filenamecalc_upx_res_unupx_XXX2_rsrcfix.exe
size692224 (0xa9000)
md562617de9edda343a49e9c72e1a8c636d
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149210229
10367
1472102229
13221022129
1312102225
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x48ccbd34
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x4aa00
SizeOfInitializedData0x2000
SizeOfUninitializedData0x68000
AddressOfEntryPoint0x3830b
BaseOfCode0x1000
BaseOfData0xa6000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.256
SubsystemVersion5.1
Reserved10
SizeOfImage0xa9000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
XXX00x10000x680000x40000RWX UDATA
XXX10x410000x3d0000x10000RWX IDATA
.rsrc0x510000x30000x58000RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x49c1c0x12c
RESOURCE0x510000x4ab07
EXCEPTION00
SECURITY00
BASERELOC0x9c0000x3588
DEBUG0x16100x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x3d780x40
Bound_IAT0x2800x12c
IAT0x10000x594
Delay_IAT0x49bac0x40
CLR_Header00
typenamesizecp
IMAGE#15774650
IMAGE#16540860
IMAGE#17042340
IMAGE#17546250
IMAGE#18048730
IMAGE#20430480
IMAGE#20830520
IMAGE#21232170
IMAGE#21633380
IMAGE#21741910
IMAGE#21842290
IMAGE#21941100
IMAGE#22040650
IMAGE#96132350
IMAGE#9814700
IMAGE#9825870
IMAGE#9835180
IMAGE#300053440
IMAGE#301541540
IMAGE#304548150
IMAGE#305160380
IMAGE#306042900
IMAGE#307548150
IMAGE#309145500
IMAGE#310015450
IMAGE#310215180
IMAGE#31038530
IMAGE#31045930
IMAGE#310633980
IMAGE#310736050
IMAGE#310835080
IMAGE#310937610
MUI#12800
WEVT_TEMPLATE#147500
BITMAPIDT_BTN_STR_STATISTICS10640
BITMAP#96510640
BITMAP#97510640
BITMAP#97710640
BITMAP#97910640
BITMAP#98010640
BITMAP#98510640
BITMAP#310527400
ICON#17440
ICON#22960
ICON#316400
ICON#47440
ICON#52960
ICON#637520
ICON#722160
ICON#813840
ICON#9601750
ICON#1096400
ICON#1142640
ICON#1211280
ICON#1316400
ICON#147440
ICON#152960
ICON#1637520
ICON#1722160
ICON#1813840
ICON#19601750
ICON#2096400
ICON#2142640
ICON#2211280
ICON#238720
GROUP_ICONSC1460
GROUP_ICON#232340
GROUP_ICON#233200
GROUP_ICON#2341460
VERSION#18880
MANIFEST#111670
module_namehintordfunction_name
KERNEL32.DLLlstrlenA
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLOutputDebugStringA
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLSizeofResource
KERNEL32.DLLLockResource
KERNEL32.DLLLoadResource
KERNEL32.DLLFindResourceW
KERNEL32.DLLFindResourceExW
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLGetSystemTime
KERNEL32.DLLSetEvent
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLCreateThread
KERNEL32.DLLCreateEventW
KERNEL32.DLLResetEvent
KERNEL32.DLLlstrcmpW
KERNEL32.DLLGlobalSize
KERNEL32.DLLGlobalUnlock
KERNEL32.DLLGlobalLock
KERNEL32.DLLGlobalAlloc
KERNEL32.DLLMulDiv
KERNEL32.DLLGlobalFindAtomW
KERNEL32.DLLGetLastError
KERNEL32.DLLInterlockedDecrement
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLGetLocalTime
KERNEL32.DLLGetDateFormatW
KERNEL32.DLLInterlockedIncrement
KERNEL32.DLLWritePrivateProfileStringW
KERNEL32.DLLGetPrivateProfileStringW
KERNEL32.DLLlstrcmpiW
KERNEL32.DLLGetLocaleInfoEx
KERNEL32.DLLGetProcAddress
KERNEL32.DLLLoadLibraryW
KERNEL32.DLLFreeLibrary
KERNEL32.DLLDelayLoadFailureHook
KERNEL32.DLLInterlockedCompareExchange
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLLocalFree
KERNEL32.DLLLocalReAlloc
KERNEL32.DLLLocalAlloc
KERNEL32.DLLGetProfileStringW
KERNEL32.DLLlstrlenW
KERNEL32.DLLCompareStringW
KERNEL32.DLLApplicationRecoveryInProgress
KERNEL32.DLLSleep
KERNEL32.DLLApplicationRecoveryFinished
KERNEL32.DLLRegisterApplicationRecoveryCallback
KERNEL32.DLLRegisterApplicationRestart
KERNEL32.DLLCompareFileTime
KERNEL32.DLLSystemTimeToFileTime
KERNEL32.DLLGetTempFileNameW
KERNEL32.DLLGetFileAttributesW
KERNEL32.DLLFileTimeToSystemTime
KERNEL32.DLLDeleteFileW
KERNEL32.DLLCreateFileW
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLGetVersionExA
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLGetTickCount
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLTerminateProcess
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLInterlockedExchange
KERNEL32.DLLRaiseException
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLHeapSize
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLCloseHandle
KERNEL32.DLLHeapDestroy
ADVAPI32.dllRegDeleteKeyW
ADVAPI32.dllRegEnumKeyExW
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllRegQueryInfoKeyW
ADVAPI32.dllRegGetValueW
ADVAPI32.dllRegEnumValueW
ADVAPI32.dllEventRegister
ADVAPI32.dllRegQueryValueExW
ADVAPI32.dllRegSetValueExW
ADVAPI32.dllRegCreateKeyExW
ADVAPI32.dllRegCloseKey
ADVAPI32.dllEventWrite
ADVAPI32.dllEventUnregister
COMCTL32.dll392
COMCTL32.dllImageList_Add
COMCTL32.dllImageList_Create
COMCTL32.dll413
COMCTL32.dll410
COMCTL32.dllImageList_Destroy
GDI32.dllCreateCompatibleBitmap
GDI32.dllCreateCompatibleDC
GDI32.dllEqualRgn
GDI32.dllCombineRgn
GDI32.dllSetRectRgn
GDI32.dllCreateRectRgnIndirect
GDI32.dllCreateRectRgn
GDI32.dllCreatePatternBrush
GDI32.dllSetTextColor
GDI32.dllSetBkMode
GDI32.dllGetStockObject
GDI32.dllSetBkColor
GDI32.dllDeleteObject
GDI32.dllExtCreatePen
GDI32.dllMoveToEx
GDI32.dllLineTo
GDI32.dllCreateSolidBrush
GDI32.dllGetTextMetricsW
GDI32.dllGetTextExtentPoint32W
GDI32.dllGetRgnBox
GDI32.dllGetTextExtentPointW
GDI32.dllCreateBrushIndirect
GDI32.dllGetObjectW
GDI32.dllSelectObject
GDI32.dllCreateFontIndirectW
GDI32.dllGetDeviceCaps
GDI32.dllDeleteDC
GDI32.dllBitBlt
GDI32.dllCreateDIBSection
gdiplus.dllGdipCreateBitmapFromScan0
gdiplus.dllGdipCreateHBITMAPFromBitmap
gdiplus.dllGdipCreateSolidFill
gdiplus.dllGdipGetImageGraphicsContext
gdiplus.dllGdipSetInterpolationMode
gdiplus.dllGdipSetSmoothingMode
gdiplus.dllGdipSetPageUnit
gdiplus.dllGdipDrawLineI
gdiplus.dllGdipDrawArcI
gdiplus.dllGdipFillRectangleI
gdiplus.dllGdipCloneBrush
gdiplus.dllGdipDisposeImage
gdiplus.dllGdipCreateBitmapFromHBITMAP
gdiplus.dllGdipCreateBitmapFromResource
gdiplus.dllGdipCreateFromHDC
gdiplus.dllGdipDrawImageRectI
gdiplus.dllGdipCloneBitmapAreaI
gdiplus.dllGdipCreatePen1
gdiplus.dllGdipDeleteBrush
gdiplus.dllGdipAlloc
gdiplus.dllGdipFree
gdiplus.dllGdiplusStartup
gdiplus.dllGdiplusShutdown
gdiplus.dllGdipCloneImage
gdiplus.dllGdipDeletePen
gdiplus.dllGdipDeleteGraphics
msvcrt.dll_strtoi64
msvcrt.dll_strtoui64
msvcrt.dll_wcsdup
msvcrt.dll_i64tow_s
msvcrt.dll_wtoi64
msvcrt.dllwcstoul
msvcrt.dllisalpha
msvcrt.dlltime
msvcrt.dlldifftime
msvcrt.dllmemmove
msvcrt.dll_callnewh
msvcrt.dll__pctype_func
msvcrt.dll___lc_codepage_func
msvcrt.dll___lc_handle_func
msvcrt.dll_errno
msvcrt.dll___mb_cur_max_func
msvcrt.dllsetlocale
msvcrt.dll__crtGetStringTypeW
msvcrt.dll__crtLCMapStringW
msvcrt.dll__mb_cur_max
msvcrt.dlltolower
msvcrt.dllisspace
msvcrt.dllabort
msvcrt.dllisalnum
msvcrt.dll__getmainargs
msvcrt.dll_cexit
msvcrt.dll_exit
msvcrt.dllsprintf_s
msvcrt.dll_ismbblead
msvcrt.dllexit
msvcrt.dll_acmdln
msvcrt.dll_initterm
msvcrt.dll_amsg_exit
msvcrt.dll__setusermatherr
msvcrt.dll__p__commode
msvcrt.dll__p__fmode
msvcrt.dll__set_app_type
msvcrt.dllpublic: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll_unlock
msvcrt.dll__dllonexit
msvcrt.dll_lock
msvcrt.dll_onexit
msvcrt.dllvoid __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll__uncaught_exception
msvcrt.dll_except_handler4_common
msvcrt.dll_controlfp
msvcrt.dllmalloc
msvcrt.dll_purecall
msvcrt.dllfree
msvcrt.dllpublic: __thiscall exception::exception(void)

??0exception@@QAE@XZ

msvcrt.dll_CxxThrowException
msvcrt.dllpublic: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dllpublic: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dllpublic: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dllpublic: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

msvcrt.dllmemmove_s
msvcrt.dllmemcpy_s
msvcrt.dll__CxxFrameHandler3
msvcrt.dllstrcspn
msvcrt.dllmemchr
msvcrt.dlllocaleconv
msvcrt.dllpublic: virtual __thiscall bad_cast::~bad_cast(void)

??1bad_cast@@UAE@XZ

msvcrt.dllpublic: __thiscall bad_cast::bad_cast(class bad_cast const &)

??0bad_cast@@QAE@ABV0@@Z

msvcrt.dlliswalpha
msvcrt.dll_wcslwr_s
msvcrt.dlliswdigit
msvcrt.dll_wcsnicmp
msvcrt.dllwcsncmp
msvcrt.dll_itow_s
msvcrt.dll_wtoi
msvcrt.dll_itoa
msvcrt.dllcalloc
msvcrt.dllwcschr
msvcrt.dll_wcsicmp
msvcrt.dll_vsnwprintf
msvcrt.dllmemcpy
msvcrt.dllwcsncpy_s
msvcrt.dllwcstol
msvcrt.dllwcscpy_s
msvcrt.dllmbstowcs_s
msvcrt.dlltoupper
msvcrt.dllisxdigit
msvcrt.dllisdigit
msvcrt.dll_ftol2_sse
msvcrt.dllmemset
msvcrt.dll_XcptFilter
msvcrt.dll_ftol2
msvcrt.dll_wcsrev
ntdll.dllWinSqmAddToStream
ole32.dllCoCreateInstance
ole32.dllCoInitialize
ole32.dllCoUninitialize
OLEAUT32.dll150
OLEAUT32.dll7
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll6
OLEAUT32.dll2
RPCRT4.dllUuidCreate
RPCRT4.dllUuidToStringW
SHELL32.dll165
SHELL32.dllSHGetSpecialFolderPathW
SHLWAPI.dll225
USER32.dllOpenClipboard
USER32.dllDefWindowProcW
USER32.dllPostQuitMessage
USER32.dllGetFocus
USER32.dllDispatchMessageW
USER32.dllTranslateMessage
USER32.dllTranslateAcceleratorW
USER32.dllGetMessageW
USER32.dllSetWindowPlacement
USER32.dllRegisterClassExW
USER32.dllLoadCursorW
USER32.dllLoadIconW
USER32.dllDrawTextW
USER32.dllReleaseDC
USER32.dllGetDC
USER32.dllGetSystemMetrics
USER32.dllEnumChildWindows
USER32.dllSetPropW
USER32.dllSystemParametersInfoW
USER32.dllCheckRadioButton
USER32.dllSendDlgItemMessageW
USER32.dllSetCursor
USER32.dllMoveWindow
USER32.dllGetDlgItemInt
USER32.dllSetDlgItemInt
USER32.dllFillRect
USER32.dllIsDlgButtonChecked
USER32.dllDrawFocusRect
USER32.dllGetNextDlgTabItem
USER32.dllOffsetRect
USER32.dllGetWindowPlacement
USER32.dllGetMonitorInfoW
USER32.dllMonitorFromWindow
USER32.dllCopyRect
USER32.dllIntersectRect
USER32.dllEnumDisplayMonitors
USER32.dllEqualRect
USER32.dllMonitorFromRect
USER32.dllGetClassWord
USER32.dllEnumDesktopWindows
USER32.dllEmptyClipboard
USER32.dllSetClipboardData
USER32.dllCloseClipboard
USER32.dllGetClipboardData
USER32.dllPostMessageW
USER32.dllGetWindowTextW
USER32.dllIsWindowEnabled
USER32.dllSetWindowLongW
USER32.dllGetClassLongW
USER32.dllSetClassLongW
USER32.dllGetSysColor
USER32.dllEnableMenuItem
USER32.dllCheckMenuRadioItem
USER32.dllGetMenu
USER32.dllCheckMenuItem
USER32.dllLoadStringW
USER32.dllGetWindowTextLengthW
USER32.dllInvalidateRect
USER32.dllUpdateWindow
USER32.dllEnableWindow
USER32.dllGetWindowLongW
USER32.dllSetWindowTextW
USER32.dllCreateDialogParamW
USER32.dllDestroyWindow
USER32.dllMapWindowPoints
USER32.dllGetClassNameW
USER32.dllGetKeyState
USER32.dllSetFocus
USER32.dllIsDialogMessageW
USER32.dllLoadAcceleratorsW
USER32.dllCharNextA
USER32.dllGetParent
USER32.dllGetClientRect
USER32.dllShowWindow
USER32.dllCreateWindowExW
USER32.dllDialogBoxParamW
USER32.dllEndDialog
USER32.dllGetDlgItem
USER32.dllGetWindowRect
USER32.dllSetWindowPos
USER32.dllSendMessageW
USER32.dllLoadImageW
USER32.dllUnregisterClassA
USER32.dllMessageBeep
WINMM.dlltimeGetTime

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Calculator
FileVersion6.1.6801.0 (winmain_win7m3.080913-2030)
InternalNameCALC
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCALC.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.6801.0

VS_FIXEDFILEINFO

FileVersion6.1.6801.0
ProductVersion6.1.6801.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0692224EXE09/14/2008 07:28:52#
15c115HTM#
51e847465PNG(529 x 476)#
53bb04086PNG(190 x 50)#
54ba84234PNG(385 x 50)#
55c344625PNG(190 x 139)#
56e484873PNG(385 x 139)#
581543048PNG(190 x 50)#
58d3c3052PNG(385 x 50)#
599283217PNG(190 x 139)#
5a5bc3338PNG(385 x 139)#
5b2c84191PNG(116 x 27)#
5c3284229PNG(116 x 27)#
5d3b04110PNG(116 x 16)#
5e3c04065PNG(116 x 16)#
5f3a43235PNG(16 x 14)#
60048470PNG(16 x 17)#
60220587PNG(16 x 16)#
6046c518PNG(16 x 17)#
606745344PNG(136 x 27)#
61b544154PNG(136 x 27)#
62b904815PNG(136 x 59)#
63e606038PNG(292 x 27)#
655f84290PNG(136 x 27)#
666bc4815PNG(136 x 59)#
6798c4550PNG(264 x 27)#
68b541545PNG(136 x 27)#
691601518PNG(325 x 63)#
69750853PNG(73 x 93)#
69aa8593PNG(190 x 27)#
69cfc3398PNG(245 x 242)#
6aa443605PNG(245 x 342)#
6b85c3508PNG(330 x 242)#
6c6103761PNG(330 x 342)#
73b7860175PNG(256 x 256)#
8887060175PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x280