a.vir

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	a.vir
size	3724288 (0x38d400)
md5	473959408997c48101a78824a8c4726c

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x532864ca
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x386000
SizeOfInitializedData	0x8000
SizeOfUninitializedData	0x518000
AddressOfEntryPoint	0x89e5e0
BaseOfCode	0x519000
BaseOfData	0x89f000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x8a7000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x518000	0	RWX UDATA
UPX1	0x519000	0x386000	0x385800	RWX IDATA
.rsrc	0x89f000	0x8000	0x7800	RW- IDATA

Data Directory

type	va	size
EXPORT	0x113000	0xa3
IMPORT	0x8a632c	0x2f0
RESOURCE	0x89f000	0x732c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x89e790	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0xc9e7a8	0xc9e7e0	0x4ff798	0	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	PREVIEWGLYPH	232
ICON	#1	16936
ICON	#2	4264
ICON	#3	2440
ICON	#4	1128
DIALOG	DLGTEMPLATE	82
DIALOG	TEXTFILEDLG	82
STRING	#4068	1352
STRING	#4069	2164
STRING	#4070	856
STRING	#4071	1084
STRING	#4072	564
STRING	#4073	1116
STRING	#4074	948
STRING	#4075	800
STRING	#4076	828
STRING	#4077	1156
STRING	#4078	880
STRING	#4079	912
STRING	#4080	636
STRING	#4081	1348
STRING	#4082	952
STRING	#4083	216
STRING	#4084	216
STRING	#4085	552
STRING	#4086	832
STRING	#4087	984
STRING	#4088	908
STRING	#4089	896
STRING	#4090	1016
STRING	#4091	280
STRING	#4092	204
STRING	#4093	520
STRING	#4094	920
STRING	#4095	876
STRING	#4096	676
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	2004
RCDATA	TFBBLIE	443852
RCDATA	TFCEF	1282209
RCDATA	TFITAJLIE	835058
RCDATA	TFITALIE	1184249
RCDATA	TFITAUNILIE	1270382
RCDATA	TFSNTJLIE	797012
RCDATA	TFSNTLIE	670430
RCDATA	TFSOBRE	725
RCDATA	TFUPITAP	1266520
RCDATA	T_	1696
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	CHROME	62
MANIFEST	#1	408

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			ExitProcess
advapi32.dll			RegFlushKey
comctl32.dll			ImageList_Add
gdi32.dll			SaveDC
ole32.dll			IsEqualGUID
oleaut32.dll			VariantCopy
quartz.dll			AMGetErrorTextA
shell32.dll			ShellExecuteA
user32.dll			GetDC
version.dll			VerQueryValueA
winmm.dll			timeGetTime
wsock32.dll			send

show previews

offset	size	type	comment
0	3724288	EXE	03/18/2014 15:22:50	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x12707c

[?] can't find file_offset of VA 0x1271b0

[?] can't find file_offset of VA 0x1272e4

[?] can't find file_offset of VA 0x127418

[?] can't find file_offset of VA 0x12754c

[?] can't find file_offset of VA 0x127680

[?] can't find file_offset of VA 0x1277b4

[?] can't find file_offset of VA 0x1278e8

[?] can't find file_offset of VA 0x127ab8

[?] can't find file_offset of VA 0x127c9c

[?] can't find file_offset of VA 0x127e6c

[?] can't find file_offset of VA 0x12803c

[?] can't find file_offset of VA 0x12820c

[?] can't find file_offset of VA 0x1283dc

[?] can't find file_offset of VA 0x1285ac

[?] can't find file_offset of VA 0x12877c

[?] can't find file_offset of VA 0x12894c

[?] can't find file_offset of VA 0x128b1c

[?] can't find file_offset of VA 0x12ecc4

[?] can't find file_offset of VA 0x12ed18

[?] can't find file_offset of VA 0x12ed6c

[?] can't find file_offset of VA 0x12f2b4

[?] can't find file_offset of VA 0x12fb28

[?] can't find file_offset of VA 0x12fe80

[?] can't find file_offset of VA 0x1302bc

[?] can't find file_offset of VA 0x1304f0

[?] can't find file_offset of VA 0x13094c

[?] can't find file_offset of VA 0x130d00

[?] can't find file_offset of VA 0x131020

[?] can't find file_offset of VA 0x13135c

[?] can't find file_offset of VA 0x1317e0

[?] can't find file_offset of VA 0x131b50

[?] can't find file_offset of VA 0x131ee0

[?] can't find file_offset of VA 0x13215c

[?] can't find file_offset of VA 0x1326a0

[?] can't find file_offset of VA 0x132a58

[?] can't find file_offset of VA 0x132b30

[?] can't find file_offset of VA 0x132c08

[?] can't find file_offset of VA 0x132e30

[?] can't find file_offset of VA 0x133170

[?] can't find file_offset of VA 0x133548

[?] can't find file_offset of VA 0x1338d4

[?] can't find file_offset of VA 0x133c54

[?] can't find file_offset of VA 0x13404c

[?] can't find file_offset of VA 0x134164

[?] can't find file_offset of VA 0x134230

[?] can't find file_offset of VA 0x134438

[?] can't find file_offset of VA 0x1347d0

[?] can't find file_offset of VA 0x134b3c

[?] can't find file_offset of VA 0x134de0

[?] can't find file_offset of VA 0x134df0

[?] can't find file_offset of VA 0x1355c4

[?] can't find file_offset of VA 0x1a1b90

[?] can't find file_offset of VA 0x2dac34

[?] can't find file_offset of VA 0x3a6a28

[?] can't find file_offset of VA 0x4c7c24

[!] refusing to read CURDIRENTRY beyond resource size

[?] can't find file_offset of VA 0xff798

[?] can't find file_offset of VA 0x113000