4ae64579fa0efd0be978c6797efe05d31517985b28ebd95dcadfacf3bb551f56 - pattern.exe

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	4ae64579fa0efd0be978c6797efe05d31517985b28ebd95dcadfacf3bb551f56
size	290818 (0x47002)
md5	50b965686ad2cbdc0066e870a928177e

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: ba d7 38 81 fe b6 56 d2  fe b6 56 d2 fe b6 56 d2  |..8...V...V...V.|
00000050: 43 f9 c0 d2 fb b6 56 d2  e0 e4 d2 d2 f6 b6 56 d2  |C.....V.......V.|
00000060: e0 e4 c3 d2 eb b6 56 d2  f7 ce d5 d2 90 b6 56 d2  |......V.......V.|
00000070: e0 e4 d5 d2 fb b6 56 d2  d9 70 3b d2 fd b6 56 d2  |......V..p;...V.|
00000080: d9 70 2d d2 f3 b6 56 d2  fe b6 57 d2 22 b6 56 d2  |.p-...V...W.".V.|
00000090: f7 ce d2 d2 c8 b6 56 d2  e0 e4 c2 d2 ff b6 56 d2  |......V.......V.|
000000a0: f7 ce c7 d2 ff b6 56 d2  52 69 63 68 fe b6 56 d2  |......V.Rich..V.|
000000b0: 52 69 63 68 57 58 ed a4  00 00 00 00 00 00 00 00  |RichWX..........|
000000c0: 00 00 00 00 00 00 00 00                           |........        |

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x5636341c
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10e
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x2000
SizeOfInitializedData	0xb000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2b74
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x722000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1ffe	0x2000	R-X CODE
.rdata	0x3000	0xb00	0x1000	R-- SHARED
.data	0x4000	0x715380	0x2000	RW- IDATA
.idata	0x71a000	0xf6a	0x1000	RW- IDATA
.rsrc	0x71b000	0x2f38	0x3000	R-- IDATA
reloc	0x71e000	0x32e8	0x4000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x71a000	0xb4
RESOURCE	0x71b000	0x2f38
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x71e000	0x6a0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x71a4b0	0x24fc
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	28840	1252
MENU	#130	98	1252
DIALOG	#100	266	1252
DIALOG	#102	532	1252
DIALOG	#129	280	1252
GROUP_ICON	#3	20	1252
VERSION	#1	776	1252

module_name	hint	ord	function_name
MFC42.DLL		4234
MFC42.DLL		4673
MFC42.DLL		4274
MFC42.DLL		6375
MFC42.DLL		4486
MFC42.DLL		2554
MFC42.DLL		2512
MFC42.DLL		5731
MFC42.DLL		3922
MFC42.DLL		1089
MFC42.DLL		5199
MFC42.DLL		2396
MFC42.DLL		3346
MFC42.DLL		5300
MFC42.DLL		5302
MFC42.DLL		4079
MFC42.DLL		4698
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		5714
MFC42.DLL		4622
MFC42.DLL		4424
MFC42.DLL		3738
MFC42.DLL		561
MFC42.DLL		815
MFC42.DLL		617
MFC42.DLL		2621
MFC42.DLL		5214
MFC42.DLL		296
MFC42.DLL		1134
MFC42.DLL		656
MFC42.DLL		609
MFC42.DLL		2725
MFC42.DLL		1168
MFC42.DLL		3610
MFC42.DLL		2575
MFC42.DLL		6055
MFC42.DLL		1776
MFC42.DLL		4396
MFC42.DLL		5290
MFC42.DLL		3402
MFC42.DLL		3574
MFC42.DLL		1146
MFC42.DLL		567
MFC42.DLL		2302
MFC42.DLL		537
MFC42.DLL		665
MFC42.DLL		2863
MFC42.DLL		354
MFC42.DLL		2379
MFC42.DLL		755
MFC42.DLL		470
MFC42.DLL		858
MFC42.DLL		4278
MFC42.DLL		6877
MFC42.DLL		922
MFC42.DLL		2859
MFC42.DLL		823
MFC42.DLL		1945
MFC42.DLL		4589
MFC42.DLL		4588
MFC42.DLL		4899
MFC42.DLL		4370
MFC42.DLL		4892
MFC42.DLL		5076
MFC42.DLL		4341
MFC42.DLL		4349
MFC42.DLL		4723
MFC42.DLL		4890
MFC42.DLL		4531
MFC42.DLL		4545
MFC42.DLL		4543
MFC42.DLL		4526
MFC42.DLL		4529
MFC42.DLL		4524
MFC42.DLL		4964
MFC42.DLL		4961
MFC42.DLL		4108
MFC42.DLL		5240
MFC42.DLL		3748
MFC42.DLL		1726
MFC42.DLL		5260
MFC42.DLL		4432
MFC42.DLL		813
MFC42.DLL		2623
MFC42.DLL		560
MFC42.DLL		4273
MFC42.DLL		2486
MFC42.DLL		4003
MFC42.DLL		4275
MFC42.DLL		825
MFC42.DLL		324
MFC42.DLL		540
MFC42.DLL		641
MFC42.DLL		800
MFC42.DLL		3597
MFC42.DLL		4425
MFC42.DLL		4627
MFC42.DLL		4080
MFC42.DLL		3079
MFC42.DLL		3825
MFC42.DLL		3831
MFC42.DLL		3830
MFC42.DLL		2976
MFC42.DLL		3081
MFC42.DLL		2985
MFC42.DLL		3262
MFC42.DLL		3136
MFC42.DLL		4465
MFC42.DLL		3259
MFC42.DLL		3147
MFC42.DLL		2982
MFC42.DLL		5277
MFC42.DLL		2124
MFC42.DLL		2446
MFC42.DLL		5261
MFC42.DLL		1727
MFC42.DLL		5065
MFC42.DLL		3749
MFC42.DLL		6376
MFC42.DLL		2055
MFC42.DLL		2648
MFC42.DLL		4441
MFC42.DLL		4837
MFC42.DLL		3798
MFC42.DLL		5280
MFC42.DLL		4353
MFC42.DLL		6374
MFC42.DLL		5163
MFC42.DLL		2385
MFC42.DLL		5241
MFC42.DLL		4407
MFC42.DLL		1775
MFC42.DLL		4078
MFC42.DLL		6052
MFC42.DLL		2514
MFC42.DLL		4710
MFC42.DLL		4998
MFC42.DLL		4853
MFC42.DLL		4376
MFC42.DLL		4160
MFC42.DLL		5265
MFC42.DLL		1576
MSVCRT.dll	183		_controlfp
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	662		memcmp
MSVCRT.dll	663		memcpy
MSVCRT.dll	712		strtol
MSVCRT.dll	211		_exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	585		exit
MSVCRT.dll	143		_acmdln
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	271		_initterm
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	390		_onexit
KERNEL32.dll	129		DeleteCriticalSection
KERNEL32.dll	532		HeapDestroy
KERNEL32.dll	547		InitializeCriticalSection
KERNEL32.dll	326		GetCurrentThreadId
KERNEL32.dll	272		GetCommandLineA
KERNEL32.dll	963		lstrcmpiA
KERNEL32.dll	382		GetModuleFileNameW
KERNEL32.dll	973		lstrlenW
KERNEL32.dll	345		GetEnvironmentVariableW
KERNEL32.dll	899		VirtualFree
KERNEL32.dll	530		HeapCreate
KERNEL32.dll	499		GetWindowsDirectoryA
KERNEL32.dll	328		GetDateFormatW
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	629		MultiByteToWideChar
KERNEL32.dll	972		lstrlenA
KERNEL32.dll	437		GetShortPathNameA
KERNEL32.dll	383		GetModuleHandleA
KERNEL32.dll	381		GetModuleFileNameA
KERNEL32.dll	248		FreeLibrary
KERNEL32.dll	416		GetProcAddress
KERNEL32.dll	594		LoadLibraryA
KERNEL32.dll	966		lstrcpyA
KERNEL32.dll	957		lstrcatA
KERNEL32.dll	916		WideCharToMultiByte
KERNEL32.dll	83		CreateFileA
KERNEL32.dll	260		GetCPInfo
KERNEL32.dll	247		FreeEnvironmentStringsW
KERNEL32.dll	80		CreateEventW
KERNEL32.dll	358		GetFileType
KERNEL32.dll	458		GetSystemTimeAsFileTime
KERNEL32.dll	86		CreateFileW
KERNEL32.dll	581		LCMapStringW
KERNEL32.dll	321		GetCurrentDirectoryW
USER32.dll	182		DrawIcon
USER32.dll	371		GetWindowPlacement
USER32.dll	270		GetDesktopWindow
USER32.dll	622		SetScrollInfo
USER32.dll	513		PeekMessageW
USER32.dll	641		SetWindowLongW
USER32.dll	348		GetSystemMenu
USER32.dll	8		AppendMenuA
USER32.dll	446		LoadIconA
USER32.dll	42		CharNextA
USER32.dll	145		DeleteMenu
USER32.dll	537		RegisterClassW
USER32.dll	700		UpdateWindow
USER32.dll	654		ShowCursor
USER32.dll	377		GetWindowTextLengthW
USER32.dll	653		ShowCaret
USER32.dll	230		FindWindowW
USER32.dll	539		RegisterClipboardFormatW
USER32.dll	196		EnableWindow
USER32.dll	268		GetDC
USER32.dll	554		ReleaseDC
USER32.dll	422		IsIconic
USER32.dll	349		GetSystemMetrics
USER32.dll	571		SendMessageA
USER32.dll	255		GetClientRect
GDI32.dll	477		PatBlt
GDI32.dll	80		CreateSolidBrush
GDI32.dll	526		SelectObject
GDI32.dll	502		Rectangle
GDI32.dll	143		DeleteObject
GDI32.dll	534		SetBkMode
GDI32.dll	342		GetCharWidth32A
GDI32.dll	363		GetDeviceCaps
GDI32.dll	62		CreateFontW
GDI32.dll	349		GetCharWidthW
GDI32.dll	58		CreateFontIndirectA
GDI32.dll	222		ExtTextOutW
GDI32.dll	412		GetPixel
ADVAPI32.dll	459		RegCloseKey
ADVAPI32.dll	477		RegEnumKeyA
ADVAPI32.dll	292		GetUserNameA
ole32.dll	92		CoRevokeClassObject
ole32.dll	80		CoRegisterClassObject
ole32.dll	59		CoInitialize
ole32.dll	105		CoUninitialize
ole32.dll	16		CoCreateInstance
OLEAUT32.dll		2
OLEAUT32.dll		161
OLEAUT32.dll		163
OLEAUT32.dll		6

StringTable 040f04b0

Comments
CompanyName
FileDescription	pattern
FileVersion	1, 0, 0, 1
InternalName	pattern
LegalCopyright	(C) 2011
LegalTrademarks
OriginalFilename	pattern.exe
PrivateBuild
ProductName	pattern
ProductVersion	1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	57344	EXE	11/01/2015 15:47:40	#
15c1	15	HTM		#
e000	233474	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 290818 bytes (285 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] non-zero dos stub after rich_hdr: "RichWX\xED\xA4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

[?] can't find file_offset of VA 0x9071a430

4ae64579fa0efd0be978c6797efe05d31517985b28ebd95dcadfacf3bb551f56- pattern.exe - pattern