2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe - tool.exe

info
MZ
PE
resources
strings
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
size	151552 (0x25000)
md5	5c2027af07ba555d680a9692328c1b68

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
93	4035	8
14	7299	2
10	8047	11
4	8047	2
11	9782	3
4	9782	3
1	1	145
11	8168	3
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x544fc342
PointerToSymbolTable	4
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x20e
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x2000
SizeOfInitializedData	0x22000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x204f
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x25000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x14d1	0x2000	R-X CODE
.rdata	0x3000	0x44f	0x1000	R-- IDATA
.data	0x4000	0x153	0x1000	RW- IDATA
.idata	0x5000	0x789	0x1000	RW- CODE
.rsrc	0x6000	0x1d95c	0x1e000	R-- IDATA
.reloc	0x24000	0x35f	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x5000	0x8c
RESOURCE	0x6000	0x1d95c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x24000	0xc
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x52e8	0x25c
Delay_IAT	0x1040	0x40
CLR_Header	0	0

show previews

type	name	size	cp	r
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#40	2147483816	16	2147483840
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#0	2105797915	1203095504	2131025808
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#0	0	4	327681
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		121706191	2863467409	3491741304
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		3199414792	3199473260	2064785646
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		2550885450	1684636371	3753365556
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		1622670463	3689281608	4100171175
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		2898419211	1430137786	865466752
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		2946589386	326256344	607792531
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		3316548406	960717676	1031762635
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		2625064180	1338086192	3131241042
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		2966905172	1531389867	276326178
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		251862143	3740810552	1245837048
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		2723987424	1166745627	936773473
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		835554241	2238194298	3384158262
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		3155466617	1411303595	4195441236
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		1000227872	2676954996	2287495775
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		1449372704	1998184579	1813578009
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		4294967295	4294967038	4294967295
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		4294836224	4293754232	4293984255
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		0	0	0
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		308	806432769	813772844
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		3844974600	1483619721	3292011829
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		532050824	3357713153	2839719484
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		3821250914	4201547300	4294318331
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		803183860	179648631	1626324740
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		0	4	65536
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W		16777216	256	86016
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	2038172045	3480267832	2731573933
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	172646868	2000970453	332184784
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	2268868104	1721014672	3101718363
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	546217278	2526618423	2186647688
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	3797163129	682952820	1895734178
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	1381858109	2360934771	3371919473
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	4264582610	4007001077	283467343
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	1241481414	4187927869	354986883
SYՓ傉䝎਍ਚഀ䡉剄送阀̈윀⹏W	#4293720822	4094959696	1313599947	79079136
ICON	#1	9640	1252	0
DIALOG	#3758096484	230	1252	0
DIALOG	#102	324	1252	0
STRING	#7	72	1252	0
GROUP_ICON	#1	20	1252	0
VERSION	#5	772	1252	0

id	lang	string
101	4	关于 mychattool(&A)...

module_name	hint	ord	function_name
MFC42.DLL		5199
MFC42.DLL		2396
MFC42.DLL		3346
MFC42.DLL		5300
MFC42.DLL		5302
MFC42.DLL		2725
MFC42.DLL		4079
MFC42.DLL		4698
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		5714
MFC42.DLL		2982
MFC42.DLL		3147
MFC42.DLL		3259
MFC42.DLL		4465
MFC42.DLL		3136
MFC42.DLL		3262
MFC42.DLL		2985
MFC42.DLL		3081
MFC42.DLL		2976
MFC42.DLL		3830
MFC42.DLL		3831
MFC42.DLL		3825
MFC42.DLL		3079
MFC42.DLL		4080
MFC42.DLL		4622
MFC42.DLL		4424
MFC42.DLL		3738
MFC42.DLL		561
MFC42.DLL		825
MFC42.DLL		815
MFC42.DLL		641
MFC42.DLL		2514
MFC42.DLL		2621
MFC42.DLL		1134
MFC42.DLL		1247
MFC42.DLL		5265
MFC42.DLL		4376
MFC42.DLL		4853
MFC42.DLL		4998
MFC42.DLL		4710
MFC42.DLL		6052
MFC42.DLL		1089
MFC42.DLL		1775
MFC42.DLL		4407
MFC42.DLL		5241
MFC42.DLL		2385
MFC42.DLL		5163
MFC42.DLL		6374
MFC42.DLL		4353
MFC42.DLL		5280
MFC42.DLL		3798
MFC42.DLL		4837
MFC42.DLL		4441
MFC42.DLL		2648
MFC42.DLL		2055
MFC42.DLL		6376
MFC42.DLL		3749
MFC42.DLL		5065
MFC42.DLL		1727
MFC42.DLL		5261
MFC42.DLL		2446
MFC42.DLL		2124
MFC42.DLL		5277
MFC42.DLL		4627
MFC42.DLL		4425
MFC42.DLL		3597
MFC42.DLL		324
MFC42.DLL		4234
MFC42.DLL		1146
MFC42.DLL		1168
MFC42.DLL		823
MFC42.DLL		800
MFC42.DLL		4160
MFC42.DLL		540
MFC42.DLL		2863
MFC42.DLL		2379
MFC42.DLL		755
MFC42.DLL		470
MFC42.DLL		5953
MFC42.DLL		939
MFC42.DLL		941
MFC42.DLL		3097
MFC42.DLL		537
MFC42.DLL		3092
MFC42.DLL		3922
MFC42.DLL		5731
MFC42.DLL		2512
MFC42.DLL		2554
MFC42.DLL		4486
MFC42.DLL		6375
MFC42.DLL		4274
MFC42.DLL		4078
MFC42.DLL		4673
MFC42.DLL		1576
MSVCRT.dll	211		_exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	585		exit
MSVCRT.dll	143		_acmdln
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	271		_initterm
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	183		_controlfp
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	690		sprintf
MSVCRT.dll	515		_wfopen
MSVCRT.dll	610		fseek
MSVCRT.dll	612		ftell
MSVCRT.dll	682		rewind
MSVCRT.dll	605		fread
MSVCRT.dll	588		fclose
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	390		_onexit
KERNEL32.dll	646		OpenProcess
KERNEL32.dll	52		CloseHandle
KERNEL32.dll	111		CreateThread
KERNEL32.dll	416		GetProcAddress
KERNEL32.dll	594		LoadLibraryA
KERNEL32.dll	383		GetModuleHandleA
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	323		GetCurrentProcessId
USER32.dll	182		DrawIcon
USER32.dll	255		GetClientRect
USER32.dll	349		GetSystemMetrics
USER32.dll	422		IsIconic
USER32.dll	348		GetSystemMenu
USER32.dll	196		EnableWindow
USER32.dll	446		LoadIconA
USER32.dll	571		SendMessageA
USER32.dll	8		AppendMenuA
USER32.dll	514		PostMessageA
WSOCK32.dll		11
WSOCK32.dll		17
WSOCK32.dll		9
WSOCK32.dll		8
WSOCK32.dll		3
WSOCK32.dll		2
WSOCK32.dll		23
PSAPI.DLL	15		GetModuleFileNameExW

StringTable 040f04e8

Comments
CompanyName
FileDescription	tool
FileVersion	1, 0, 0, 1
InternalName	tool
LegalCopyright	Copyright ? 2014
LegalTrademarks
OriginalFilename	tool.exe
PrivateBuild
ProductName	tool
ProductVersion	1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	151552	EXE	10/28/2014 16:24:34	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 43162 entries in directory, but got EOF on 7670-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 151552

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 24592

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 73744

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 79888

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 86032

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 98320

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 104464

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 110608

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 116752

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 122896

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 126992

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 131088

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 135184

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 139280

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 143376

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 147472

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 83472

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 107536

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 43024

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 29712

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 24736

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 24577

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 24320

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 24577

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 56802 entries in directory, but got EOF on 16192-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 46984

[?] too many errors getting resource data, stopped on 89 of 16192

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 24577

[?] too many errors getting resource data, stopped on 5652 of 7670

[?] can't find file_offset of VA 0xe

[?] can't find file_offset of VA 0x96a32161

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x1ce27829

[?] can't find file_offset of VA 0x601d8623

[?] can't find file_offset of VA 0xe1e703b1

[?] can't find file_offset of VA 0x7d6b54bc

[?] can't find file_offset of VA 0x8a7fd470

[?] can't find file_offset of VA 0xcf3d5b12

[?] can't find file_offset of VA 0x96781c46

[?] can't find file_offset of VA 0xce378b02

[?] can't find file_offset of VA 0xb7af347d

[?] can't find file_offset of VA 0xbacf10d

[?] can't find file_offset of VA 0xc5bca005

[?] can't find file_offset of VA 0x2d1717bf

[?] can't find file_offset of VA 0xe09be105

[?] can't find file_offset of VA 0x5b30e7d7

[?] can't find file_offset of VA 0xb7898419

[?] can't find file_offset of VA 0xffffffff

[?] can't find file_offset of VA 0xffff0000

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x9ea119b6

[?] can't find file_offset of VA 0xccb63329

[?] can't find file_offset of VA 0x2433e251

[?] can't find file_offset of VA 0xb5e20891

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x400

[?] can't find file_offset of VA 0xaf8decde

[?] can't find file_offset of VA 0xda1adeed

[?] can't find file_offset of VA 0x5827e8df

[?] can't find file_offset of VA 0xb8e0775b

[?] can't find file_offset of VA 0x82111667

[?] can't find file_offset of VA 0x2360dc10

[?] can't find file_offset of VA 0x6259b3f4

[?] can't find file_offset of VA 0xa51bbde8

[?] can't find file_offset of VA 0x203d82e9

[?] can't find file_offset of VA 0x10050b0

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe- tool.exe - tool

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040f04e8

VS_FIXEDFILEINFO

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
- tool.exe - tool