filename | pestudio.exe | |
---|---|---|
size | 565248 (0x8a000) | |
md5 | 56cb4d50906eed7233436805579f81f5 | |
type | PE32 executable (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0xf0 |
Rich Header
lib id | version | times used |
---|---|---|
109 | 50727 | 9 |
123 | 50727 | 19 |
1 | 0 | 530 |
149 | 30729 | 24 |
131 | 30729 | 149 |
132 | 21022 | 3 |
132 | 30729 | 231 |
148 | 21022 | 1 |
145 | 30729 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
Data Directory
id | lang | string |
---|---|---|
128 | 1033 | pestudio pestudio Executable (*.exe) .exe pestudio.Document pestudio |
129 | 1033 | ... |
130 | 1033 | ... |
156 | 1033 | ... |
157 | 1033 | ... |
158 | 1033 | ... |
159 | 1033 | ... |
32773 | 1033 | . close file |
32775 | 1033 | . open file |
32785 | 1033 | . create an XML report |
32868 | 1033 | . save file |
32955 | 1033 | Configure pestudio Configure pestudio |
57664 | 1033 | display program information, version number and copyright about pestudio |
57665 | 1033 | quit pestudio exit |
59136 | 1033 | EXT |
61440 | 1033 | Open |
61441 | 1033 | Save As |
61442 | 1033 | All Files (*.*) |
61443 | 1033 | Untitled |
61446 | 1033 | an unnamed file |
61457 | 1033 | &Hide |
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.dll | 914 | RtlUnwind | |
KERNEL32.dll | 1069 | TerminateProcess | |
KERNEL32.dll | 1086 | UnhandledExceptionFilter | |
KERNEL32.dll | 1045 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 721 | IsDebuggerPresent | |
KERNEL32.dll | 669 | HeapAlloc | |
KERNEL32.dll | 673 | HeapFree | |
KERNEL32.dll | 676 | HeapReAlloc | |
KERNEL32.dll | 1057 | Sleep | |
KERNEL32.dll | 260 | ExitProcess | |
KERNEL32.dll | 678 | HeapSize | |
KERNEL32.dll | 571 | GetStdHandle | |
KERNEL32.dll | 500 | GetModuleFileNameA | |
KERNEL32.dll | 331 | FreeEnvironmentStringsW | |
KERNEL32.dll | 449 | GetEnvironmentStringsW | |
KERNEL32.dll | 368 | GetCommandLineW | |
KERNEL32.dll | 1000 | SetHandleCount | |
KERNEL32.dll | 471 | GetFileType | |
KERNEL32.dll | 569 | GetStartupInfoA | |
KERNEL32.dll | 671 | HeapCreate | |
KERNEL32.dll | 1111 | VirtualFree | |
KERNEL32.dll | 852 | QueryPerformanceCounter | |
KERNEL32.dll | 591 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 570 | GetStartupInfoW | |
KERNEL32.dll | 338 | GetACP | |
KERNEL32.dll | 531 | GetOEMCP | |
KERNEL32.dll | 731 | IsValidCodePage | |
KERNEL32.dll | 737 | LCMapStringA | |
KERNEL32.dll | 739 | LCMapStringW | |
KERNEL32.dll | 1108 | VirtualAlloc | |
KERNEL32.dll | 693 | InitializeCriticalSectionAndSpinCount | |
KERNEL32.dll | 619 | GetTimeZoneInformation | |
KERNEL32.dll | 387 | GetConsoleCP | |
KERNEL32.dll | 405 | GetConsoleMode | |
KERNEL32.dll | 488 | GetLocaleInfoA | |
KERNEL32.dll | 573 | GetStringTypeA | |
KERNEL32.dll | 576 | GetStringTypeW | |
KERNEL32.dll | 1020 | SetStdHandle | |
KERNEL32.dll | 1154 | WriteConsoleA | |
KERNEL32.dll | 409 | GetConsoleOutputCP | |
KERNEL32.dll | 1164 | WriteConsoleW | |
KERNEL32.dll | 120 | CreateFileA | |
KERNEL32.dll | 976 | SetEnvironmentVariableA | |
KERNEL32.dll | 978 | SetErrorMode | |
KERNEL32.dll | 469 | GetFileSizeEx | |
KERNEL32.dll | 763 | LocalFileTimeToFileTime | |
KERNEL32.dll | 459 | GetFileAttributesExW | |
KERNEL32.dll | 271 | FileTimeToLocalFileTime | |
KERNEL32.dll | 568 | GetShortPathNameW | |
KERNEL32.dll | 633 | GetVolumeInformationW | |
KERNEL32.dll | 292 | FindFirstFileW | |
KERNEL32.dll | 281 | FindClose | |
KERNEL32.dll | 425 | GetCurrentProcess | |
KERNEL32.dll | 212 | DuplicateHandle | |
KERNEL32.dll | 468 | GetFileSize | |
KERNEL32.dll | 973 | SetEndOfFile | |
KERNEL32.dll | 1087 | UnlockFile | |
KERNEL32.dll | 773 | LockFile | |
KERNEL32.dll | 321 | FlushFileBuffers | |
KERNEL32.dll | 991 | SetFilePointer | |
KERNEL32.dll | 872 | ReadFile | |
KERNEL32.dll | 1197 | lstrcmpiW | |
KERNEL32.dll | 575 | GetStringTypeExW | |
KERNEL32.dll | 195 | DeleteFileW | |
KERNEL32.dll | 790 | MoveFileW | |
KERNEL32.dll | 1171 | WritePrivateProfileStringW | |
KERNEL32.dll | 1066 | SystemTimeToFileTime | |
KERNEL32.dll | 272 | FileTimeToSystemTime | |
KERNEL32.dll | 607 | GetThreadLocale | |
KERNEL32.dll | 1205 | lstrlenA | |
KERNEL32.dll | 704 | InterlockedIncrement | |
KERNEL32.dll | 651 | GlobalFlags | |
KERNEL32.dll | 1075 | TlsFree | |
KERNEL32.dll | 190 | DeleteCriticalSection | |
KERNEL32.dll | 768 | LocalReAlloc | |
KERNEL32.dll | 1077 | TlsSetValue | |
KERNEL32.dll | 1074 | TlsAlloc | |
KERNEL32.dll | 692 | InitializeCriticalSection | |
KERNEL32.dll | 655 | GlobalHandle | |
KERNEL32.dll | 659 | GlobalReAlloc | |
KERNEL32.dll | 217 | EnterCriticalSection | |
KERNEL32.dll | 1076 | TlsGetValue | |
KERNEL32.dll | 751 | LeaveCriticalSection | |
KERNEL32.dll | 765 | LocalFree | |
KERNEL32.dll | 761 | LocalAlloc | |
KERNEL32.dll | 654 | GlobalGetAtomNameW | |
KERNEL32.dll | 793 | MulDiv | |
KERNEL32.dll | 502 | GetModuleHandleA | |
KERNEL32.dll | 560 | GetProfileIntW | |
KERNEL32.dll | 614 | GetTickCount | |
KERNEL32.dll | 439 | GetDiskFreeSpaceW | |
KERNEL32.dll | 479 | GetFullPathNameW | |
KERNEL32.dll | 601 | GetTempFileNameW | |
KERNEL32.dll | 470 | GetFileTime | |
KERNEL32.dll | 995 | SetFileTime | |
KERNEL32.dll | 462 | GetFileAttributesW | |
KERNEL32.dll | 428 | GetCurrentThread | |
KERNEL32.dll | 90 | ConvertDefaultLocale | |
KERNEL32.dll | 233 | EnumResourceLanguagesW | |
KERNEL32.dll | 1193 | lstrcmpA | |
KERNEL32.dll | 490 | GetLocaleInfoW | |
KERNEL32.dll | 82 | CompareStringA | |
KERNEL32.dll | 701 | InterlockedExchange | |
KERNEL32.dll | 426 | GetCurrentProcessId | |
KERNEL32.dll | 700 | InterlockedDecrement | |
KERNEL32.dll | 501 | GetModuleFileNameW | |
KERNEL32.dll | 652 | GlobalFree | |
KERNEL32.dll | 1206 | lstrlenW | |
KERNEL32.dll | 335 | FreeResource | |
KERNEL32.dll | 644 | GlobalAddAtomW | |
KERNEL32.dll | 649 | GlobalFindAtomW | |
KERNEL32.dll | 647 | GlobalDeleteAtom | |
KERNEL32.dll | 630 | GetVersionExW | |
KERNEL32.dll | 85 | CompareStringW | |
KERNEL32.dll | 1194 | lstrcmpW | |
KERNEL32.dll | 629 | GetVersionExA | |
KERNEL32.dll | 429 | GetCurrentThreadId | |
KERNEL32.dll | 127 | CreateFileW | |
KERNEL32.dll | 1165 | WriteFile | |
KERNEL32.dll | 753 | LoadLibraryA | |
KERNEL32.dll | 67 | CloseHandle | |
KERNEL32.dll | 332 | FreeLibrary | |
KERNEL32.dll | 486 | GetLastError | |
KERNEL32.dll | 1004 | SetLastError | |
KERNEL32.dll | 544 | GetProcAddress | |
KERNEL32.dll | 505 | GetModuleHandleW | |
KERNEL32.dll | 756 | LoadLibraryW | |
KERNEL32.dll | 1203 | lstrcpynW | |
KERNEL32.dll | 645 | GlobalAlloc | |
KERNEL32.dll | 656 | GlobalLock | |
KERNEL32.dll | 663 | GlobalUnlock | |
KERNEL32.dll | 794 | MultiByteToWideChar | |
KERNEL32.dll | 1146 | WideCharToMultiByte | |
KERNEL32.dll | 313 | FindResourceW | |
KERNEL32.dll | 758 | LoadResource | |
KERNEL32.dll | 775 | LockResource | |
KERNEL32.dll | 1056 | SizeofResource | |
KERNEL32.dll | 347 | GetCPInfo | |
KERNEL32.dll | 858 | RaiseException | |
USER32.dll | 365 | GetSysColorBrush | |
USER32.dll | 735 | UnregisterClassW | |
USER32.dll | 157 | DestroyIcon | |
USER32.dll | 58 | CharUpperW | |
USER32.dll | 213 | EndPaint | |
USER32.dll | 14 | BeginPaint | |
USER32.dll | 383 | GetWindowDC | |
USER32.dll | 404 | GrayStringW | |
USER32.dll | 199 | DrawTextExW | |
USER32.dll | 200 | DrawTextW | |
USER32.dll | 711 | TabbedTextOutW | |
USER32.dll | 239 | FillRect | |
USER32.dll | 658 | SetRectEmpty | |
USER32.dll | 771 | WindowFromPoint | |
USER32.dll | 69 | ClientToScreen | |
USER32.dll | 657 | SetRect | |
USER32.dll | 692 | ShowOwnedPopups | |
USER32.dll | 624 | SetCursor | |
USER32.dll | 400 | GetWindowThreadProcessId | |
USER32.dll | 329 | GetMenuStringW | |
USER32.dll | 158 | DestroyMenu | |
USER32.dll | 325 | GetMenuItemInfoW | |
USER32.dll | 284 | GetDesktopWindow | |
USER32.dll | 91 | CreateDialogIndirectParamW | |
USER32.dll | 339 | GetNextDlgTabItem | |
USER32.dll | 211 | EndDialog | |
USER32.dll | 454 | IsWindowEnabled | |
USER32.dll | 696 | ShowWindow | |
USER32.dll | 517 | MoveWindow | |
USER32.dll | 684 | SetWindowTextW | |
USER32.dll | 441 | IsDialogMessageW | |
USER32.dll | 643 | SetMenuItemBitmaps | |
USER32.dll | 318 | GetMenuCheckMarkDimensions | |
USER32.dll | 465 | LoadBitmapW | |
USER32.dll | 471 | LoadIconW | |
USER32.dll | 602 | SendDlgItemMessageW | |
USER32.dll | 601 | SendDlgItemMessageA | |
USER32.dll | 768 | WinHelpW | |
USER32.dll | 437 | IsChild | |
USER32.dll | 257 | GetCapture | |
USER32.dll | 460 | IsZoomed | |
USER32.dll | 656 | SetPropW | |
USER32.dll | 348 | GetPropW | |
USER32.dll | 592 | RemovePropW | |
USER32.dll | 292 | GetFocus | |
USER32.dll | 633 | SetFocus | |
USER32.dll | 398 | GetWindowTextLengthW | |
USER32.dll | 399 | GetWindowTextW | |
USER32.dll | 293 | GetForegroundWindow | |
USER32.dll | 312 | GetLastActivePopup | |
USER32.dll | 614 | SetActiveWindow | |
USER32.dll | 13 | BeginDeferWindowPos | |
USER32.dll | 210 | EndDeferWindowPos | |
USER32.dll | 287 | GetDlgItem | |
USER32.dll | 373 | GetTopWindow | |
USER32.dll | 160 | DestroyWindow | |
USER32.dll | 729 | UnhookWindowsHookEx | |
USER32.dll | 333 | GetMessageTime | |
USER32.dll | 499 | MapWindowPoints | |
USER32.dll | 719 | TrackPopupMenu | |
USER32.dll | 639 | SetMenu | |
USER32.dll | 660 | SetScrollPos | |
USER32.dll | 359 | GetScrollPos | |
USER32.dll | 634 | SetForegroundWindow | |
USER32.dll | 543 | PostMessageW | |
USER32.dll | 323 | GetMenuItemID | |
USER32.dll | 511 | MessageBoxW | |
USER32.dll | 104 | CreateWindowExW | |
USER32.dll | 262 | GetClassInfoExW | |
USER32.dll | 263 | GetClassInfoW | |
USER32.dll | 566 | RegisterClassW | |
USER32.dll | 3 | AdjustWindowRectEx | |
USER32.dll | 341 | GetParent | |
USER32.dll | 236 | EqualRect | |
USER32.dll | 151 | DeferWindowPos | |
USER32.dll | 286 | GetDlgCtrlID | |
USER32.dll | 150 | DefWindowProcW | |
USER32.dll | 29 | CallWindowProcW | |
USER32.dll | 316 | GetMenu | |
USER32.dll | 386 | GetWindowLongW | |
USER32.dll | 677 | SetWindowLongW | |
USER32.dll | 679 | SetWindowPos | |
USER32.dll | 526 | OffsetRect | |
USER32.dll | 425 | IntersectRect | |
USER32.dll | 708 | SystemParametersInfoA | |
USER32.dll | 445 | IsIconic | |
USER32.dll | 391 | GetWindowPlacement | |
USER32.dll | 367 | GetSystemMetrics | |
USER32.dll | 381 | GetWindow | |
USER32.dll | 688 | SetWindowsHookExW | |
USER32.dll | 27 | CallNextHookEx | |
USER32.dll | 334 | GetMessageW | |
USER32.dll | 725 | TranslateMessage | |
USER32.dll | 169 | DispatchMessageW | |
USER32.dll | 249 | GetActiveWindow | |
USER32.dll | 540 | PeekMessageW | |
USER32.dll | 754 | ValidateRect | |
USER32.dll | 733 | UnpackDDElParam | |
USER32.dll | 595 | ReuseDDElParam | |
USER32.dll | 463 | LoadAcceleratorsW | |
USER32.dll | 421 | InsertMenuItemW | |
USER32.dll | 101 | CreatePopupMenu | |
USER32.dll | 16 | BringWindowToTop | |
USER32.dll | 723 | TranslateAcceleratorW | |
USER32.dll | 469 | LoadCursorW | |
USER32.dll | 156 | DestroyCursor | |
USER32.dll | 626 | SetCursorPos | |
USER32.dll | 587 | ReleaseCapture | |
USER32.dll | 267 | GetClassNameW | |
USER32.dll | 615 | SetCapture | |
USER32.dll | 745 | UpdateWindow | |
USER32.dll | 209 | EnableWindow | |
USER32.dll | 281 | GetCursorPos | |
USER32.dll | 61 | CheckMenuItem | |
USER32.dll | 207 | EnableMenuItem | |
USER32.dll | 322 | GetMenuItemCount | |
USER32.dll | 363 | GetSubMenu | |
USER32.dll | 590 | RemoveMenu | |
USER32.dll | 481 | LoadMenuW | |
USER32.dll | 611 | SendMessageW | |
USER32.dll | 544 | PostQuitMessage | |
USER32.dll | 458 | IsWindowVisible | |
USER32.dll | 453 | IsWindow | |
USER32.dll | 513 | ModifyMenuW | |
USER32.dll | 79 | CopyRect | |
USER32.dll | 553 | PtInRect | |
USER32.dll | 417 | InflateRect | |
USER32.dll | 269 | GetClientRect | |
USER32.dll | 596 | ScreenToClient | |
USER32.dll | 282 | GetDC | |
USER32.dll | 588 | ReleaseDC | |
USER32.dll | 426 | InvalidateRect | |
USER32.dll | 332 | GetMessagePos | |
USER32.dll | 71 | CloseClipboard | |
USER32.dll | 621 | SetClipboardData | |
USER32.dll | 206 | EmptyClipboard | |
USER32.dll | 392 | GetWindowRect | |
USER32.dll | 327 | GetMenuState | |
USER32.dll | 586 | RegisterWindowMessageW | |
USER32.dll | 461 | KillTimer | |
USER32.dll | 670 | SetTimer | |
USER32.dll | 152 | DeleteMenu | |
USER32.dll | 305 | GetKeyState | |
USER32.dll | 693 | ShowScrollBar | |
USER32.dll | 709 | SystemParametersInfoW | |
USER32.dll | 96 | CreateIconFromResourceEx | |
USER32.dll | 649 | SetParent | |
USER32.dll | 562 | RedrawWindow | |
USER32.dll | 364 | GetSysColor | |
USER32.dll | 527 | OpenClipboard | |
USER32.dll | 265 | GetClassLongW | |
GDI32.dll | 655 | SetViewportExtEx | |
GDI32.dll | 600 | ScaleViewportExtEx | |
GDI32.dll | 659 | SetWindowExtEx | |
GDI32.dll | 601 | ScaleWindowExtEx | |
GDI32.dll | 72 | CreatePatternBrush | |
GDI32.dll | 500 | GetStockObject | |
GDI32.dll | 549 | OffsetViewportOrgEx | |
GDI32.dll | 437 | GetDeviceCaps | |
GDI32.dll | 525 | GetTextMetricsW | |
GDI32.dll | 281 | Escape | |
GDI32.dll | 656 | SetViewportOrgEx | |
GDI32.dll | 672 | TextOutW | |
GDI32.dll | 581 | RectVisible | |
GDI32.dll | 577 | PtVisible | |
GDI32.dll | 491 | GetPixel | |
GDI32.dll | 62 | CreateFontIndirectW | |
GDI32.dll | 535 | IntersectClipRect | |
GDI32.dll | 284 | ExcludeClipRect | |
GDI32.dll | 635 | SetMapMode | |
GDI32.dll | 614 | SetBkMode | |
GDI32.dll | 592 | RestoreDC | |
GDI32.dll | 599 | SaveDC | |
GDI32.dll | 557 | PatBlt | |
GDI32.dll | 45 | CreateCompatibleBitmap | |
GDI32.dll | 667 | StretchDIBits | |
GDI32.dll | 205 | DeleteDC | |
GDI32.dll | 63 | CreateFontW | |
GDI32.dll | 606 | SelectObject | |
GDI32.dll | 423 | GetCharWidthW | |
GDI32.dll | 208 | DeleteObject | |
GDI32.dll | 403 | GetBkColor | |
GDI32.dll | 291 | ExtTextOutW | |
GDI32.dll | 18 | BitBlt | |
GDI32.dll | 46 | CreateCompatibleDC | |
GDI32.dll | 40 | CreateBitmap | |
GDI32.dll | 613 | SetBkColor | |
GDI32.dll | 653 | SetTextColor | |
GDI32.dll | 426 | GetClipBox | |
GDI32.dll | 82 | CreateSolidBrush | |
GDI32.dll | 517 | GetTextExtentPoint32W | |
GDI32.dll | 430 | GetCurrentObject | |
GDI32.dll | 484 | GetObjectW | |
COMDLG32.dll | 10 | GetFileTitleW | |
ADVAPI32.dll | 632 | RegSetValueExW | |
ADVAPI32.dll | 563 | RegCreateKeyExW | |
ADVAPI32.dll | 633 | RegSetValueW | |
ADVAPI32.dll | 298 | GetFileSecurityW | |
ADVAPI32.dll | 676 | SetFileSecurityW | |
ADVAPI32.dll | 617 | RegQueryValueW | |
ADVAPI32.dll | 606 | RegOpenKeyW | |
ADVAPI32.dll | 586 | RegEnumKeyW | |
ADVAPI32.dll | 574 | RegDeleteKeyW | |
ADVAPI32.dll | 603 | RegOpenKeyExW | |
ADVAPI32.dll | 616 | RegQueryValueExW | |
ADVAPI32.dll | 554 | RegCloseKey | |
ADVAPI32.dll | 566 | RegCreateKeyW | |
SHELL32.dll | 27 | DragAcceptFiles | |
SHELL32.dll | 28 | DragFinish | |
SHELL32.dll | 32 | DragQueryFileW | |
SHELL32.dll | 44 | ExtractIconW | |
SHELL32.dll | 186 | SHGetFileInfoW | |
SHELL32.dll | 280 | ShellExecuteW | |
SHLWAPI.dll | 73 | PathFindFileNameW | |
SHLWAPI.dll | 139 | PathRemoveFileSpecW | |
SHLWAPI.dll | 151 | PathStripToRootW | |
SHLWAPI.dll | 71 | PathFindExtensionW | |
SHLWAPI.dll | 113 | PathIsUNCW | |
ole32.dll | 103 | CoTaskMemFree | |
ole32.dll | 107 | CoUninitialize | |
ole32.dll | 283 | RevokeDragDrop | |
ole32.dll | 70 | CoLockObjectExternal | |
ole32.dll | 281 | RegisterDragDrop | |
ole32.dll | 62 | CoInitializeEx | |
ole32.dll | 16 | CoCreateInstance | |
ole32.dll | 61 | CoInitialize | |
OLEAUT32.dll | 4 | ||
OLEAUT32.dll | 9 | ||
OLEAUT32.dll | 12 | ||
OLEAUT32.dll | 8 |
StringTable 000004b0
Comments | Malware Initial Assessment |
CompanyName | www.winitor.com |
FileDescription | Malware Initial Assessment - www.winitor.com |
FileVersion | 8, 97, 0, 0 |
InternalName | pestudio.exe |
LegalCopyright | Copyright © 2009-2019 Marc Ochsenmeier |
LegalTrademarks | www.winitor.com |
OriginalFilename | pestudio.exe |
ProductName | pestudio |
ProductVersion | 8, 97, 0, 0 |
VS_FIXEDFILEINFO
FileVersion | 8.97.0.0 |
ProductVersion | 8.97.0.0 |
StrucVersion | 0x10000 |
FileFlagsMask | 0x3f |
FileFlags | 0x28 |
FileOS | 4 |
FileType | 1 |
FileSubtype | 0 |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
everything is OK