Resume_LinkedIn.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	Resume_LinkedIn.exe
size	19456 (0x4c00)
md5	62f4a3dfe059e9030e2450d608c82899

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc8

Rich Header

lib id	version	times used
1	0	45
147	30729	7
171	30319	7
154	30319	1
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x52690740
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x2c00
SizeOfInitializedData	0x1c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3160
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x300000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x6000
SizeOfHeaders	0x400
CheckSum	0x4ca0
Subsystem	2
DllCharacteristics	0x8500
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2a62	0x2c00	RWX CODE
.rsrc	0x4000	0x1ac4	0x1c00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3638	0x50
RESOURCE	0x4000	0x1ac4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1000	0xc0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
PNG	#106	2417	1252
ICON	#1	3752	1252
GROUP_ICON	#122	20	1252
MANIFEST	#1	346	1252

module_name	hint	function_name
gdiplus.dll	54	GdipCloneImage
gdiplus.dll	629	GdiplusStartup
gdiplus.dll	628	GdiplusShutdown
gdiplus.dll	42	GdipBitmapGetPixel
gdiplus.dll	82	GdipCreateBitmapFromStreamICM
gdiplus.dll	81	GdipCreateBitmapFromStream
gdiplus.dll	290	GdipGetImageHeight
gdiplus.dll	300	GdipGetImageWidth
gdiplus.dll	152	GdipDisposeImage
gdiplus.dll	237	GdipFree
gdiplus.dll	33	GdipAlloc
KERNEL32.dll	719	HeapFree
KERNEL32.dll	331	FindResourceA
KERNEL32.dll	833	LoadResource
KERNEL32.dll	1201	SizeofResource
KERNEL32.dll	852	LockResource
KERNEL32.dll	586	GetProcessHeap
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	143	CreateFileW
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	1343	lstrcatW
KERNEL32.dll	906	OutputDebugStringW
KERNEL32.dll	354	FreeLibrary
KERNEL32.dll	448	GetCurrentProcess
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	831	LoadLibraryW
KERNEL32.dll	828	LoadLibraryA
USER32.dll	785	UpdateWindow
USER32.dll	735	ShowWindow
USER32.dll	110	CreateWindowExW
USER32.dll	589	RegisterClassExW
USER32.dll	491	LoadCursorW
USER32.dll	493	LoadIconW
USER32.dll	156	DefWindowProcW
USER32.dll	446	InvalidateRect
USER32.dll	567	PostQuitMessage
USER32.dll	636	SendMessageW
USER32.dll	349	GetMessageW
USER32.dll	821	wvsprintfW
USER32.dll	220	EndPaint
USER32.dll	246	FillRect
USER32.dll	276	GetClientRect
USER32.dll	14	BeginPaint
USER32.dll	175	DispatchMessageW

show previews

offset	size	type	comment
0	19456	EXE	10/24/2013 11:40:48	#
15c1	15	HTM		#
3138	2417	PNG	(34 x 34)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK