quittung_07072014.cpl

info
MZ
PE
resources
strings
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	quittung_07072014.cpl
size	12288 (0x3000)
md5	529b8ad238e0d38126cb776918ae30a0

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
93	3077	4
15	3077	2
96	3077	3
95	3077	8
25	9210	2
93	2067	2
93	2179	3
1	0	123
100	3077	3
92	3077	1
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x53b65882
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x1200
SizeOfInitializedData	0x1a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x198a
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x7000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.1 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x116a	0x1200	R-X CODE
.rdata	0x3000	0x700	0x800	R-- IDATA
.data	0x4000	0x1f4	0x200	RW- IDATA
.rsrc	0x5000	0x720	0x800	R-- IDATA
.reloc	0x6000	0x6de	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x35c0	0x140
IMPORT	0x31cc	0x78
RESOURCE	0x5000	0x720
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x6000	0x264
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x3148	0x48
Bound_IAT	0	0
IAT	0x3000	0x94
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
PNG	#102	592	0
STRING	#7	1052	0

id	lang	string
103	1049	Ddh_3Pg47R1xRHsFPzGSFwckHrmKDGN9GsOK1ABQWVWiRzu9aNtbxN93gkFnCsV8kKeVhnZoTcj1zvDfWHFrO6nPtLAAA7UYCIJrJBLlsZhBCCB17QCRRqZnnwohzH7FKdduLEq9w7cJdL4HnxxN7IgG6S3hqtq0wmnG2aJ14ERo_HTk2npxXxM6y744NseLkAFBkauJWSxyjmY_vGrstVBtbW_gZzKckOnVWLVLgRUBD2yeuUU0hXQlWaEXMt2
104	1049	Svl6rTYfSs6a63sjbIM80aUGj1riIZcMGkNS87q6s9iTvCxAGHdyZgevEBE3ifxksw_YHotxx7F7MxRwHEaCNinSF3TLAeUlPnBJgvRaE4uY7wVixd973Zu_UNeos_u5L1ngqv4oajjntTsJE0tDZFW7xfxyC7ifuFccTU77JgKyfp5ugCeO8C5RlWQKxKzKyeBWYaPtszufqv_Y1zRp6qE6c6gUK5NlKG2lGOWBGteDPCJZnxNCPSSg2kjoBUs

module_name	hint	function_name
KERNEL32.dll	239	FreeLibrary
KERNEL32.dll	839	Sleep
KERNEL32.dll	408	GetProcAddress
KERNEL32.dll	584	LoadLibraryA
KERNEL32.dll	315	GetCurrentProcessId
KERNEL32.dll	318	GetCurrentThreadId
KERNEL32.dll	469	GetTickCount
KERNEL32.dll	663	QueryPerformanceCounter
KERNEL32.dll	175	ExitProcess
KERNEL32.dll	448	GetSystemTimeAsFileTime
USER32.dll	445	LoadIconA
USER32.dll	458	LoadStringA
SHELL32.dll	262	ShellExecuteA
MSVCR71.dll	453	_purecall
MSVCR71.dll	241	_except_handler3
MSVCR71.dll	76	__CppXcptFilter
MSVCR71.dll	187	_adjust_fdiv
MSVCR71.dll	735	malloc
MSVCR71.dll	319	_initterm
MSVCR71.dll	684	free
MSVCR71.dll	440	_onexit
MSVCR71.dll	107	__dllonexit
MSVCR71.dll	17	void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
MSVCR71.dll	798	time
MSVCR71.dll	770	srand
MSVCR71.dll	756	rand
MSVCR71.dll	81	__CxxFrameHandler
MSVCR71.dll	155	__security_error_handler
MSVCR71.dll	18	void __cdecl operator delete(void *) ??3@YAXPAX@Z
MSVCP71.dll	349	public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(void) ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
MSVCP71.dll	1324	public: class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > & __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::append(char const *) ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
MSVCP71.dll	543	public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::~basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(void) ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

ord	entry_va	function_name
1	0x1020	CPlApplet

module_name	80FLmtS2s6TUZEhdiI7b0LDYqO1d0NlmVW2DFHmfyQzZOqv9hwKRe4TbWvH9g4sFF10ywiXbjHiTzaRVS_qC6FvPuKGe8VPQ1XuLCn_pZmias6ZoUZ_eOWQG9xCn0_lMLCdymCe_yx6hvyswfFLz9kscYj_gYBQtcsT_bJbNF8FyKK84T3gVYzH5ieZdC4g48RFmGTRn4jAK1FwUnPIrVt_YiDpzmJoyQOou2obkonY892PhP1Xat7AluC5zLli.cpl
flags	0
timestamp	2014-07-04 07:32:16
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x35ec
Functions(1)	0x35e8
NameOrdinals(1)	0x35f0

show previews

offset	size	type	comment
0	12288	DLL	07/04/2014 07:32:18	#
15c1	15	HTM		#
20b0	592	PNG	(16 x 16)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK