filenameMAKECAB.OVL
size152576 (0x25400)
md554fda6becfa8249c4bade9d80749bbca
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x33a0843d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion4.20
SizeOfCode0x1d000
SizeOfInitializedData0x8c00
SizeOfUninitializedData0
AddressOfEntryPoint0xe2a0
BaseOfCode0x1000
BaseOfData0x1e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x29000
SizeOfHeaders0x400
CheckSum0x34b25
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v4.2

Sections

namevavsizeraw sizeflags
.text0x10000x1cfe10x1d000R-X CODE
.rdata0x1e0000x8a80xa00R-- IDATA
.data0x1f0000x62440x4c00RW- IDATA
.idata0x260000x7760x800RW- IDATA
.reloc0x270000x15280x1600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x260000x3c
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x270000x1368
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x261580x11c
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll598VirtualAlloc
KERNEL32.dll231GetFileAttributesA
KERNEL32.dll23CloseHandle
KERNEL32.dll117FileTimeToDosDateTime
KERNEL32.dll118FileTimeToLocalFileTime
KERNEL32.dll237GetFileTime
KERNEL32.dll48CreateFileA
KERNEL32.dll530SetFileAttributesA
KERNEL32.dll533SetFileTime
KERNEL32.dll406LocalFileTimeToFileTime
KERNEL32.dll82DosDateTimeToFileTime
KERNEL32.dll243GetLastError
KERNEL32.dll365HeapFree
KERNEL32.dll359HeapAlloc
KERNEL32.dll106ExitProcess
KERNEL32.dll577TerminateProcess
KERNEL32.dll210GetCurrentProcess
KERNEL32.dll327GetTimeZoneInformation
KERNEL32.dll308GetSystemTime
KERNEL32.dll244GetLocalTime
KERNEL32.dll238GetFileType
KERNEL32.dll466ReadFile
KERNEL32.dll630WriteFile
KERNEL32.dll532SetFilePointer
KERNEL32.dll77DeleteFileA
KERNEL32.dll125FindClose
KERNEL32.dll119FileTimeToSystemTime
KERNEL32.dll129FindFirstFileA
KERNEL32.dll41CreateDirectoryA
KERNEL32.dll208GetCurrentDirectoryA
KERNEL32.dll169GetCommandLineA
KERNEL32.dll331GetVersion
KERNEL32.dll363HeapDestroy
KERNEL32.dll361HeapCreate
KERNEL32.dll601VirtualFree
KERNEL32.dll222GetDriveTypeA
KERNEL32.dll298GetStringTypeA
KERNEL32.dll617WideCharToMultiByte
KERNEL32.dll301GetStringTypeW
KERNEL32.dll425MultiByteToWideChar
KERNEL32.dll395LCMapStringA
KERNEL32.dll396LCMapStringW
KERNEL32.dll277GetProcAddress
KERNEL32.dll253GetModuleHandleA
KERNEL32.dll523SetEndOfFile
KERNEL32.dll534SetHandleCount
KERNEL32.dll297GetStdHandle
KERNEL32.dll295GetStartupInfoA
KERNEL32.dll548SetStdHandle
KERNEL32.dll239GetFullPathNameA
KERNEL32.dll481RtlUnwind
KERNEL32.dll587UnhandledExceptionFilter
KERNEL32.dll251GetModuleFileNameA
KERNEL32.dll149FreeEnvironmentStringsA
KERNEL32.dll224GetEnvironmentStrings
KERNEL32.dll150FreeEnvironmentStringsW
KERNEL32.dll226GetEnvironmentStringsW
KERNEL32.dll162GetCPInfo
KERNEL32.dll156GetACP
KERNEL32.dll264GetOEMCP
KERNEL32.dll141FlushFileBuffers
KERNEL32.dll398LoadLibraryA
KERNEL32.dll29CompareStringA
KERNEL32.dll30CompareStringW
KERNEL32.dll524SetEnvironmentVariableA
KERNEL32.dll368HeapReAlloc
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dll10VerQueryValueA
VERSION.dllGetFileVersionInfoA
offsetsizetypecomment
0152576EXE06/12/1997 23:20:29#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK