Firefox Setup 1.5.exe - 7zS.sfx

info
MZ
PE
resources
strings
imports
foremost
7zip
version info
signature
hexdump
disasm
log
discuss
donate

filename	Firefox Setup 1.5.exe
size	5185880 (0x4f2158)
md5	85c2495db6a3f1ca0f3f9132d6e49617

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
11	8047	3
14	7299	8
10	8047	11
4	8047	2
1	0	141
93	2179	9
11	8966	52
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x3fd61ff9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0xa000
SizeOfInitializedData	0x3000
SizeOfUninitializedData	0x12000
AddressOfEntryPoint	0x1c8d0
BaseOfCode	0x13000
BaseOfData	0x1d000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x20000
SizeOfHeaders	0x1000
CheckSum	0x4f4c59
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x12000	0	RWX UDATA
UPX1	0x13000	0xa000	0x9c00	RWX IDATA
.rsrc	0x1d000	0x3000	0x3000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1fd10	0x124
RESOURCE	0x1d000	0x2d10
EXCEPTION	0	0
SECURITY	0x4f1558	0xc00
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	744	1252
ICON	#2	296	1252
ICON	#3	1384	1252
ICON	#4	2216	1252
ICON	#5	3752	1252
ICON	#6	1640	1252
DIALOG	#500	184	1252
STRING	#1	84	1252
STRING	#5	52	1252
GROUP_ICON	#159	90	1252
VERSION	#1	644	1252
#255	#1	4	1252

lang

string

1033

db 6e 88 c8 f1 c4 03 f0  33 7c 9d 25 88 7a e1 c0  |.n......3|.%.z..|
07 21 74 32 2b 46 f0 a3  de fd f8 77 51 58 10 53  |.!t2+F.....wQX.S|
30 d4 97 8a 4f 74 72 8a  03 b7 45 e0 74 6d fa 31  |0...Otr...E.tm.1|
aa 68 71 dc 9f ce 47 43  eb 03 44 e7 28 0c 31 1f  |.hq...GC..D.(.1.|
54 83 ff 80 35 b0 31 75  e2 03 7d f0 03 5d f0 48  |T...5.1u..}..].H|
39 be 1b ff                                       |9...            |

1033

eb a0 2b f7 01 7d dc 84  3d 6b 56 7d 48 84 2b ea  |..+..}..=kV}H.+.|
07 03 23 77 4d 51 21 2d  f1 db ff f5 2b 39 a1 09  |..#wMQ!-....+9..|
fa 0b 33 0f 94 c3 eb 06  b3 a7 db 20 08 d4 c3 03  |..3........ ....|
8a c3 79 5f                                       |..y_            |

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		ExitProcess
COMCTL32.dll	17
MSVCRT.dll		exit
OLEAUT32.dll	9
USER32.dll		SetTimer

StringTable 040904b0

CompanyName	Mozilla
FileDescription	Firefox
FileVersion	3, 12, 0, 0
InternalName	7zS.sfx
LegalCopyright	Mozilla
OriginalFilename	7zS.sfx
ProductName	Firefox
ProductVersion	3, 12, 0, 0

VS_FIXEDFILEINFO

FileVersion	3.12.0.0
ProductVersion	3.12.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte Code Signing CA

serial: 402827

Certificates (3)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  1 00:00:00 1996 GMT
            Not After : Dec 31 23:59:59 2020 GMT
        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:d2:36:36:6a:8b:d7:c2:5b:9e:da:81:41:62:8f:
                    38:ee:49:04:55:d6:d0:ef:1c:1b:95:16:47:ef:18:
                    48:35:3a:52:f4:2b:6a:06:8f:3b:2f:ea:56:e3:af:
                    86:8d:9e:17:f7:9e:b4:65:75:02:4d:ef:cb:09:a2:
                    21:51:d8:9b:d0:67:d0:ba:0d:92:06:14:73:d4:93:
                    cb:97:2a:00:9c:5c:4e:0c:bc:fa:15:52:fc:f2:44:
                    6e:da:11:4a:6e:08:9f:2f:2d:e3:f9:aa:3a:86:73:
                    b6:46:53:58:c8:89:05:bd:83:11:b8:73:3f:aa:07:
                    8d:f4:42:4d:e7:40:9d:1c:37
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: md5WithRSAEncryption
         26:48:2c:16:c2:58:fa:e8:16:74:0c:aa:aa:5f:54:3f:f2:d7:
         c9:78:60:5e:5e:6e:37:63:22:77:36:7e:b2:17:c4:34:b9:f5:
         08:85:fc:c9:01:38:ff:4d:be:f2:16:42:43:e7:bb:5a:46:fb:
         c1:c6:11:1f:f1:4a:b0:28:46:c9:c3:c4:42:7d:bc:fa:ab:59:
         6e:d5:b7:51:88:11:e3:a4:85:19:6b:82:4c:a4:0c:12:ad:e9:
         a4:ae:3f:f1:c3:49:65:9a:8c:c5:c8:3e:25:b7:94:99:bb:92:
         32:71:07:f0:86:5e:ed:50:27:a6:0d:a6:23:f9:bb:cb:a6:07:
         14:42

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10 (0xa)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
        Validity
            Not Before: Aug  6 00:00:00 2003 GMT
            Not After : Aug  5 23:59:59 2013 GMT
        Subject: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c6:b8:b9:27:60:af:0b:e3:91:69:65:db:7e:8d:
                    ed:91:e6:aa:f1:be:d5:ed:fe:6d:d4:2c:7f:d1:70:
                    77:fb:26:99:57:b4:dd:3f:30:b8:dc:21:ea:68:8d:
                    81:92:fc:2e:4b:91:35:84:20:f2:da:4a:ba:b4:fc:
                    e6:da:88:f2:20:c5:21:92:09:47:95:a0:09:1c:a6:
                    79:be:b1:4c:1d:fc:f1:8a:6e:54:d2:69:a1:f1:4c:
                    93:3a:41:fe:7d:d4:64:7b:63:45:f7:60:60:1d:31:
                    1d:a4:e9:d3:0f:8b:fb:6e:26:24:b3:a8:ff:e5:e5:
                    90:d4:b4:c2:dc:50:60:ae:59
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawtePremiumServerCA.crl

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=PrivateLabel2-144
    Signature Algorithm: sha1WithRSAEncryption
         76:b2:9c:ee:13:9f:1b:f6:2d:34:92:94:45:73:34:dc:8e:6b:
         2e:5c:fc:4c:7d:89:eb:c3:68:f1:d7:99:0f:2e:1d:17:c8:b5:
         16:8b:be:cd:8a:05:06:f2:19:49:3a:03:5b:05:c9:20:8e:6d:
         52:e1:76:81:a0:c3:65:8a:22:67:e4:1c:53:53:37:46:bf:bc:
         d7:2f:eb:7b:9e:d0:14:45:6c:40:21:08:e2:5d:75:76:66:30:
         1e:f4:df:82:8a:2f:bd:f3:a2:0c:bf:1d:db:9f:14:a2:9a:72:
         37:4d:b0:77:48:e8:4a:3f:09:ce:55:19:2c:ef:e6:07:24:e1:
         af:ec

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4204583 (0x402827)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte Code Signing CA
        Validity
            Not Before: Nov  2 21:38:02 2005 GMT
            Not After : Nov  2 21:38:02 2006 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Mozilla Corporation, OU=Secure Application Development, CN=Mozilla Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:cb:53:ed:15:46:16:48:7e:dd:ba:6d:c0:51:8a:
                    e6:9a:10:af:c2:0d:c6:30:a0:72:d5:34:5b:97:cb:
                    58:81:56:80:84:27:71:2d:c5:cd:ae:ee:14:06:7b:
                    b1:d6:d2:8b:4d:22:f8:5d:7f:3e:39:5f:fb:fa:a9:
                    38:dc:f8:c0:76:2b:2b:75:7b:4a:8e:71:89:6c:fb:
                    b5:77:39:8b:42:b6:75:4a:b2:06:66:a0:d0:e7:fb:
                    90:cd:6f:55:f4:40:b6:e7:b6:f2:22:90:41:e5:a3:
                    ac:44:b5:0b:c7:17:c6:83:0e:df:c9:81:27:db:97:
                    ac:a6:5f:36:a5:0f:87:72:db
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Code Signing, Microsoft Commercial Code Signing
            Netscape Cert Type: 
                Object Signing
            2.5.29.4: 
                0.0.0..
+.....7.......
            X509v3 Subject Alternative Name: 
                DNS:www.mozilla.com
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.thawte.com/ThawteCodeSigningCA.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.thawte.com

            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: md5WithRSAEncryption
         0e:b4:93:f1:a5:40:4d:fc:5b:8f:70:eb:69:e2:8e:e5:2a:0a:
         09:9e:56:2e:51:f1:26:49:23:42:5b:f7:71:0a:f2:05:a2:ba:
         eb:30:79:67:b1:ea:35:f5:5e:8b:78:b6:c2:1d:81:c8:6e:f6:
         86:ef:e9:f5:34:33:cb:67:0d:96:1a:43:ff:8e:10:80:f4:5e:
         c8:d9:83:be:97:6d:c2:00:ad:dd:d0:fe:0b:9d:73:47:cc:97:
         35:9f:ad:8c:7c:e4:cf:bf:b4:5f:3b:e3:0d:75:9f:39:72:03:
         05:c2:f6:c6:e9:c1:5c:6e:ff:55:87:66:18:40:db:19:22:23:
         e8:6f

pkcs7-signedData

1
- MD5: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - MD5
      - 5c 6e 7b 48 34 7f 84 a8 d6 f5 10 f3 8a 9d a1 ab |\n{H4...........|
- Certificates
  - Certificate #0
    - 2
      - 1
      - RSA-MD5: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 1996-08-01 00:00:00 UTC: 2020-12-31 23:59:59 UTC
      - Subject
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - #5
        rsaEncryption: nil
        D2:36:36:6A:8B:D7:C2:5B:9E:DA:81:41:62:8F:38:EE:
        49:04:55:D6:D0:EF:1C:1B:95:16:47:EF:18:48:35:3A:
        52:F4:2B:6A:06:8F:3B:2F:EA:56:E3:AF:86:8D:9E:17:
        F7:9E:B4:65:75:02:4D:EF:CB:09:A2:21:51:D8:9B:D0:
        67:D0:BA:0D:92:06:14:73:D4:93:CB:97:2A:00:9C:5C:
        4E:0C:BC:FA:15:52:FC:F2:44:6E:DA:11:4A:6E:08:9F:
        2F:2D:E3:F9:AA:3A:86:73:B6:46:53:58:C8:89:05:BD:
        83:11:B8:73:3F:AA:07:8D:F4:42:4D:E7:40:9D:1C:37: 0x010001
      - basicConstraints: true, true
    - RSA-MD5:
```
26 48 2c 16 c2 58 fa e8  16 74 0c aa aa 5f 54 3f  |&H,..X...t..._T?|
f2 d7 c9 78 60 5e 5e 6e  37 63 22 77 36 7e b2 17  |...x`^^n7c"w6~..|
c4 34 b9 f5 08 85 fc c9  01 38 ff 4d be f2 16 42  |.4.......8.M...B|
43 e7 bb 5a 46 fb c1 c6  11 1f f1 4a b0 28 46 c9  |C..ZF......J.(F.|
c3 c4 42 7d bc fa ab 59  6e d5 b7 51 88 11 e3 a4  |..B}...Yn..Q....|
85 19 6b 82 4c a4 0c 12  ad e9 a4 ae 3f f1 c3 49  |..k.L.......?..I|
65 9a 8c c5 c8 3e 25 b7  94 99 bb 92 32 71 07 f0  |e....>%.....2q..|
86 5e ed 50 27 a6 0d a6  23 f9 bb cb a6 07 14 42  |.^.P'...#......B|
```
  - Certificate #1
    - 2
      - 0x0A
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Cape Town
        O: Thawte Consulting cc
        OU: Certification Services Division
        CN: Thawte Premium Server CA
        emailAddress: premium-server@thawte.com
      - 2003-08-06 00:00:00 UTC: 2013-08-05 23:59:59 UTC
      - Subject
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - #5
        rsaEncryption: nil
        C6:B8:B9:27:60:AF:0B:E3:91:69:65:DB:7E:8D:ED:91:
        E6:AA:F1:BE:D5:ED:FE:6D:D4:2C:7F:D1:70:77:FB:26:
        99:57:B4:DD:3F:30:B8:DC:21:EA:68:8D:81:92:FC:2E:
        4B:91:35:84:20:F2:DA:4A:BA:B4:FC:E6:DA:88:F2:20:
        C5:21:92:09:47:95:A0:09:1C:A6:79:BE:B1:4C:1D:FC:
        F1:8A:6E:54:D2:69:A1:F1:4C:93:3A:41:FE:7D:D4:64:
        7B:63:45:F7:60:60:1D:31:1D:A4:E9:D3:0F:8B:FB:6E:
        26:24:B3:A8:FF:E5:E5:90:D4:B4:C2:DC:50:60:AE:59: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.thawte.com/ThawtePremiumServerCA.crl
        extendedKeyUsage
        clientAuth: codeSigning
        keyUsage: true, 6
        subjectAltName
        CN: PrivateLabel2-144
    - RSA-SHA1:
```
76 b2 9c ee 13 9f 1b f6  2d 34 92 94 45 73 34 dc  |v.......-4..Es4.|
8e 6b 2e 5c fc 4c 7d 89  eb c3 68 f1 d7 99 0f 2e  |.k.\.L}...h.....|
1d 17 c8 b5 16 8b be cd  8a 05 06 f2 19 49 3a 03  |.............I:.|
5b 05 c9 20 8e 6d 52 e1  76 81 a0 c3 65 8a 22 67  |[.. .mR.v...e."g|
e4 1c 53 53 37 46 bf bc  d7 2f eb 7b 9e d0 14 45  |..SS7F.../.{...E|
6c 40 21 08 e2 5d 75 76  66 30 1e f4 df 82 8a 2f  |l@!..]uvf0...../|
bd f3 a2 0c bf 1d db 9f  14 a2 9a 72 37 4d b0 77  |...........r7M.w|
48 e8 4a 3f 09 ce 55 19  2c ef e6 07 24 e1 af ec  |H.J?..U.,...$...|
```
  - Certificate #2
    - 2
      - 0x402827
      - RSA-MD5: nil
      - Issuer
        C: ZA
        O: Thawte Consulting (Pty) Ltd.
        CN: Thawte Code Signing CA
      - 2005-11-02 21:38:02 UTC: 2006-11-02 21:38:02 UTC
      - Subject
        C: US
        ST: California
        L: Mountain View
        O: Mozilla Corporation
        OU: Secure Application Development
        CN: Mozilla Corporation
      - #5
        rsaEncryption: nil
        CB:53:ED:15:46:16:48:7E:DD:BA:6D:C0:51:8A:E6:9A:
        10:AF:C2:0D:C6:30:A0:72:D5:34:5B:97:CB:58:81:56:
        80:84:27:71:2D:C5:CD:AE:EE:14:06:7B:B1:D6:D2:8B:
        4D:22:F8:5D:7F:3E:39:5F:FB:FA:A9:38:DC:F8:C0:76:
        2B:2B:75:7B:4A:8E:71:89:6C:FB:B5:77:39:8B:42:B6:
        75:4A:B2:06:66:A0:D0:E7:FB:90:CD:6F:55:F4:40:B6:
        E7:B6:F2:22:90:41:E5:A3:AC:44:B5:0B:C7:17:C6:83:
        0E:DF:C9:81:27:DB:97:AC:A6:5F:36:A5:0F:87:72:DB: 0x010001
      - #6
        extendedKeyUsage
        codeSigning: msCodeCom
        nsCertType: 0x10
        2.5.29.4
        msCodeCom: 0x80
        subjectAltName: www.mozilla.com
        crlDistributionPoints: http://crl.thawte.com/ThawteCodeSigningCA.crl
        authorityInfoAccess
        OCSP: http://ocsp.thawte.com
        basicConstraints
        true
        nil
    - RSA-MD5:
```
0e b4 93 f1 a5 40 4d fc  5b 8f 70 eb 69 e2 8e e5  |.....@M.[.p.i...|
2a 0a 09 9e 56 2e 51 f1  26 49 23 42 5b f7 71 0a  |*...V.Q.&I#B[.q.|
f2 05 a2 ba eb 30 79 67  b1 ea 35 f5 5e 8b 78 b6  |.....0yg..5.^.x.|
c2 1d 81 c8 6e f6 86 ef  e9 f5 34 33 cb 67 0d 96  |....n.....43.g..|
1a 43 ff 8e 10 80 f4 5e  c8 d9 83 be 97 6d c2 00  |.C.....^.....m..|
ad dd d0 fe 0b 9d 73 47  cc 97 35 9f ad 8c 7c e4  |......sG..5...|.|
cf bf b4 5f 3b e3 0d 75  9f 39 72 03 05 c2 f6 c6  |..._;..u.9r.....|
e9 c1 5c 6e ff 55 87 66  18 40 db 19 22 23 e8 6f  |..\n.U.f.@.."#.o|
```
- 1
  - unnamed
    - #0
      - C: ZA
      - O: Thawte Consulting (Pty) Ltd.
      - CN: Thawte Code Signing CA
    - 0x402827
  - MD5: nil
  - #2
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeCom
    - messageDigest:
```
8c c2 d7 98 5d cf 2c 32  50 2d a6 ea da fe d6 dd  |....].,2P-......|
```
  - rsaEncryption:
```
60 f3 f6 4e 15 20 87 b7  af 01 e2 80 97 cf dc 28  |`..N. .........(|
8c 6b 16 3a af e4 10 14  6f 5f 5e 44 a3 b9 d9 87  |.k.:....o_^D....|
5d 5a 13 1b 37 59 50 87  64 8d e0 ab f9 f1 e7 14  |]Z..7YP.d.......|
df 08 45 21 05 05 83 4a  26 91 87 1c b7 c2 0e ce  |..E!...J&.......|
76 53 0a e5 68 0c d3 bd  00 2c 9b bd 6a ae c2 db  |vS..h....,..j...|
e2 5e a8 ca 1a ae 95 29  13 74 3b 5b 14 f5 1e d3  |.^.....).t;[....|
6a 51 d9 8b d1 c8 e1 1f  aa 83 0a 17 63 22 32 09  |jQ..........c"2.|
58 92 c1 68 67 d9 64 8a  f0 7a c8 ea 8a ae de 76  |X..hg.d..z.....v|
```

show previews

offset	size	type	comment
0	53248	EXE	12/09/2003 19:18:17	#
15c1	15	HTM		#
d000	5132632	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 5185880 bytes (5065 KiB)


--
Type = PE
Physical Size = 5185880
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms
Created = 2003-12-09 19:18:17
Headers Size = 4096
Checksum = 5196889
Name = 7zS.sfx
Image Size = 131072
Section Alignment = 4096
File Alignment = 512
Code Size = 40960
Initialized Data Size = 12288
Uninitialized Data Size = 73728
Linker Version = 6.0
OS Version = 4.0
Image Version = 0.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 3.12.0.0
FileVersion: 3, 12, 0, 0
ProductVersion: 3.12.0.0
ProductVersion: 3, 12, 0, 0
CompanyName: Mozilla
FileDescription: Firefox
InternalName: 7zS.sfx
LegalCopyright: Mozilla
OriginalFilename: 7zS.sfx
ProductName: Firefox
----
Path = [0]
Size = 5129560
Packed Size = 5129560
Virtual Size = 5129560
Offset = 53248
--
Path = [0]
Type = 7z
Offset = 84
Physical Size = 5129469
Tail Size = 7
Headers Size = 417
Method = LZMA:24 BCJ2
Solid = +
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2005-11-12 01:10:37 ....A      1698442      5129052  setuprsc.dll
2005-11-12 01:10:37 ....A       207492               setup.exe
2005-11-12 01:10:37 ....A        33393               config.ini
2005-11-18 02:59:29 ....A        18142               install.ini
2005-11-12 01:10:37 ....A         6416               license.txt
2005-11-12 01:10:37 ....A       857034               adt.xpi
2005-11-12 01:10:38 ....A     13742442               browser.xpi
2005-11-18 02:59:29 ....A       630456               de.xpi
2005-11-12 01:10:38 ....A       716558               talkback.xpi
2005-11-12 01:10:38 ....A      1341141               xpcom.xpi
2005-11-12 01:10:37 ....A        76294               UninstallFirefox.zip
------------------- ----- ------------ ------------  ------------------------
2005-11-18 02:59:29           19327810      5129052  11 files

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] string size(56758) > stringtable size(84). truncated to 82

[!] cannot convert "\x88\xC8\xF1\xC4\x03\xF03|\x9D%\x88z\xE1\xC0\a!"... to UTF-16

[!] string size(82390) > stringtable size(52). truncated to 50

[!] cannot convert "+\xF7\x01}\xDC\x84=kV}H\x84+\xEA\a\x03"... to UTF-16

Firefox Setup 1.5.exe- 7zS.sfx - Firefox