MZ Header

Rich Header

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

Signers (1)

issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte Code Signing CA
serial: 402827

Certificates (3)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  1 00:00:00 1996 GMT
            Not After : Dec 31 23:59:59 2020 GMT
        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:d2:36:36:6a:8b:d7:c2:5b:9e:da:81:41:62:8f:
                    38:ee:49:04:55:d6:d0:ef:1c:1b:95:16:47:ef:18:
                    48:35:3a:52:f4:2b:6a:06:8f:3b:2f:ea:56:e3:af:
                    86:8d:9e:17:f7:9e:b4:65:75:02:4d:ef:cb:09:a2:
                    21:51:d8:9b:d0:67:d0:ba:0d:92:06:14:73:d4:93:
                    cb:97:2a:00:9c:5c:4e:0c:bc:fa:15:52:fc:f2:44:
                    6e:da:11:4a:6e:08:9f:2f:2d:e3:f9:aa:3a:86:73:
                    b6:46:53:58:c8:89:05:bd:83:11:b8:73:3f:aa:07:
                    8d:f4:42:4d:e7:40:9d:1c:37
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: md5WithRSAEncryption
         26:48:2c:16:c2:58:fa:e8:16:74:0c:aa:aa:5f:54:3f:f2:d7:
         c9:78:60:5e:5e:6e:37:63:22:77:36:7e:b2:17:c4:34:b9:f5:
         08:85:fc:c9:01:38:ff:4d:be:f2:16:42:43:e7:bb:5a:46:fb:
         c1:c6:11:1f:f1:4a:b0:28:46:c9:c3:c4:42:7d:bc:fa:ab:59:
         6e:d5:b7:51:88:11:e3:a4:85:19:6b:82:4c:a4:0c:12:ad:e9:
         a4:ae:3f:f1:c3:49:65:9a:8c:c5:c8:3e:25:b7:94:99:bb:92:
         32:71:07:f0:86:5e:ed:50:27:a6:0d:a6:23:f9:bb:cb:a6:07:
         14:42

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10 (0xa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  6 00:00:00 2003 GMT
            Not After : Aug  5 23:59:59 2013 GMT
        Subject: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c6:b8:b9:27:60:af:0b:e3:91:69:65:db:7e:8d:
                    ed:91:e6:aa:f1:be:d5:ed:fe:6d:d4:2c:7f:d1:70:
                    77:fb:26:99:57:b4:dd:3f:30:b8:dc:21:ea:68:8d:
                    81:92:fc:2e:4b:91:35:84:20:f2:da:4a:ba:b4:fc:
                    e6:da:88:f2:20:c5:21:92:09:47:95:a0:09:1c:a6:
                    79:be:b1:4c:1d:fc:f1:8a:6e:54:d2:69:a1:f1:4c:
                    93:3a:41:fe:7d:d4:64:7b:63:45:f7:60:60:1d:31:
                    1d:a4:e9:d3:0f:8b:fb:6e:26:24:b3:a8:ff:e5:e5:
                    90:d4:b4:c2:dc:50:60:ae:59
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=PrivateLabel2-144
    Signature Algorithm: sha1WithRSAEncryption
         76:b2:9c:ee:13:9f:1b:f6:2d:34:92:94:45:73:34:dc:8e:6b:
         2e:5c:fc:4c:7d:89:eb:c3:68:f1:d7:99:0f:2e:1d:17:c8:b5:
         16:8b:be:cd:8a:05:06:f2:19:49:3a:03:5b:05:c9:20:8e:6d:
         52:e1:76:81:a0:c3:65:8a:22:67:e4:1c:53:53:37:46:bf:bc:
         d7:2f:eb:7b:9e:d0:14:45:6c:40:21:08:e2:5d:75:76:66:30:
         1e:f4:df:82:8a:2f:bd:f3:a2:0c:bf:1d:db:9f:14:a2:9a:72:
         37:4d:b0:77:48:e8:4a:3f:09:ce:55:19:2c:ef:e6:07:24:e1:
         af:ec

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4204583 (0x402827)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Validity
            Not Before: Nov  2 21:38:02 2005 GMT
            Not After : Nov  2 21:38:02 2006 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Mozilla Corporation, OU=Secure Application Development, CN=Mozilla Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:cb:53:ed:15:46:16:48:7e:dd:ba:6d:c0:51:8a:
                    e6:9a:10:af:c2:0d:c6:30:a0:72:d5:34:5b:97:cb:
                    58:81:56:80:84:27:71:2d:c5:cd:ae:ee:14:06:7b:
                    b1:d6:d2:8b:4d:22:f8:5d:7f:3e:39:5f:fb:fa:a9:
                    38:dc:f8:c0:76:2b:2b:75:7b:4a:8e:71:89:6c:fb:
                    b5:77:39:8b:42:b6:75:4a:b2:06:66:a0:d0:e7:fb:
                    90:cd:6f:55:f4:40:b6:e7:b6:f2:22:90:41:e5:a3:
                    ac:44:b5:0b:c7:17:c6:83:0e:df:c9:81:27:db:97:
                    ac:a6:5f:36:a5:0f:87:72:db
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            Netscape Cert Type: 
                Object Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            X509v3 Subject Alternative Name: 
                DNS:www.mozilla.com
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawteCodeSigningCA.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: md5WithRSAEncryption
         0e:b4:93:f1:a5:40:4d:fc:5b:8f:70:eb:69:e2:8e:e5:2a:0a:
         09:9e:56:2e:51:f1:26:49:23:42:5b:f7:71:0a:f2:05:a2:ba:
         eb:30:79:67:b1:ea:35:f5:5e:8b:78:b6:c2:1d:81:c8:6e:f6:
         86:ef:e9:f5:34:33:cb:67:0d:96:1a:43:ff:8e:10:80:f4:5e:
         c8:d9:83:be:97:6d:c2:00:ad:dd:d0:fe:0b:9d:73:47:cc:97:
         35:9f:ad:8c:7c:e4:cf:bf:b4:5f:3b:e3:0d:75:9f:39:72:03:
         05:c2:f6:c6:e9:c1:5c:6e:ff:55:87:66:18:40:db:19:22:23:
         e8:6f
pkcs7-signedData
  • 1
    • MD5: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • :
            00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
            00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |
        • MD5
          • 5c 6e 7b 48 34 7f 84 a8  d6 f5 10 f3 8a 9d a1 ab  |\n{H4...........|
    • Certificates
      • Certificate #0
        • 2
          • 1
          • RSA-MD5: nil
          • Issuer
            • C: ZA
            • ST: Western Cape
            • L: Cape Town
            • O: Thawte Consulting cc
            • OU: Certification Services Division
            • CN: Thawte Premium Server CA
            • emailAddress: premium-server@thawte.com
          • 1996-08-01 00:00:00 UTC: 2020-12-31 23:59:59 UTC
          • Subject
            • C: ZA
            • ST: Western Cape
            • L: Cape Town
            • O: Thawte Consulting cc
            • OU: Certification Services Division
            • CN: Thawte Premium Server CA
            • emailAddress: premium-server@thawte.com
          • #5
            • rsaEncryption: nil
            • D2:36:36:6A:8B:D7:C2:5B:9E:DA:81:41:62:8F:38:EE:
              49:04:55:D6:D0:EF:1C:1B:95:16:47:EF:18:48:35:3A:
              52:F4:2B:6A:06:8F:3B:2F:EA:56:E3:AF:86:8D:9E:17:
              F7:9E:B4:65:75:02:4D:EF:CB:09:A2:21:51:D8:9B:D0:
              67:D0:BA:0D:92:06:14:73:D4:93:CB:97:2A:00:9C:5C:
              4E:0C:BC:FA:15:52:FC:F2:44:6E:DA:11:4A:6E:08:9F:
              2F:2D:E3:F9:AA:3A:86:73:B6:46:53:58:C8:89:05:BD:
              83:11:B8:73:3F:AA:07:8D:F4:42:4D:E7:40:9D:1C:37
              : 0x010001
          • basicConstraints: true, true
        • RSA-MD5:
          26 48 2c 16 c2 58 fa e8  16 74 0c aa aa 5f 54 3f  |&H,..X...t..._T?|
          f2 d7 c9 78 60 5e 5e 6e  37 63 22 77 36 7e b2 17  |...x`^^n7c"w6~..|
          c4 34 b9 f5 08 85 fc c9  01 38 ff 4d be f2 16 42  |.4.......8.M...B|
          43 e7 bb 5a 46 fb c1 c6  11 1f f1 4a b0 28 46 c9  |C..ZF......J.(F.|
          c3 c4 42 7d bc fa ab 59  6e d5 b7 51 88 11 e3 a4  |..B}...Yn..Q....|
          85 19 6b 82 4c a4 0c 12  ad e9 a4 ae 3f f1 c3 49  |..k.L.......?..I|
          65 9a 8c c5 c8 3e 25 b7  94 99 bb 92 32 71 07 f0  |e....>%.....2q..|
          86 5e ed 50 27 a6 0d a6  23 f9 bb cb a6 07 14 42  |.^.P'...#......B|
      • Certificate #1
        • 2
          • 0x0A
          • RSA-SHA1: nil
          • Issuer
            • C: ZA
            • ST: Western Cape
            • L: Cape Town
            • O: Thawte Consulting cc
            • OU: Certification Services Division
            • CN: Thawte Premium Server CA
            • emailAddress: premium-server@thawte.com
          • 2003-08-06 00:00:00 UTC: 2013-08-05 23:59:59 UTC
          • Subject
            • C: ZA
            • O: Thawte Consulting (Pty) Ltd.
            • CN: Thawte Code Signing CA
          • #5
            • rsaEncryption: nil
            • C6:B8:B9:27:60:AF:0B:E3:91:69:65:DB:7E:8D:ED:91:
              E6:AA:F1:BE:D5:ED:FE:6D:D4:2C:7F:D1:70:77:FB:26:
              99:57:B4:DD:3F:30:B8:DC:21:EA:68:8D:81:92:FC:2E:
              4B:91:35:84:20:F2:DA:4A:BA:B4:FC:E6:DA:88:F2:20:
              C5:21:92:09:47:95:A0:09:1C:A6:79:BE:B1:4C:1D:FC:
              F1:8A:6E:54:D2:69:A1:F1:4C:93:3A:41:FE:7D:D4:64:
              7B:63:45:F7:60:60:1D:31:1D:A4:E9:D3:0F:8B:FB:6E:
              26:24:B3:A8:FF:E5:E5:90:D4:B4:C2:DC:50:60:AE:59
              : 0x010001
          • X509v3 extensions
            • basicConstraints
              • true
              • true: 0
            • crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
            • extendedKeyUsage
              • clientAuth: codeSigning
            • keyUsage: true, 6
            • subjectAltName
              • CN: PrivateLabel2-144
        • RSA-SHA1:
          76 b2 9c ee 13 9f 1b f6  2d 34 92 94 45 73 34 dc  |v.......-4..Es4.|
          8e 6b 2e 5c fc 4c 7d 89  eb c3 68 f1 d7 99 0f 2e  |.k.\.L}...h.....|
          1d 17 c8 b5 16 8b be cd  8a 05 06 f2 19 49 3a 03  |.............I:.|
          5b 05 c9 20 8e 6d 52 e1  76 81 a0 c3 65 8a 22 67  |[.. .mR.v...e."g|
          e4 1c 53 53 37 46 bf bc  d7 2f eb 7b 9e d0 14 45  |..SS7F.../.{...E|
          6c 40 21 08 e2 5d 75 76  66 30 1e f4 df 82 8a 2f  |l@!..]uvf0...../|
          bd f3 a2 0c bf 1d db 9f  14 a2 9a 72 37 4d b0 77  |...........r7M.w|
          48 e8 4a 3f 09 ce 55 19  2c ef e6 07 24 e1 af ec  |H.J?..U.,...$...|
      • Certificate #2
        • 2
          • 0x402827
          • RSA-MD5: nil
          • Issuer
            • C: ZA
            • O: Thawte Consulting (Pty) Ltd.
            • CN: Thawte Code Signing CA
          • 2005-11-02 21:38:02 UTC: 2006-11-02 21:38:02 UTC
          • Subject
            • C: US
            • ST: California
            • L: Mountain View
            • O: Mozilla Corporation
            • OU: Secure Application Development
            • CN: Mozilla Corporation
          • #5
            • rsaEncryption: nil
            • CB:53:ED:15:46:16:48:7E:DD:BA:6D:C0:51:8A:E6:9A:
              10:AF:C2:0D:C6:30:A0:72:D5:34:5B:97:CB:58:81:56:
              80:84:27:71:2D:C5:CD:AE:EE:14:06:7B:B1:D6:D2:8B:
              4D:22:F8:5D:7F:3E:39:5F:FB:FA:A9:38:DC:F8:C0:76:
              2B:2B:75:7B:4A:8E:71:89:6C:FB:B5:77:39:8B:42:B6:
              75:4A:B2:06:66:A0:D0:E7:FB:90:CD:6F:55:F4:40:B6:
              E7:B6:F2:22:90:41:E5:A3:AC:44:B5:0B:C7:17:C6:83:
              0E:DF:C9:81:27:DB:97:AC:A6:5F:36:A5:0F:87:72:DB
              : 0x010001
          • #6
            • extendedKeyUsage
              • codeSigning: msCodeCom
            • nsCertType: 0x10
            • 2.5.29.4
              • msCodeCom: 0x80
            • subjectAltName: www.mozilla.com
            • crlDistributionPoints: http://crl.thawte.com/ThawteCodeSigningCA.crl
            • authorityInfoAccess
              • OCSP: http://ocsp.thawte.com
            • basicConstraints
              • true
              • nil
        • RSA-MD5:
          0e b4 93 f1 a5 40 4d fc  5b 8f 70 eb 69 e2 8e e5  |.....@M.[.p.i...|
          2a 0a 09 9e 56 2e 51 f1  26 49 23 42 5b f7 71 0a  |*...V.Q.&I#B[.q.|
          f2 05 a2 ba eb 30 79 67  b1 ea 35 f5 5e 8b 78 b6  |.....0yg..5.^.x.|
          c2 1d 81 c8 6e f6 86 ef  e9 f5 34 33 cb 67 0d 96  |....n.....43.g..|
          1a 43 ff 8e 10 80 f4 5e  c8 d9 83 be 97 6d c2 00  |.C.....^.....m..|
          ad dd d0 fe 0b 9d 73 47  cc 97 35 9f ad 8c 7c e4  |......sG..5...|.|
          cf bf b4 5f 3b e3 0d 75  9f 39 72 03 05 c2 f6 c6  |..._;..u.9r.....|
          e9 c1 5c 6e ff 55 87 66  18 40 db 19 22 23 e8 6f  |..\n.U.f.@.."#.o|
    • 1
      • unnamed
        • #0
          • C: ZA
          • O: Thawte Consulting (Pty) Ltd.
          • CN: Thawte Code Signing CA
        • 0x402827
      • MD5: nil
      • #2
        • 1.3.6.1.4.1.311.2.1.12
          • nil
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeCom
        • messageDigest:
          8c c2 d7 98 5d cf 2c 32  50 2d a6 ea da fe d6 dd  |....].,2P-......|
      • rsaEncryption:
        60 f3 f6 4e 15 20 87 b7  af 01 e2 80 97 cf dc 28  |`..N. .........(|
        8c 6b 16 3a af e4 10 14  6f 5f 5e 44 a3 b9 d9 87  |.k.:....o_^D....|
        5d 5a 13 1b 37 59 50 87  64 8d e0 ab f9 f1 e7 14  |]Z..7YP.d.......|
        df 08 45 21 05 05 83 4a  26 91 87 1c b7 c2 0e ce  |..E!...J&.......|
        76 53 0a e5 68 0c d3 bd  00 2c 9b bd 6a ae c2 db  |vS..h....,..j...|
        e2 5e a8 ca 1a ae 95 29  13 74 3b 5b 14 f5 1e d3  |.^.....).t;[....|
        6a 51 d9 8b d1 c8 e1 1f  aa 83 0a 17 63 22 32 09  |jQ..........c"2.|
        58 92 c1 68 67 d9 64 8a  f0 7a c8 ea 8a ae de 76  |X..hg.d..z.....v|
offsetsizetypecomment
053248EXE12/09/2003 19:18:17#
15c115HTM#
d0005132632BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 5185880 bytes (5065 KiB)


--
Type = PE
Physical Size = 5185880
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms
Created = 2003-12-09 19:18:17
Headers Size = 4096
Checksum = 5196889
Name = 7zS.sfx
Image Size = 131072
Section Alignment = 4096
File Alignment = 512
Code Size = 40960
Initialized Data Size = 12288
Uninitialized Data Size = 73728
Linker Version = 6.0
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 3.12.0.0
FileVersion: 3, 12, 0, 0
ProductVersion: 3.12.0.0
ProductVersion: 3, 12, 0, 0
CompanyName: Mozilla
FileDescription: Firefox
InternalName: 7zS.sfx
LegalCopyright: Mozilla
OriginalFilename: 7zS.sfx
ProductName: Firefox
----
Path = [0]
Size = 5129560
Packed Size = 5129560
Virtual Size = 5129560
Offset = 53248
--
Path = [0]
Type = 7z
Offset = 84
Physical Size = 5129469
Tail Size = 7
Headers Size = 417
Method = LZMA:24 BCJ2
Solid = +
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2005-11-12 01:10:37 ....A      1698442      5129052  setuprsc.dll
2005-11-12 01:10:37 ....A       207492               setup.exe
2005-11-12 01:10:37 ....A        33393               config.ini
2005-11-18 02:59:29 ....A        18142               install.ini
2005-11-12 01:10:37 ....A         6416               license.txt
2005-11-12 01:10:37 ....A       857034               adt.xpi
2005-11-12 01:10:38 ....A     13742442               browser.xpi
2005-11-18 02:59:29 ....A       630456               de.xpi
2005-11-12 01:10:38 ....A       716558               talkback.xpi
2005-11-12 01:10:38 ....A      1341141               xpcom.xpi
2005-11-12 01:10:37 ....A        76294               UninstallFirefox.zip
------------------- ----- ------------ ------------  ------------------------
2005-11-18 02:59:29           19327810      5129052  11 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

[!] string size(56758) > stringtable size(84). truncated to 82

[!] cannot convert "\x88\xC8\xF1\xC4\x03\xF03|\x9D%\x88z\xE1\xC0\a!"... to UTF-16

[!] string size(82390) > stringtable size(52). truncated to 50

[!] cannot convert "+\xF7\x01}\xDC\x84=kV}H\x84+\xEA\a\x03"... to UTF-16