ADP_Reference_09172013.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	ADP_Reference_09172013.exe
size	20480 (0x5000)
md5	47db7adff2526b3494e61300b5ad504b

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
1	0	32
147	30729	7
171	30319	6
154	30319	1
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x5238645a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x1000
SizeOfInitializedData	0x3c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1b30
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0x1173f
Subsystem	2
DllCharacteristics	0x8540
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xff4	0x1000	RWX CODE
.rdata	0x2000	0x462	0x600	R-- IDATA
.rsrc	0x3000	0x334c	0x3400	R-- IDATA
.reloc	0x7000	0xf6	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x212c	0x50
RESOURCE	0x3000	0x334c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x7000	0xcc
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2000	0x8c
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
PNG	#106	2415	1252
ICON	#1	10036	1252
GROUP_ICON	#122	20	1252
MANIFEST	#1	346	1252

module_name	hint	function_name
gdiplus.dll	54	GdipCloneImage
gdiplus.dll	629	GdiplusStartup
gdiplus.dll	91	GdipCreateFromHDC
gdiplus.dll	42	GdipBitmapGetPixel
gdiplus.dll	82	GdipCreateBitmapFromStreamICM
gdiplus.dll	81	GdipCreateBitmapFromStream
gdiplus.dll	290	GdipGetImageHeight
gdiplus.dll	300	GdipGetImageWidth
gdiplus.dll	152	GdipDisposeImage
gdiplus.dll	144	GdipDeleteGraphics
gdiplus.dll	237	GdipFree
gdiplus.dll	33	GdipAlloc
KERNEL32.dll	828	LoadLibraryA
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	1343	lstrcatW
KERNEL32.dll	906	OutputDebugStringW
KERNEL32.dll	831	LoadLibraryW
KERNEL32.dll	448	GetCurrentProcess
KERNEL32.dll	334	FindResourceW
KERNEL32.dll	833	LoadResource
KERNEL32.dll	1201	SizeofResource
KERNEL32.dll	852	LockResource
KERNEL32.dll	1257	VirtualAlloc
KERNEL32.dll	1260	VirtualFree
KERNEL32.dll	354	FreeLibrary
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	586	GetProcessHeap
USER32.dll	613	ReleaseDC
USER32.dll	14	BeginPaint
USER32.dll	291	GetDesktopWindow
USER32.dll	220	EndPaint
USER32.dll	821	wvsprintfW

show previews

offset	size	type	comment
0	20480	EXE	09/17/2013 14:16:58	#
15c1	15	HTM		#
1b38	2415	PNG	(34 x 34)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK