PDFShrink.exe - PDF Shrink

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	PDFShrink.exe
size	2531840 (0x26a200)
md5	531538d3ef32ab10e8c2a70295701774

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
126	50327	10
125	50727	64
95	4035	4
93	4035	23
1	0	684
109	50727	435
110	50727	524
122	50727	1
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x4af0670c
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x3d6000
SizeOfInitializedData	0x2d5000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x3d7000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x6d5000
SizeOfHeaders	0x400
CheckSum	0x272a91
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6c5000	0x25b200	RWX CODE
.rsrc	0x6c6000	0xf000	0xec00	RWX CODE

Data Directory

type	va	size
EXPORT	0x4cbc80	0xe2b
IMPORT	0x6d3d64	0x8f
RESOURCE	0x6c6000	0xd8e2
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x3d8920	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x6d4b40	0x25
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0xad4b64	0xad4b65	0xad4b58	0xad4b5c	0	0

show previews

type	name	size	cp
CURSOR	#5	308	1252
CURSOR	#6	308	1252
CURSOR	#7	308	1252
CURSOR	#8	308	1252
CURSOR	#9	308	1252
CURSOR	#10	308	1252
CURSOR	#11	308	1252
CURSOR	#12	308	1252
CURSOR	#13	308	1252
CURSOR	#14	308	1252
CURSOR	#15	308	1252
BITMAP	CSQUERY	192	1252
BITMAP	WXBITMAP_STD_COLOURS	108	1252
ICON	#1	1128	1252
ICON	#2	4264	1252
ICON	#3	9640	1252
ICON	#4	16936	1252
ICON	#16	744	1252
ICON	#17	296	1252
ICON	#18	1384	1252
ICON	#19	296	1252
ICON	#20	1384	1252
ICON	#21	296	1252
ICON	#22	1384	1252
ICON	#23	296	1252
ICON	#24	1384	1252
ICON	#25	296	1252
ICON	#26	1384	1252
ICON	#27	296	1252
ICON	#28	1384	1252
ICON	#29	296	1252
ICON	#30	1384	1252
ICON	#31	296	1252
ICON	#32	1384	1252
ICON	#33	296	1252
MENU	WXWINDOWMENU	180	1252
GROUP_CURSOR	WXCURSOR_BLANK	20	1252
GROUP_CURSOR	WXCURSOR_BULLSEYE	20	1252
GROUP_CURSOR	WXCURSOR_CROSS	20	1252
GROUP_CURSOR	WXCURSOR_HAND	20	1252
GROUP_CURSOR	WXCURSOR_MAGNIFIER	20	1252
GROUP_CURSOR	WXCURSOR_PBRUSH	20	1252
GROUP_CURSOR	WXCURSOR_PENCIL	20	1252
GROUP_CURSOR	WXCURSOR_PLEFT	20	1252
GROUP_CURSOR	WXCURSOR_PRIGHT	20	1252
GROUP_CURSOR	WXCURSOR_RIGHT_ARROW	20	1252
GROUP_CURSOR	WXCURSOR_ROLLER	20	1252
GROUP_ICON	AAA_APP_ICON	62	1252
GROUP_ICON	WXICON_AAA	34	1252
GROUP_ICON	WXICON_SMALL_CDROM	34	1252
GROUP_ICON	WXICON_SMALL_CLOSED_FOLDER	34	1252
GROUP_ICON	WXICON_SMALL_COMPUTER	34	1252
GROUP_ICON	WXICON_SMALL_DRIVE	34	1252
GROUP_ICON	WXICON_SMALL_FILE	34	1252
GROUP_ICON	WXICON_SMALL_FLOPPY	34	1252
GROUP_ICON	WXICON_SMALL_OPEN_FOLDER	34	1252
GROUP_ICON	WXICON_SMALL_REMOVEABLE	34	1252
VERSION	#1	856	1252
MANIFEST	#1	362	1252

module_name	hint	ord	function_name
kernel32.dll			LoadLibraryA
kernel32.dll			GetProcAddress
kernel32.dll			VirtualAlloc
kernel32.dll			VirtualFree

StringTable 040904b0

CompanyName	Apago, Inc.
FileDescription	PDF Shrink
FileVersion	4.4
InternalName	PDF Shrink
LegalCopyright	© 2002-2009 Apago, Inc.
LegalTrademarks	PDF Shrink is a registered trademark of Apago, Inc.
OriginalFilename	PDFShrink.exe
ProductName	PDF Shrink for Windows
ProductVersion	4.4

VS_FIXEDFILEINFO

FileVersion	4.4.18.5856
ProductVersion	4.4.18.5856
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	2531840	EXE	11/03/2009 17:23:24	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x6b8000

[?] can't find file_offset of VA 0x6b80c0

[?] can't find file_offset of VA 0x6b8130

[?] can't find file_offset of VA 0x6b81e8

[?] can't find file_offset of VA 0x6b8200

[?] can't find file_offset of VA 0x6b8218

[?] can't find file_offset of VA 0x6b8230

[?] can't find file_offset of VA 0x6b8248

[?] can't find file_offset of VA 0x6b8260

[?] can't find file_offset of VA 0x6b8278

[?] can't find file_offset of VA 0x6b8290

[?] can't find file_offset of VA 0x6b82a8

[?] can't find file_offset of VA 0x6b82c0

[?] can't find file_offset of VA 0x6b82d8

[?] can't find file_offset of VA 0x4cbc80

[?] can't find file_offset of VA 0x3d8920