DNIWEbot.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	DNIWEbot.exe
size	844800 (0xce400)
md5	547c4f76c907c320228e9f1589d4655b

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x523ab4b7
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x2aea00
SizeOfInitializedData	0x73a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x2b1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x34e000
SizeOfHeaders	0x400
CheckSum	0xd1edb
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x341000	0xc2200	RWX CODE
.rsrc	0x342000	0xc000	0xbe00	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x34bc24	0x2e8
RESOURCE	0x342000	0x9942
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x34dc54	0x6c
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x2de000	0x9c8
CLR_Header	0	0

TLS

raw start	raw end	index	callbks
0x74dc74	0x74dcc0	0x74dc6c	0x74dc70
0	0	0	0
0	0	0	0
0	0	0	0

show previews

type	name	size
VCLSTYLE	CARBONWOT	51370
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
ICON	#1	1128
ICON	#2	2440
ICON	#3	4264
ICON	#4	9640
ICON	#5	16936
STRING	#4059	1472
STRING	#4060	4416
STRING	#4061	2444
STRING	#4062	2300
STRING	#4063	2316
STRING	#4064	1484
STRING	#4065	580
STRING	#4066	1456
STRING	#4067	972
STRING	#4068	1072
STRING	#4069	844
STRING	#4070	1144
STRING	#4071	896
STRING	#4072	932
STRING	#4073	652
STRING	#4074	1028
STRING	#4075	928
STRING	#4076	844
STRING	#4077	764
STRING	#4078	188
STRING	#4079	224
STRING	#4080	952
STRING	#4081	1024
STRING	#4082	1068
STRING	#4083	716
STRING	#4084	1120
STRING	#4085	1672
STRING	#4086	1184
STRING	#4087	808
STRING	#4088	796
STRING	#4089	980
STRING	#4090	380
STRING	#4091	204
STRING	#4092	464
STRING	#4093	988
STRING	#4094	1028
STRING	#4095	748
STRING	#4096	796
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	3252
RCDATA	PLATFORMTARGETS	2
RCDATA	TMAINFORM	1794
GROUP_CURSOR	CAT_DRAG_COPY	20
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	76
VERSION	#1	368
MANIFEST	#1	714

module_name	hint	ord	function_name
kernel32.dll			LoadLibraryA
kernel32.dll			GetProcAddress
kernel32.dll			VirtualAlloc
kernel32.dll			VirtualFree
oleaut32.dll			SysFreeString
advapi32.dll			RegQueryValueExW
user32.dll			MessageBoxA
gdi32.dll			UnrealizeObject
version.dll			VerQueryValueW
ole32.dll			OleUninitialize
comctl32.dll			InitializeFlatSB
msvcrt.dll			memset
shell32.dll			ShellExecuteW
winspool.drv			OpenPrinterW

StringTable 040904E4

CompanyName	WarPack
FileVersion	2.0.0.68
ProductVersion	2.0.0

VS_FIXEDFILEINFO

FileVersion	2.0.0.68
ProductVersion	2.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	844800	EXE	09/19/2013 08:24:23	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x31f000

[?] can't find file_offset of VA 0x32b8b0

[?] can't find file_offset of VA 0x32b9e8

[?] can't find file_offset of VA 0x32bb20

[?] can't find file_offset of VA 0x32bc58

[?] can't find file_offset of VA 0x32bd90

[?] can't find file_offset of VA 0x32bec8

[?] can't find file_offset of VA 0x32c000

[?] can't find file_offset of VA 0x32c138

[?] can't find file_offset of VA 0x32c270

[?] can't find file_offset of VA 0x32c830

[?] can't find file_offset of VA 0x32d970

[?] can't find file_offset of VA 0x32e300

[?] can't find file_offset of VA 0x32ec00

[?] can't find file_offset of VA 0x32f510

[?] can't find file_offset of VA 0x32fae0

[?] can't find file_offset of VA 0x32fd28

[?] can't find file_offset of VA 0x3302d8

[?] can't find file_offset of VA 0x3306a8

[?] can't find file_offset of VA 0x330ad8

[?] can't find file_offset of VA 0x330e28

[?] can't find file_offset of VA 0x3312a0

[?] can't find file_offset of VA 0x331620

[?] can't find file_offset of VA 0x3319c8

[?] can't find file_offset of VA 0x331c58

[?] can't find file_offset of VA 0x332060

[?] can't find file_offset of VA 0x332400

[?] can't find file_offset of VA 0x332750

[?] can't find file_offset of VA 0x332a50

[?] can't find file_offset of VA 0x332b10

[?] can't find file_offset of VA 0x332bf0

[?] can't find file_offset of VA 0x332fa8

[?] can't find file_offset of VA 0x3333a8

[?] can't find file_offset of VA 0x3337d8

[?] can't find file_offset of VA 0x333aa8

[?] can't find file_offset of VA 0x333f08

[?] can't find file_offset of VA 0x334590

[?] can't find file_offset of VA 0x334a30

[?] can't find file_offset of VA 0x334d58

[?] can't find file_offset of VA 0x335078

[?] can't find file_offset of VA 0x335450

[?] can't find file_offset of VA 0x3355d0

[?] can't find file_offset of VA 0x3356a0

[?] can't find file_offset of VA 0x335870

[?] can't find file_offset of VA 0x335c50

[?] can't find file_offset of VA 0x336058

[?] can't find file_offset of VA 0x336348

[?] can't find file_offset of VA 0x336668

[?] can't find file_offset of VA 0x336678

[?] can't find file_offset of VA 0x337330

[?] can't find file_offset of VA 0x337338

[?] can't find file_offset of VA 0x337a40

[?] can't find file_offset of VA 0x337a58

[?] can't find file_offset of VA 0x337a70

[?] can't find file_offset of VA 0x337a88

[?] can't find file_offset of VA 0x337aa0

[?] can't find file_offset of VA 0x337ab8

[?] can't find file_offset of VA 0x337ad0

[?] can't find file_offset of VA 0x337ae8

[?] can't find file_offset of VA 0x2de000