filenameslljcdlve.exe
size227840 (0x37a00)
md5742cc24d8775e0318fcb136bb40e446e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
004
19807886
1884447
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x53eb7e3b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.12
SizeOfCode0x2400
SizeOfInitializedData0x35200
SizeOfUninitializedData0
AddressOfEntryPoint0x14b9
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x3b000
SizeOfHeaders0x400
CheckSum0x38ee5
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig2(h)

Sections

namevavsizeraw sizeflags
.text0x10000x222e0x2400R-X CODE
.rdata0x40000xc0c0xe00R-- IDATA
.data0x50000x13080x1200RW- IDATA
.rsrc0x70000x3313c0x33200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x45b80xb4
RESOURCE0x70000x3313c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x118
Delay_IAT00
CLR_Header00
typenamesizecp
POPKAL#3211413121252
ICON#50676240
GROUP_ICON䅍义䍉乏200
module_namehintordfunction_name
user32.dll509SendMessageA
user32.dll500ScreenToClient
user32.dll493ReleaseCapture
user32.dll481RegisterClassExA
user32.dll469PostQuitMessage
user32.dll446MoveWindow
user32.dll433MessageBoxA
user32.dll408LoadIconA
user32.dll404LoadCursorA
user32.dll402LoadBitmapA
user32.dll518SetCapture
user32.dll338GetWindowLongA
user32.dll323GetSystemMetrics
user32.dll290GetMessageA
user32.dll276GetMenu
user32.dll265GetKeyState
user32.dll244GetCursorPos
user32.dll147DispatchMessageA
user32.dll131DefWindowProcA
user32.dll86CreateWindowExA
user32.dll568SetWindowLongA
user32.dll584ShowWindow
user32.dll606TranslateMessage
user32.dll618UpdateWindow
user32.dll573SetWindowTextA
user32.dll343GetWindowRect
user32.dll57ClipCursor
user32.dll52CheckMenuRadioItem
gdi32.dll75DeleteObject
gdi32.dll47CreateFontIndirectA
kernel32.dll791lstrcpynA
kernel32.dll789lstrcpyA
kernel32.dll787lstrcmpiA
kernel32.dll783lstrcatA
kernel32.dll793lstrlenA
kernel32.dll695Sleep
kernel32.dll694SizeofResource
kernel32.dll509LockResource
kernel32.dll495LoadResource
kernel32.dll490LoadLibraryA
kernel32.dll339GetProcAddress
kernel32.dll306GetModuleFileNameA
kernel32.dll192FindResourceA
kernel32.dll79CreateProcessA
kernel32.dll155ExitProcess
kernel32.dll163FileTimeToLocalFileTime
kernel32.dll164FileTimeToSystemTime
kernel32.dll173FindClose
kernel32.dll177FindFirstFileA
kernel32.dll186FindNextFileA
kernel32.dll254GetCurrentDirectoryA
kernel32.dll308GetModuleHandleA
comctl32.dll50ImageList_Destroy
comctl32.dll84InitCommonControls
comctl32.dll44ImageList_Add
comctl32.dll49ImageList_Create
imagehlp.dll35SearchTreeForFile
shell32.dll150SHGetPathFromIDListA
shell32.dll136SHGetFileInfoA
shell32.dll91SHBrowseForFolderA
oleaut32.dll85SysAllocStringByteLen
ole32.dll96CoTaskMemFree
offsetsizetypecomment
0227840EXE08/13/2014 15:03:23#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK