filename5ffd4c5e1766196ac1cbd799de829812757684f4432f1b8de59054890997c30d
size68096 (0x10a00)
md57d419cd096fec8bcf945e00e70a9bc41
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
93403521
10115
109507279
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x51cf61fa
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x6000
SizeOfInitializedData0xa600
SizeOfUninitializedData0
AddressOfEntryPoint0x3af0
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0x13675
Subsystem2
DllCharacteristics0x400
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

FASM v1.5x

Sections

namevavsizeraw sizeflags
.text0x10000x5fde0x6000RWX CODE
.data0x70000x31100x2600RW- IDATA
.rsrc0xb0000x751c0x7600R-- IDATA
.reloc0x130000x9620xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x64fc0xdc
RESOURCE0xb0000x751c
EXCEPTION00
SECURITY00
BASERELOC0x130000x86c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x1f4
Delay_IAT00
CLR_Header00
typenamesizecp
ICON1298851252
module_namehintordfunction_name
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll932WriteFile
KERNEL32.dll795SetFilePointer
KERNEL32.dll862TerminateProcess
KERNEL32.dll646OpenProcess
KERNEL32.dll489GetVersionExA
KERNEL32.dll453GetSystemInfo
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll664Process32Next
KERNEL32.dll957lstrcatA
KERNEL32.dll534HeapFree
KERNEL32.dll528HeapAlloc
KERNEL32.dll662Process32First
KERNEL32.dll114CreateToolhelp32Snapshot
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll131DeleteFileA
KERNEL32.dll276GetComputerNameA
KERNEL32.dll790SetEvent
KERNEL32.dll854Sleep
KERNEL32.dll912WaitForSingleObject
KERNEL32.dll973lstrlenW
KERNEL32.dll132DeleteFileW
KERNEL32.dll70CopyFileW
KERNEL32.dll78CreateDirectoryW
KERNEL32.dll79CreateEventA
KERNEL32.dll900VirtualFreeEx
KERNEL32.dll941WriteProcessMemory
KERNEL32.dll898VirtualAllocEx
KERNEL32.dll972lstrlenA
KERNEL32.dll185ExitProcess
KERNEL32.dll106CreateRemoteThread
KERNEL32.dll147DuplicateHandle
KERNEL32.dll105CreateProcessW
KERNEL32.dll427GetProcessVersion
KERNEL32.dll111CreateThread
KERNEL32.dll616MapViewOfFile
KERNEL32.dll84CreateFileMappingA
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll904VirtualQuery
KERNEL32.dll967lstrcpyW
KERNEL32.dll382GetModuleFileNameW
KERNEL32.dll958lstrcatW
KERNEL32.dll419GetProcessHeap
KERNEL32.dll323GetCurrentProcessId
KERNEL32.dll96CreateMutexA
KERNEL32.dll272GetCommandLineA
KERNEL32.dll696ReadProcessMemory
KERNEL32.dll905VirtualQueryEx
KERNEL32.dll960lstrcmpA
KERNEL32.dll963lstrcmpiA
KERNEL32.dll613LockResource
KERNEL32.dll599LoadResource
KERNEL32.dll853SizeofResource
KERNEL32.dll227FindResourceA
KERNEL32.dll320GetCurrentDirectoryA
KERNEL32.dll863TerminateThread
KERNEL32.dll86CreateFileW
KERNEL32.dll722ResumeThread
KERNEL32.dll856SuspendThread
KERNEL32.dll899VirtualFree
KERNEL32.dll808SetLastError
KERNEL32.dll83CreateFileA
KERNEL32.dll369GetLastError
KERNEL32.dll355GetFileSize
KERNEL32.dll897VirtualAlloc
KERNEL32.dll693ReadFile
KERNEL32.dll594LoadLibraryA
KERNEL32.dll416GetProcAddress
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll52CloseHandle
KERNEL32.dll966lstrcpyA
KERNEL32.dll563IsBadReadPtr
KERNEL32.dll479GetTickCount
USER32.dll96CreateWindowExA
USER32.dll314GetMessageA
USER32.dll682TranslateMessage
USER32.dll161DispatchMessageA
USER32.dll535RegisterClassExA
USER32.dll349GetSystemMetrics
USER32.dll650SetWindowsHookExA
USER32.dll727wsprintfA
USER32.dll728wsprintfW
USER32.dll142DefWindowProcA
ADVAPI32.dll428OpenProcessToken
ADVAPI32.dll28AdjustTokenPrivileges
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll516RegSetValueExA
ADVAPI32.dll492RegOpenKeyExA
ADVAPI32.dll503RegQueryValueExA
ADVAPI32.dll472RegDeleteValueA
ADVAPI32.dll292GetUserNameA
ADVAPI32.dll465RegCreateKeyExA
ADVAPI32.dll517RegSetValueExW
ADVAPI32.dll489RegNotifyChangeKeyValue
ADVAPI32.dll468RegDeleteKeyA
ADVAPI32.dll335LookupPrivilegeValueA
SHELL32.dll178SHGetFolderPathW
ole32.dll15CoCreateGuid
SHLWAPI.dll271StrStrA
SHLWAPI.dll237StrCmpNIA
WININET.dll89HttpSendRequestA
WININET.dll105InternetCloseHandle
WININET.dll85HttpOpenRequestA
WININET.dll146InternetOpenA
WININET.dll132InternetGetCookieA
WININET.dll154InternetReadFile
WININET.dll147InternetOpenUrlA
WININET.dll111InternetConnectA
urlmon.dll60ObtainUserAgentString
WS2_32.dll57
WS2_32.dll12
WS2_32.dll52
RPCRT4.dll497UuidToStringA
offsetsizetypecomment
068096EXE06/29/2013 22:38:50#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER