | 4610 | ||
| MFC42.DLL | 4612 | ||
| MFC42.DLL | 2801 | ||
| MFC42.DLL | 350 | ||
| MFC42.DLL | 6157 | ||
| MFC42.DLL | 2393 | ||
| MFC42.DLL | 3663 | ||
| MFC42.DLL | 825 | ||
| MFC42.DLL | 6571 | ||
| MFC42.DLL | 1871 | ||
| MFC42.DLL | 858 | ||
| MFC42.DLL | 823 | ||
| MFC42.DLL | 1168 | ||
| MSVCRT.dll | 202 | _except_handler3 | |
| MSVCRT.dll | 129 | __set_app_type | |
| MSVCRT.dll | 111 | __p__fmode | |
| MSVCRT.dll | 106 | __p__commode | |
| MSVCRT.dll | 157 | _adjust_fdiv | |
| MSVCRT.dll | 131 | __setusermatherr | |
| MSVCRT.dll | 271 | _initterm | |
| MSVCRT.dll | 88 | __getmainargs | |
| MSVCRT.dll | 143 | _acmdln | |
| MSVCRT.dll | 585 | exit | |
| MSVCRT.dll | 72 | _XcptFilter | |
| MSVCRT.dll | 211 | _exit | |
| MSVCRT.dll | 390 | _onexit | |
| MSVCRT.dll | 85 | __dllonexit | |
| MSVCRT.dll | 14 | public: virtual __thiscall type_info::~type_info(void) ??1type_info@@UAE@XZ | |
| MSVCRT.dll | 702 | strlen | |
| MSVCRT.dll | 73 | __CxxFrameHandler | |
| MSVCRT.dll | 183 | _controlfp | |
| MSVCRT.dll | 426 | _setmbcp | |
| MSVCRT.dll | 690 | sprintf | |
| MSVCRT.dll | 599 | fopen | |
| MSVCRT.dll | 600 | fprintf | |
| MSVCRT.dll | 588 | fclose | |
| MSVCRT.dll | 587 | fabs | |
| MSVCRT.dll | 241 | _ftol | |
| MSVCRT.dll | 663 | memcpy | |
| MSVCRT.dll | 565 | abs | |
| MSVCRT.dll | 665 | memset | |
| KERNEL32.dll | 220 | FindNextFileA | |
| KERNEL32.dll | 693 | ReadFile | |
| KERNEL32.dll | 86 | CreateFileW | |
| KERNEL32.dll | 416 | GetProcAddress | |
| KERNEL32.dll | 206 | FindClose | |
| KERNEL32.dll | 646 | OpenProcess | |
| KERNEL32.dll | 323 | GetCurrentProcessId | |
| KERNEL32.dll | 383 | GetModuleHandleA | |
| KERNEL32.dll | 439 | GetStartupInfoA | |
| KERNEL32.dll | 371 | GetLocalTime | |
| KERNEL32.dll | 83 | CreateFileA | |
| KERNEL32.dll | 932 | WriteFile | |
| KERNEL32.dll | 881 | UnmapViewOfFile | |
| KERNEL32.dll | 52 | CloseHandle | |
| KERNEL32.dll | 522 | GlobalUnlock | |
| KERNEL32.dll | 511 | GlobalFree | |
| KERNEL32.dll | 594 | LoadLibraryA | |
| KERNEL32.dll | 355 | GetFileSize | |
| USER32.dll | 700 | UpdateWindow | |
| USER32.dll | 196 | EnableWindow | |
| GDI32.dll | 143 | DeleteObject | |
| GDI32.dll | 586 | StretchDIBits | |
| GDI32.dll | 527 | SelectPalette | |
| GDI32.dll | 71 | CreatePen | |
| SHELL32.dll | 121 | SHBrowseForFolderA | |
| PSAPI.DLL | 15 | GetModuleFileNameExW |
 |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 36865 entries in directory, but got EOF on 15752-th.
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 38232
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 146494
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37188
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 46520
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37380
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37118
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37030
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36934
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36940
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37022
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37072
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37190
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36976
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36964
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36970
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36968
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37044
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36942
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36984
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36900
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36910
[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "\xA6\xDD" on UTF-16LE
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36944
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 149520
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 155664
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 161808
[?] too many errors getting resource data, stopped on 104 of 2816
[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 36865
[?] too many errors getting resource data, stopped on 13779 of 15752
[?] can't find file_offset of VA 0x0
[?] can't find file_offset of VA 0xbdfc51eb
[?] can't find file_offset of VA 0x91efe4ef
[?] can't find file_offset of VA 0x800002d8
[?] can't find file_offset of VA 0x68948458
[?] can't find file_offset of VA 0x640001
[?] can't find file_offset of VA 0x58000
[?] can't find file_offset of VA 0x800000e0
[?] can't find file_offset of VA 0x1
[?] can't find file_offset of VA 0xe148000
[?] can't find file_offset of VA 0xf1
[?] can't find file_offset of VA 0x80000188
[?] can't find file_offset of VA 0x1a00000
[?] can't find file_offset of VA 0xe
[?] can't find file_offset of VA 0x68000
[?] can't find file_offset of VA 0x0
[?] can't find file_offset of VA 0x80000068
[?] can't find file_offset of VA 0x28000
[?] can't find file_offset of VA 0x0
[?] can't find file_offset of VA 0x3
[?] can't find file_offset of VA 0x6
[?] can't find file_offset of VA 0x6292d2f2
[?] can't find file_offset of VA 0xe68c9131
[?] can't find file_offset of VA 0x99e9ab4
[?] can't find file_offset of VA 0x7d3dd317
[?] can't find file_offset of VA 0xe2003889
[?] can't find file_offset of VA 0x27064bd0
[?] can't find file_offset of VA 0x8509fc86
[?] can't find file_offset of VA 0x386c60a2
[?] can't find file_offset of VA 0xe1fe6a58
[?] can't find file_offset of VA 0x15ff4865
[?] can't find file_offset of VA 0xffd1d1d1
[?] can't find file_offset of VA 0xffffffff
[?] can't find file_offset of VA 0x474e4944
[!] refusing to read CURDIRENTRY beyond resource size