filenamefile.ecr
size456192 (0x6f600)
md56ab1f062e35c8eacb03d918a05af7165
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
11804737
19812497
1084
1052067139
954035136
15307752
198078143
188444134
699111251
62090107

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x530aa1de
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion10.0
SizeOfCode0x1c00
SizeOfInitializedData0x6d600
SizeOfUninitializedData0
AddressOfEntryPoint0x29f5
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x72000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x105000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x1b000
SizeOfHeapCommit0x6000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x1b810x1c00R-X CODE
.rdata0x30000x7240x800R-- IDATA
.data0x40000x6c4b80x6c600RW- IDATA
.reloc0x710000x67c0x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x30000x64
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x710000x67c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x30640x120
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
MSVCRT.dll587_wexecvpe
MSVCRT.dll503_spawnve
MSVCRT.dll110__crtLCMapStringA
MSVCRT.dll668exit
MSVCRT.dll115__getmainargs
MSVCRT.dll139__p__fmode
MSVCRT.dll159__set_app_type
MSVCRT.dll233_daylight
MSVCRT.dll424_mbsninc
MSVCRT.dll497_sopen
MSVCRT.dll718iswalnum
MSVCRT.dll705gmtime
MSVCRT.dll682fopen
MSVCRT.dll189_adjust_fdiv
MSVCRT.dll134__p__commode
MSVCRT.dll253_exit
MSVCRT.dll322_initterm
MSVCRT.dll244_except_handler3
MSVCRT.dll161__setusermatherr
MSVCRT.dll458_purecall
MSVCRT.dll175_acmdln
MSVCRT.dll239_endthreadex
MSVCRT.dll221_controlfp
MSVCRT.dll265_findclose
MSVCRT.dll80_XcptFilter
OLEPRO32.dll6OleTranslateColor
OLEPRO32.dll2OleCreatePropertyFrame
GDI32.dll84DeleteObject
GDI32.dll152EqualRgn
GDI32.dll464SelectObject
GDI32.dll78CreateSolidBrush
KERNEL32.dll440HeapAlloc
KERNEL32.dll292GetFileAttributesA
KERNEL32.dll662SetEvent
KERNEL32.dll414GlobalAddAtomA
KERNEL32.dll815lstrcmpA
KERNEL32.dll403GetVersionExA
KERNEL32.dll693SetThreadAffinityMask
KERNEL32.dll668SetFilePointerEx
KERNEL32.dll272GetCurrentThreadId
KERNEL32.dll395GetTimeFormatA
KERNEL32.dll394GetTickCount
KERNEL32.dll552Process32FirstW
KERNEL32.dll404GetVersionExW
KERNEL32.dll663SetFileApisToANSI
KERNEL32.dll60CreateHardLinkA
KERNEL32.dll168FindFirstFileExA
KERNEL32.dll810_lwrite
KERNEL32.dll345GetProcessHeap
KERNEL32.dll350GetProcessTimes
KERNEL32.dll827lstrlenA
KERNEL32.dll318GetModuleHandleA
KERNEL32.dll561QueryPerformanceCounter
KERNEL32.dll52CreateEventA
KERNEL32.dll600ResetEvent
KERNEL32.dll799WriteProfileSectionW
KERNEL32.dll376GetSystemTime
KERNEL32.dll291GetExitCodeThread
KERNEL32.dll527OpenEventW
KERNEL32.dll269GetCurrentProcess
KERNEL32.dll363GetStartupInfoW
KERNEL32.dll446HeapFree
KERNEL32.dll406GetVolumeInformationW
KERNEL32.dll319GetModuleHandleW
KERNEL32.dll721TerminateProcess
KERNEL32.dll756VirtualAlloc
KERNEL32.dll30CloseHandle
KERNEL32.dll362GetStartupInfoA
offsetsizetypecomment
0456192EXE02/24/2014 01:35:26#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK