ReFox.tmp.exe - ReFox

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	ReFox.tmp.exe
size	2749735 (0x29f527)
md5	54f78afa18a26ab970a2c20ae22bb830

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x200

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x5e32e004
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	5.0
SizeOfCode	0x3e4000
SizeOfInitializedData	0x2eb000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2284
BaseOfCode	0x1000
BaseOfData	0x3e5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x709000
SizeOfHeaders	0x400
CheckSum	0x29e41e
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

PeCompact 2.xx (BitSum Technologies / v2.0)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6e7000	0x276a00	RWX CODE
.rsrc	0x6e8000	0x21000	0x20000	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x70604c	0x3a6
RESOURCE	0x6e8000	0x1d924
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x707fdc	0xdc
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x519000	0x574
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0xb07ffc	0xb080b8	0xb07ff4	0xb07ff8	0	0
0	0	0	0xfe000542	0x504f42	0x6f430a0d
0x6f72506d	0x5a432820	0xa0d29	0x206e614a	0x32203033	0x303230
0x353a3431	0x39333a33	0x3e0a0d00	0x65203e3e	0x69616d2d	0x69203a6c
0x406f666e	0x6f666572	0x656e2e78	0x3c3c2074	0xa0d3c	0x53250a0d
0x203d204e	0x23585800	0x23232323	0x23	0x55250a0d	0x203d2031
0x6f6e4100	0x6f6d796e	0x7375	0	0	0
0	0	0xa0d0000	0x20325525	0x7500203d	0x6765726e
0x65747369	0x20646572	0x79706f63	0	0	0

show previews

type	name	size	cp
ICON	#1	74893	1252
ICON	#2	16936	1252
ICON	#3	9640	1252
ICON	#4	6760	1252
ICON	#5	4264	1252
ICON	#6	2440	1252
ICON	#7	1720	1252
ICON	#8	1128	1252
RCDATA	DVCLAL	16	1252
GROUP_ICON	MAINICON	118	1252
VERSION	#1	836	1252
MANIFEST	#1	1628	1252

module_name	ord	function_name
kernel32.dll		LoadLibraryA
kernel32.dll		GetProcAddress
kernel32.dll		VirtualAlloc
kernel32.dll		VirtualFree
ADVAPI32.DLL		AllocateAndInitializeSid
VERSION.DLL		GetFileVersionInfoA
WINSPOOL.DRV		ClosePrinter
COMCTL32.DLL		ImageList_Add
COMDLG32.DLL		ChooseColorA
GDI32.DLL		BitBlt
SHELL32.DLL		DragAcceptFiles
SHFOLDER.DLL		SHGetFolderPathA
USER32.DLL		ActivateKeyboardLayout
WINMM.DLL		mciGetErrorStringA
OLE32.DLL		CoCreateGuid
OLEAUT32.DLL	200
PSAPI.DLL		GetMappedFileNameA

StringTable 040904E4

CompanyName	ComPro (CZ)
FileDescription	ReFox XII
FileVersion	12.99.2019.1117
InternalName	ReFox.12.99
LegalCopyright	Jan Brebera (c) 1992-2020
LegalTrademarks	ReFox, ComPro (CZ)
OriginalFilename	ReFox
ProductName	ReFox XII
ProductVersion	12.99/16
Comments	2019.11.17

VS_FIXEDFILEINFO

FileVersion	12.99.2019.1117
ProductVersion	12.99.2019.1117
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	2715136	EXE	01/30/2020 13:54:12	#
15c1	15	HTM		#
2770f0	74893	PNG	(256 x 256)	#
296e00	34599	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 2749735 bytes (2686 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x6ca000

[?] can't find file_offset of VA 0x519000

ReFox.tmp.exe-