filenames1404.exe
size794624 (0xc2000)
md5764c9db67ee35531d30351e6090790ea
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
95307740
15307714
96307714
9321797
1084
10030771
9430521
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x534c1ed6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x29000
SizeOfInitializedData0xa8000
SizeOfUninitializedData0
AddressOfEntryPoint0x1f9f
BaseOfCode0x1000
BaseOfData0x2a000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xd2000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x287bc0x29000R-X CODE
.rdata0x2a0000x6a1e0x7000R-- IDATA
.data0x310000x55c980x46000RW- IDATA
.rsrc0x870000x4a0a00x4b000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x303480x50
RESOURCE0x870000x4a0a0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x2a1600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x2fdb00x48
Bound_IAT00
IAT0x2a0000x158
Delay_IAT00
CLR_Header00
typenamesizecp
BINARES#992833180
ICON#196400
ICON#242640
ICON#311280
DIALOGCORNER1920
DIALOGDUCK2820
DIALOGGIRL2900
DIALOGHOLE2240
DIALOGMEAN2320
DIALOGPIECE3080
DIALOGPRETTY2740
DIALOGSHIP1980
DIALOGSUFFIX2500
DIALOGWRITE3200
DIALOGYOU3000
GROUP_ICON#201480
VERSION#18520
module_namehintordfunction_name
OLEAUT32.dll422
OLEAUT32.dll424
OLEAUT32.dll200
OLEAUT32.dll418
OLEAUT32.dll417
OLEAUT32.dll420
OLEAUT32.dll201
OLEAUT32.dll415
OLEAUT32.dll416
OLEAUT32.dll419
OLEAUT32.dll421
OLEAUT32.dll402
OLEAUT32.dll401
OLEAUT32.dll423
OLEAUT32.dll202
sisbkup.dll61SisRestoredLink
sisbkup.dll62SisFreeAllocatedMemory
sisbkup.dll24SisCreateRestoreStructure
sisbkup.dll11SisCSFilesToBackupForLink
sisbkup.dll18SisFreeRestoreStructure
sisbkup.dll43SisRestoredCommonStoreFile
KERNEL32.dll863TerminateProcess
KERNEL32.dll516GetSystemInfo
KERNEL32.dll395GetLocaleInfoA
KERNEL32.dll522GetStringTypeW
KERNEL32.dll480GetStringTypeA
KERNEL32.dll572LCMapStringW
KERNEL32.dll654MultiByteToWideChar
KERNEL32.dll632LCMapStringA
KERNEL32.dll516GetSystemTimeAsFileTime
KERNEL32.dll324GetCurrentProcessId
KERNEL32.dll415GetCurrentThreadId
KERNEL32.dll547GetTickCount
KERNEL32.dll695QueryPerformanceCounter
KERNEL32.dll591IsBadCodePtr
KERNEL32.dll620IsBadReadPtr
KERNEL32.dll983VirtualQuery
KERNEL32.dll617InterlockedExchange
KERNEL32.dll346GetCPInfo
KERNEL32.dll454GetOEMCP
KERNEL32.dll322GetACP
KERNEL32.dll662LoadLibraryA
KERNEL32.dll600HeapSize
KERNEL32.dll153CreateFileA
KERNEL32.dll443GetNativeSystemInfo
KERNEL32.dll425GetProcessHeap
KERNEL32.dll149CreateProcessA
KERNEL32.dll675PrepareTape
KERNEL32.dll435GetLocalTime
KERNEL32.dll261FindNextChangeNotification
KERNEL32.dll291FindFirstChangeNotificationA
KERNEL32.dll942VirtualProtect
KERNEL32.dll48CloseHandle
KERNEL32.dll438GetModuleHandleA
KERNEL32.dll526GetStartupInfoA
KERNEL32.dll353GetCommandLineA
KERNEL32.dll571GetVersionExA
KERNEL32.dll718RtlUnwind
KERNEL32.dll675RaiseException
KERNEL32.dll522HeapAlloc
KERNEL32.dll587HeapFree
KERNEL32.dll268ExitProcess
KERNEL32.dll502GetProcAddress
KERNEL32.dll345GetCurrentProcess
KERNEL32.dll933WriteFile
KERNEL32.dll498GetStdHandle
KERNEL32.dll437GetModuleFileNameA
KERNEL32.dll883UnhandledExceptionFilter
KERNEL32.dll239FreeEnvironmentStringsA
KERNEL32.dll375GetEnvironmentStrings
KERNEL32.dll335FreeEnvironmentStringsW
KERNEL32.dll948WideCharToMultiByte
KERNEL32.dll446GetLastError
KERNEL32.dll415GetEnvironmentStringsW
KERNEL32.dll795SetHandleCount
KERNEL32.dll446GetFileType
KERNEL32.dll539HeapDestroy
KERNEL32.dll557HeapCreate
KERNEL32.dll924VirtualFree
KERNEL32.dll903SetUnhandledExceptionFilter
KERNEL32.dll917VirtualAlloc
KERNEL32.dll555HeapReAlloc
KERNEL32.dll604IsBadWritePtr

StringTable 000004E4

CompanyNameAlternative Technology Solutions
FileDescriptionSubtractmultiply
FileVersion15.5.302.464
InternalNameSubtractmultiply
LegalCopyright© 2006, Alternative Technology Solutions
LegalTrademarksSubtractmultiply®
ProductNameSubtractmultiply
ProductVersion15.5.302.464

VS_FIXEDFILEINFO

FileVersion15.5.302.464
ProductVersion15.5.302.464
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0794624EXE04/14/2014 17:45:58#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK