filenameSkype_Hacker_Setup.exe
size796698 (0xc281a)
md54e6a9234a0b4f4a45e94a8fc2e48e23d
typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1272912
1180478
14729920
10804773
10896615
9521902
93217919
10218
4990442
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x49006b10
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x14000
SizeOfInitializedData0x3000
SizeOfUninitializedData0x1d000
AddressOfEntryPoint0x310e0
BaseOfCode0x1e000
BaseOfData0x32000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x35000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
UPX00x10000x1d0000RWX UDATA
UPX10x1e0000x140000x13400RWX IDATA
.rsrc0x320000x30000x2e00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x34a340x20c
RESOURCE0x320000x2a34
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12960
ICON#213840
ICON#37440
ICON#422160
ICON#537520
DIALOG#112380
DIALOG#113380
DIALOG#1311220
DIALOG#132380
GROUP_ICON#800760
VERSION#18000
MANIFEST#17900
module_namehintordfunction_name
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLExitProcess
ADVAPI32.dllRegCloseKey
COMCTL32.dll17
comdlg32.dllGetOpenFileNameA
GDI32.dllBitBlt
ole32.dllCoGetMalloc
SHELL32.dllDragFinish
USER32.dllIsIconic
VERSION.dllVerFindFileA

StringTable 040904b0

Comments
CompanyName
FileDescription
FileVersion2, 0, 0, 32
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductNameSkype Hacker v2.4.6 Install Program
ProductVersion2, 0, 0, 32
SpecialBuild

VS_FIXEDFILEINFO

FileVersion2.0.0.32
ProductVersion2.0.0.32
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
091648EXE10/23/2008 12:16:16#
15c115HTM#
16600705050BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 796698 bytes (779 KiB)


--
Type = bzip2
ERRORS:
There are data after the end of archive
Offset = 92272
Physical Size = 18863
Tail Size = 685563
Streams = 1
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    .....        49800        18863  data~
------------------- ----- ------------ ------------  ------------------------
                                 49800        18863  1 files

Warnings: 1

Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK