3021621.exe

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	3021621.exe
size	102400 (0x19000)
md5	80fdce8ae097aecf78f1b97ccefd22bd

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
123	50727	2
125	50727	1
109	50727	21
93	4035	9
1	0	56
110	50727	3
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x50effc34
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x1000
SizeOfInitializedData	0x17000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x15e1
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x19000
SizeOfHeaders	0x1000
CheckSum	0x204a3
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xb18	0x1000	R-X CODE
.rdata	0x2000	0x848	0x1000	R-- IDATA
.data	0x3000	0x39c	0x1000	RW- IDATA
.po2	0x4000	0x11	0x1000	RW- IDATA
.rsrc	0x5000	0x13834	0x14000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x22bc	0x78
RESOURCE	0x5000	0x13834
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x2110	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x2180	0x40
Bound_IAT	0	0
IAT	0x2000	0xf4
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
BITMAP	#132	78332	1252
ICON	#1	744	1252
STRING	#9	110	1252
GROUP_ICON	#132	20	1252
MANIFEST	#1	340	1252

id	lang	string
130	1033	457 8s6564 dslk dsfe390 *(D
131	1033	Mdlskue cdsa

module_name	hint	function_name
KERNEL32.dll	425	GetProcessShutdownParameters
KERNEL32.dll	648	OpenSemaphoreA
KERNEL32.dll	479	GetTickCount
KERNEL32.dll	369	GetLastError
KERNEL32.dll	79	CreateEventA
KERNEL32.dll	600	LocalAlloc
KERNEL32.dll	427	GetProcessVersion
KERNEL32.dll	381	GetModuleFileNameA
KERNEL32.dll	878	UnhandledExceptionFilter
KERNEL32.dll	322	GetCurrentProcess
KERNEL32.dll	862	TerminateProcess
KERNEL32.dll	458	GetSystemTimeAsFileTime
KERNEL32.dll	383	GetModuleHandleA
KERNEL32.dll	409	GetPrivateProfileSectionNamesA
KERNEL32.dll	323	GetCurrentProcessId
KERNEL32.dll	326	GetCurrentThreadId
KERNEL32.dll	675	QueryPerformanceCounter
KERNEL32.dll	842	SetUnhandledExceptionFilter
KERNEL32.dll	439	GetStartupInfoA
KERNEL32.dll	550	InterlockedCompareExchange
KERNEL32.dll	854	Sleep
KERNEL32.dll	553	InterlockedExchange
KERNEL32.dll	569	IsDebuggerPresent
USER32.dll	96	CreateWindowExA
USER32.dll	45	CharPrevA
USER32.dll	7	AnyPopup
ADVAPI32.dll	61	CloseEventLog
SHELL32.dll	36	DragQueryPoint
MSVCR80.dll	1244	exit
MSVCR80.dll	261	_acmdln
MSVCR80.dll	528	_initterm
MSVCR80.dll	529	_initterm_e
MSVCR80.dll	561	_ismbblead
MSVCR80.dll	235	__setusermatherr
MSVCR80.dll	275	_adjust_fdiv
MSVCR80.dll	206	__p__commode
MSVCR80.dll	210	__p__fmode
MSVCR80.dll	370	_encode_pointer
MSVCR80.dll	232	__set_app_type
MSVCR80.dll	67	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR80.dll	1011	_unlock
MSVCR80.dll	153	__dllonexit
MSVCR80.dll	642	_lock
MSVCR80.dll	808	_onexit
MSVCR80.dll	360	_decode_pointer
MSVCR80.dll	379	_except_handler4_common
MSVCR80.dll	535	_invoke_watson
MSVCR80.dll	327	_controlfp_s
MSVCR80.dll	339	_crt_debugger_hook
MSVCR80.dll	105	_XcptFilter
MSVCR80.dll	388	_exit
MSVCR80.dll	308	_cexit
MSVCR80.dll	162	__getmainargs
MSVCR80.dll	285	_amsg_exit
MSVCR80.dll	779	_mbsstr
MSVCR80.dll	324	_configthreadlocale

show previews

offset	size	type	comment
0	102400	EXE	01/11/2013 11:49:08	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK