filename1.ex#
size19456 (0x4c00)
md54e56d91129e726c15ae7d00a8952f6b5
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
9321798
1472991
10804711
480473
1077
1197829
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x501793c0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x2a00
SizeOfInitializedData0x1e00
SizeOfUninitializedData0
AddressOfEntryPoint0x3780
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x7000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x29850x2a00R-X CODE
.rdata0x40000x75a0x800R-- IDATA
.data0x50000xf000x1000RW- IDATA
.rsrc0x60000x4480x600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x41a80x78
RESOURCE0x60000x448
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x13c
Delay_IAT00
CLR_Header00
typenamesizecp
STRING#1640
VERSION#18720
idlangstring
11033kZh~@XiA@#@ASy/H
module_namehintordfunction_name
MSVCRT.dll183_controlfp
MSVCRT.dll202_except_handler3
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll573atoi
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll143_acmdln
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll695strchr
MSVCRT.dll535_write
MSVCRT.dll391_open
MSVCRT.dll220_filelength
MSVCRT.dll324_lseek
MSVCRT.dll408_read
MSVCRT.dll179_close
MSVCRT.dll704strncmp
MSVCRT.dll657malloc
MSVCRT.dll606free
MSVCRT.dll449_stricmp
MSVCRT.dll693sscanf
MSVCRT.dll690sprintf
KERNEL32.dll441GetSystemDirectoryA
KERNEL32.dll429GetShortPathNameA
KERNEL32.dll336GetEnvironmentVariableA
KERNEL32.dll953lstrcpyA
KERNEL32.dll944lstrcatA
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll806SetPriorityClass
KERNEL32.dll317GetCurrentThread
KERNEL32.dll824SetThreadPriority
KERNEL32.dll808SetProcessPriorityBoost
KERNEL32.dll959lstrlenA
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll584LoadLibraryA
KERNEL32.dll239FreeLibrary
KERNEL32.dll643OutputDebugStringA
KERNEL32.dll919WriteFile
KERNEL32.dll95CreatePipe
KERNEL32.dll361GetLastError
KERNEL32.dll46CloseHandle
KERNEL32.dll312GetCurrentDirectoryA
KERNEL32.dll647PeekNamedPipe
KERNEL32.dll683ReadFile
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll408GetProcAddress
KERNEL32.dll96CreateProcessA
KERNEL32.dll105CreateThread
KERNEL32.dll901WaitForSingleObject
KERNEL32.dll339GetExitCodeThread
KERNEL32.dll850TerminateThread
KERNEL32.dll841Sleep
USER32.dll458LoadStringA
WS2_32.dll4
WS2_32.dll21
WS2_32.dll23
WS2_32.dll22
WS2_32.dll9
WS2_32.dll11
WS2_32.dll16
WS2_32.dll19
WS2_32.dll3
WS2_32.dll116
WS2_32.dll115
SHELL32.dll126SHChangeNotify
SHELL32.dll265ShellExecuteExA

StringTable 040904b0

Comments
CompanyNameMicroSoft Corporation
FileDescriptionActiveX
FileVersion1, 0, 0, 1
InternalNameActiveX
LegalCopyrightCopyright ? 2008
LegalTrademarks
OriginalFilenameActiveX.exe
PrivateBuild
ProductNameMicroSoft Corporation ActiveX
ProductVersion1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
019456EXE07/31/2012 08:13:52#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK