b_cr.exe - OwnDrawButton.exe

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	b_cr.exe
size	213504 (0x34200)
md5	752037eb06c5956b9b3aa14c8175b774

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
93	4035	6
14	7299	3
10	8047	11
4	8047	2
11	9782	3
4	9782	3
1	0	182
11	8168	7
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x53861131
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.0
SizeOfCode	0x4000
SizeOfInitializedData	0x2f000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x450f
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.2
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x34000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3a6e	0x4000	R-X CODE
.rdata	0x5000	0x15be	0x2000	R-- IDATA
.data	0x7000	0xe0d	0x1000	RW- IDATA
.rsrc	0x8000	0x2bb89	0x2c000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x5ed8	0x78
RESOURCE	0x8000	0x2bb88
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5000	0x29d
Delay_IAT	0x1020	0x7f
CLR_Header	0	0

show previews

type	name	size	cp	r
BITMAP	#1610612744	67108864	0	33555968
BITMAP	#0	0	4	65536
BITMAP	#16777216	68291868	34474517	17434384
BITMAP	#2013265920	0	4	393216
BITMAP	#0	3256540200	3419733719	1647064672
BITMAP	#128	3696418774	78388388	3612167341
BITMAP	#32896	1089213326	2426992468	38422802
ICON	#1	9640	1252	0
DIALOG	#102	474	1252	0
GROUP_ICON	#1	20	1252	0
VERSION	#1	840	1252	0
HTML	#89	167432	1252	0

module_name	hint	ord	function_name
MFC42.DLL		2055
MFC42.DLL		6376
MFC42.DLL		3749
MFC42.DLL		5065
MFC42.DLL		1727
MFC42.DLL		5261
MFC42.DLL		2446
MFC42.DLL		2124
MFC42.DLL		5277
MFC42.DLL		2982
MFC42.DLL		3147
MFC42.DLL		3259
MFC42.DLL		4465
MFC42.DLL		3136
MFC42.DLL		3262
MFC42.DLL		2985
MFC42.DLL		3081
MFC42.DLL		2976
MFC42.DLL		3402
MFC42.DLL		3830
MFC42.DLL		3831
MFC42.DLL		3825
MFC42.DLL		3079
MFC42.DLL		4080
MFC42.DLL		4627
MFC42.DLL		4424
MFC42.DLL		3574
MFC42.DLL		609
MFC42.DLL		540
MFC42.DLL		567
MFC42.DLL		825
MFC42.DLL		800
MFC42.DLL		4275
MFC42.DLL		4284
MFC42.DLL		3874
MFC42.DLL		2859
MFC42.DLL		2864
MFC42.DLL		2379
MFC42.DLL		5981
MFC42.DLL		3573
MFC42.DLL		3693
MFC42.DLL		3626
MFC42.DLL		3663
MFC42.DLL		2414
MFC42.DLL		5875
MFC42.DLL		5788
MFC42.DLL		5787
MFC42.DLL		1641
MFC42.DLL		4673
MFC42.DLL		4274
MFC42.DLL		6375
MFC42.DLL		4486
MFC42.DLL		2554
MFC42.DLL		2648
MFC42.DLL		5731
MFC42.DLL		3922
MFC42.DLL		1089
MFC42.DLL		5199
MFC42.DLL		2396
MFC42.DLL		3346
MFC42.DLL		5300
MFC42.DLL		5302
MFC42.DLL		2725
MFC42.DLL		4079
MFC42.DLL		4698
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		5714
MFC42.DLL		4622
MFC42.DLL		3738
MFC42.DLL		561
MFC42.DLL		815
MFC42.DLL		2514
MFC42.DLL		2621
MFC42.DLL		641
MFC42.DLL		823
MFC42.DLL		5265
MFC42.DLL		4376
MFC42.DLL		4853
MFC42.DLL		4998
MFC42.DLL		6052
MFC42.DLL		1775
MFC42.DLL		4407
MFC42.DLL		5280
MFC42.DLL		4425
MFC42.DLL		3597
MFC42.DLL		1146
MFC42.DLL		1168
MFC42.DLL		324
MFC42.DLL		2302
MFC42.DLL		4234
MFC42.DLL		4710
MFC42.DLL		755
MFC42.DLL		470
MFC42.DLL		1200
MFC42.DLL		3092
MFC42.DLL		2818
MFC42.DLL		3706
MFC42.DLL		3571
MFC42.DLL		640
MFC42.DLL		2405
MFC42.DLL		1640
MFC42.DLL		323
MFC42.DLL		4133
MFC42.DLL		4297
MFC42.DLL		2754
MFC42.DLL		4441
MFC42.DLL		4837
MFC42.DLL		3798
MFC42.DLL		5290
MFC42.DLL		4353
MFC42.DLL		6374
MFC42.DLL		5163
MFC42.DLL		2385
MFC42.DLL		5241
MFC42.DLL		4396
MFC42.DLL		1776
MFC42.DLL		4078
MFC42.DLL		6055
MFC42.DLL		2512
MFC42.DLL		2575
MFC42.DLL		1576
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	271		_initterm
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	106		__p__commode
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	183		_controlfp
MSVCRT.dll	585		exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	390		_onexit
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	670		printf
MSVCRT.dll	665		memset
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	588		fclose
MSVCRT.dll	605		fread
MSVCRT.dll	682		rewind
MSVCRT.dll	612		ftell
MSVCRT.dll	610		fseek
MSVCRT.dll	515		_wfopen
MSVCRT.dll	143		_acmdln
MSVCRT.dll	599		fopen
MSVCRT.dll	85		__dllonexit
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	382		GetModuleFileNameW
KERNEL32.dll	383		GetModuleHandleA
USER32.dll	446		LoadIconA
USER32.dll	571		SendMessageA
USER32.dll	182		DrawIcon
USER32.dll	349		GetSystemMetrics
USER32.dll	422		IsIconic
USER32.dll	268		GetDC
USER32.dll	620		SetRect
USER32.dll	440		LoadBitmapA
USER32.dll	278		GetFocus
USER32.dll	243		GetCapture
USER32.dll	524		PtInRect
USER32.dll	553		ReleaseCapture
USER32.dll	403		InvalidateRect
USER32.dll	580		SetCapture
USER32.dll	74		CopyRect
USER32.dll	366		GetWindowLongA
USER32.dll	196		EnableWindow
USER32.dll	346		GetSysColor
USER32.dll	727		wsprintfA
USER32.dll	479		MessageBoxA
USER32.dll	255		GetClientRect
GDI32.dll	502		Rectangle
GDI32.dll	45		CreateCompatibleDC
GDI32.dll	526		SelectObject
GDI32.dll	436		GetTextExtentPoint32A
GDI32.dll	71		CreatePen
GDI32.dll	513		RoundRect
GDI32.dll	80		CreateSolidBrush
GDI32.dll	476		PaintRgn
GDI32.dll	74		CreatePolygonRgn
GDI32.dll	18		BitBlt

StringTable 081404e3

Comments
CompanyName
FileDescription	OwnDrawButton
FileVersion	1, 0, 0, 1
InternalName	OwnDrawButton
LegalCopyright	Copyright ? 2014
LegalTrademarks
OriginalFilename	OwnDrawButton.exe
PrivateBuild
ProductName	OwnDrawButton
ProductVersion	1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	212992	EXE	05/28/2014 16:39:13	#
15c1	15	HTM		#
ad80	27999	JPG		#
34000	512	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 213504 bytes (209 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 33280 entries in directory, but got EOF on 22582-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 213504

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32785

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33040

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 32784

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 76744 entries in directory, but got EOF on 18478-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "\x06\xDB" followed by "An" on UTF-16LE

[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "W\xD8" followed by "\xF8{" on UTF-16LE

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 169889

[?] too many errors getting resource data, stopped on 18346 of 18478

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 98064

[?] too many errors getting resource data, stopped on 58 of 22582

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x60d0914

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x2e91b4c8

[?] can't find file_offset of VA 0xe00ac4e8

[?] can't find file_offset of VA 0x76be4e5f

b_cr.exe-