filename0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330
size790528 (0xc1000)
md546e96df14e74915e86a22516d4c111be
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Dropper.Icedid-6497591-0 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4513062c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x33000
SizeOfInitializedData0xa2000
SizeOfUninitializedData0
AddressOfEntryPoint0x1dc10
BaseOfCode0x1000
BaseOfData0x34000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xd6000
SizeOfHeaders0x1000
CheckSum0xc1477
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x32fb40x33000R-X CODE
.rdata0x340000x95f20xa000R-- IDATA
.data0x3e0000x186400x4000RW- IDATA
.rsrc0x570000x7ed680x7f000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x3c0c40xdc
RESOURCE0x570000x7ed68
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x344a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x391700x40
Bound_IAT00
IAT0x340000x3e8
Delay_IAT00
CLR_Header00
typenamesizecp
BASI#68207520
ENT#67415020
GLAS#70207540
SWIM#69207520
WAVE#66415020
ICON#12703760
ICON#2676240
ICON#3169360
ICON#496400
ICON#542640
ICON#624400
ICON#711280
GROUP_ICON#11040
VERSION#18160
module_namehintordfunction_name
KERNEL32.dll181DeleteCriticalSection
KERNEL32.dll956TlsFree
KERNEL32.dll457GetModuleHandleA
KERNEL32.dll595InterlockedDecrement
KERNEL32.dll327FreeLibrary
KERNEL32.dll580InterlockedIncrement
KERNEL32.dll355GetCurrentThreadId
KERNEL32.dll562GlobalFlags
KERNEL32.dll559GlobalGetAtomNameA
KERNEL32.dll544GetThreadLocale
KERNEL32.dll522GetVersionExA
KERNEL32.dll996lstrcmpW
KERNEL32.dll543GlobalDeleteAtom
KERNEL32.dll515GlobalFindAtomA
KERNEL32.dll514GlobalAddAtomA
KERNEL32.dll430GetLocaleInfoA
KERNEL32.dll327GetCPInfo
KERNEL32.dll491GetOEMCP
KERNEL32.dll665LocalReAlloc
KERNEL32.dll766ReadFile
KERNEL32.dll984WriteFile
KERNEL32.dll805SetFilePointer
KERNEL32.dll333FlushFileBuffers
KERNEL32.dll395GetCurrentProcess
KERNEL32.dll126CreateFileA
KERNEL32.dll590HeapFree
KERNEL32.dll539HeapReAlloc
KERNEL32.dll691RaiseException
KERNEL32.dll898VirtualAlloc
KERNEL32.dll781RtlUnwind
KERNEL32.dll890TerminateProcess
KERNEL32.dll952UnhandledExceptionFilter
KERNEL32.dll914SetUnhandledExceptionFilter
KERNEL32.dll661IsDebuggerPresent
KERNEL32.dll337GetCommandLineA
KERNEL32.dll513GetStartupInfoA
KERNEL32.dll569HeapSize
KERNEL32.dll975VirtualFree
KERNEL32.dll621HeapDestroy
KERNEL32.dll591HeapCreate
KERNEL32.dll293FreeEnvironmentStringsA
KERNEL32.dll388GetEnvironmentStrings
KERNEL32.dll265FreeEnvironmentStringsW
KERNEL32.dll346GetEnvironmentStringsW
KERNEL32.dll882SetHandleCount
KERNEL32.dll393GetFileType
KERNEL32.dll732QueryPerformanceCounter
KERNEL32.dll522GetTickCount
KERNEL32.dll548GetSystemTimeAsFileTime
KERNEL32.dll348GetACP
KERNEL32.dll306GetConsoleCP
KERNEL32.dll389GetConsoleMode
KERNEL32.dll514GetUserDefaultLCID
KERNEL32.dll253EnumSystemLocalesA
KERNEL32.dll673IsValidLocale
KERNEL32.dll669IsValidCodePage
KERNEL32.dll541GetStringTypeA
KERNEL32.dll534GetStringTypeW
KERNEL32.dll625LCMapStringA
KERNEL32.dll601LCMapStringW
KERNEL32.dll436GetLocaleInfoW
KERNEL32.dll908SetStdHandle
KERNEL32.dll357GetConsoleOutputCP
KERNEL32.dll990WriteConsoleW
KERNEL32.dll886TlsSetValue
KERNEL32.dll942TlsAlloc
KERNEL32.dll589GlobalHandle
KERNEL32.dll606GlobalReAlloc
KERNEL32.dll884TlsGetValue
KERNEL32.dll651LeaveCriticalSection
KERNEL32.dll644LocalAlloc
KERNEL32.dll357GetCurrentProcessId
KERNEL32.dll473GetModuleFileNameA
KERNEL32.dll581GlobalFree
KERNEL32.dll525GlobalAlloc
KERNEL32.dll550GlobalLock
KERNEL32.dll590GlobalUnlock
KERNEL32.dll327FormatMessageA
KERNEL32.dll625LocalFree
KERNEL32.dll231FindResourceA
KERNEL32.dll679LoadResource
KERNEL32.dll620LockResource
KERNEL32.dll875SizeofResource
KERNEL32.dll856SetLastError
KERNEL32.dll248FindFirstChangeNotificationA
KERNEL32.dll109CloseHandle
KERNEL32.dll1032lstrlenA
KERNEL32.dll97CompareStringA
KERNEL32.dll452GetProcessHeap
KERNEL32.dll560HeapAlloc
KERNEL32.dll477GetSystemDirectoryA
KERNEL32.dll277ExitProcess
KERNEL32.dll528GetStdHandle
KERNEL32.dll985WriteConsoleA
KERNEL32.dll940WaitForSingleObject
KERNEL32.dll478GetProcAddress
KERNEL32.dll605LoadLibraryA
KERNEL32.dll930Sleep
KERNEL32.dll159EnterCriticalSection
KERNEL32.dll645InitializeCriticalSection
KERNEL32.dll986lstrcmpA
KERNEL32.dll517GetVersion
KERNEL32.dll406GetLastError
KERNEL32.dll988WideCharToMultiByte
KERNEL32.dll638MultiByteToWideChar
KERNEL32.dll633InterlockedExchange
USER32.dll802TabbedTextOutA
USER32.dll227DrawTextA
USER32.dll265DrawTextExA
USER32.dll450GrayStringA
USER32.dll584PostQuitMessage
USER32.dll640RegisterWindowMessageA
USER32.dll586LoadIconA
USER32.dll894WinHelpA
USER32.dll283GetCapture
USER32.dll336GetClassLongA
USER32.dll703SetPropA
USER32.dll415GetPropA
USER32.dll710RemovePropA
USER32.dll491IsWindow
USER32.dll344GetDlgItem
USER32.dll484GetTopWindow
USER32.dll217DestroyWindow
USER32.dll401GetMessageTime
USER32.dll548MapWindowPoints
USER32.dll715SetForegroundWindow
USER32.dll424GetMenu
USER32.dll597PostMessageA
USER32.dll148CreateWindowExA
USER32.dll345GetClassInfoExA
USER32.dll311GetClassInfoA
USER32.dll669RegisterClassA
USER32.dll56AdjustWindowRectEx
USER32.dll127CopyRect
USER32.dll194DefWindowProcA
USER32.dll116CallWindowProcA
USER32.dll789SetWindowLongA
USER32.dll800SystemParametersInfoA
USER32.dll469IsIconic
USER32.dll434GetWindowPlacement
USER32.dll337GetMenuCheckMarkDimensions
USER32.dll512LoadBitmapA
USER32.dll617ModifyMenuA
USER32.dll243EnableMenuItem
USER32.dll101CheckMenuItem
USER32.dll334GetFocus
USER32.dll100ClientToScreen
USER32.dll389GetDlgCtrlID
USER32.dll587PtInRect
USER32.dll775SetWindowTextA
USER32.dll805UnregisterClassA
USER32.dll764SetWindowsHookExA
USER32.dll34CallNextHookEx
USER32.dll201DispatchMessageA
USER32.dll408GetKeyState
USER32.dll654PeekMessageA
USER32.dll832ValidateRect
USER32.dll507LoadCursorA
USER32.dll478GetSystemMetrics
USER32.dll646ReleaseDC
USER32.dll413GetSysColor
USER32.dll437InflateRect
USER32.dll723SetParent
USER32.dll327ExitWindowsEx
USER32.dll535IntersectRect
USER32.dll418GetSysColorBrush
USER32.dll815UnhookWindowsHookEx
USER32.dll287GetClientRect
USER32.dll466GetWindowThreadProcessId
USER32.dll104CreateDialogIndirectParamA
USER32.dll343GetForegroundWindow
USER32.dll166CreatePopupMenu
USER32.dll230DialogBoxIndirectParamA
USER32.dll446GetWindowRect
USER32.dll335FindWindowA
USER32.dll436GetWindowTextA
USER32.dll785SetWindowPos
USER32.dll314EnumChildWindows
USER32.dll340GetDC
USER32.dll336GetClassNameA
USER32.dll847UpdateWindow
USER32.dll419GetMessagePos
USER32.dll200DestroyMenu
USER32.dll700SendMessageA
USER32.dll373GetParent
USER32.dll421GetWindowLongA
USER32.dll329GetLastActivePopup
USER32.dll541IsWindowEnabled
USER32.dll292EnableWindow
USER32.dll526MessageBoxA
USER32.dll363GetMenuState
USER32.dll381GetMenuItemID
USER32.dll421GetMenuItemCount
USER32.dll384GetSubMenu
USER32.dll723SetMenuItemBitmaps
USER32.dll407GetWindow
GDI32.dll560GetStockObject
GDI32.dll280DeleteObject
GDI32.dll130CreateBitmap
GDI32.dll537GetClipBox
GDI32.dll766SetTextColor
GDI32.dll646SetBkColor
GDI32.dll322ExtTextOutA
GDI32.dll642SaveDC
GDI32.dll753SetMapMode
GDI32.dll773SetViewportOrgEx
GDI32.dll724TextOutA
GDI32.dll648RectVisible
GDI32.dll245DeleteDC
GDI32.dll666ScaleWindowExtEx
GDI32.dll747SetWindowExtEx
GDI32.dll687ScaleViewportExtEx
GDI32.dll700SetViewportExtEx
GDI32.dll635OffsetViewportOrgEx
GDI32.dll729SelectObject
GDI32.dll337Escape
GDI32.dll647PtVisible
GDI32.dll711RestoreDC
GDI32.dll488GetDeviceCaps
COMCTL32.dll225PropertySheetA
COMCTL32.dll16CreatePropertySheetPageA
COMCTL32.dll6
ole32.dll344OleInitialize
ole32.dll402OleSetContainedObject
ole32.dll387OleUninitialize
SHLWAPI.dll243SHRegCloseUSKey
SHLWAPI.dll311SHRegCreateUSKeyA
SHLWAPI.dll408StrToIntA
SHLWAPI.dll281SHRegWriteUSValueA
ADVAPI32.dll709RegQueryValueExA
ADVAPI32.dll562RegCloseKey
ADVAPI32.dll586RegCreateKeyA
OLEAUT32.dll9
OLEAUT32.dll12
OLEAUT32.dll8
WINSPOOL.DRV158DocumentPropertiesA
WINSPOOL.DRV194OpenPrinterA
WINSPOOL.DRV79ClosePrinter
OLEACC.dll55LresultFromObject
OLEACC.dll58CreateStdAccessibleObject

StringTable 040904B0

Comments
CompanyNameVinSolutions Syllable
FileDescriptionTrack Weather
FileVersion0, 6, 4339, 2565
InternalNameTrack Weather
LegalCopyrightCopyright, 2007-2012 VinSolutions Syllable. All rights reserved.
OriginalFilenameBasegreen.exe
ProductNameTrack Weather

VS_FIXEDFILEINFO

FileVersion0.6.4339.2565
ProductVersion0.6.4339.2565
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0790528EXE09/21/2006 21:37:48#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK