FAX_id{DIGIT[30]}.exe

info
MZ
PE
resources
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	FAX_id{DIGIT[30]}.exe
size	137216 (0x21800)
md5	8c830cfdd2b5829b9164862e2457780a

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x84

DOS stub

00000000: bb 11 00 0f 1f b5 0a cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0a 0d 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00                                       |....            |

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x51002677
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	255.255
SizeOfCode	0x1400
SizeOfInitializedData	0x1fe00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1202
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x27000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	1
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1314	0x1400	R-X CODE
.rdata	0x3000	0xa34	0xc00	R-- IDATA
.data	0x4000	0x2fec	0x200	RW- IDATA
.rsrc	0x7000	0x1ef00	0x1f000	R-- IDATA
.import	0x26000	0x1e4	0x200	RW- UDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x30ac	0x50
RESOURCE	0x7000	0x1ef68
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0x2600a	0xb0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x26000	0xb4
CLR_Header	0	0

show previews

type	name	size	cp	r
ICON	#1	16424	0	0
MENU	#768	4290297025	4290498520	1639963882
MENU	#3839	1236324344	2337396445	532185919
MENU	#128	0	0	262144
MENU	#256	897192498	3323702379	460614045
MENU	#128000	166626625	816398989	4193328739
MENU	#128000	849284802	2983684452	587301864
MENU	#527360	1437432378	1503422017	1164348867
MENU	#264448	3533106161	940350206	3515229534
MENU	#264448	841741564	2208079981	839295514
MENU	#35592192	4294967039	4294835197	1644035838
MENU	#10240	0	0	0
GROUP_ICON	#500	20	0	0

module_name	hint	function_name
KERNEL32.dll	450	GetCurrentProcess
KERNEL32.dll	1266	VirtualProtectEx
KERNEL32.dll	616	GetStringTypeA
KERNEL32.dll	1140	SetLastError
KERNEL32.dll	488	GetFileAttributesW
KERNEL32.dll	132	CreateEventA
KERNEL32.dll	535	GetModuleHandleA
KERNEL32.dll	1150	SetPriorityClass
KERNEL32.dll	519	GetLocaleInfoW
KERNEL32.dll	131	CreateDirectoryW
KERNEL32.dll	1026	RemoveDirectoryW
KERNEL32.dll	843	LocalLock
KERNEL32.dll	662	GetTickCount
KERNEL32.dll	721	HeapFree
KERNEL32.dll	334	FindResourceW
KERNEL32.dll	213	FindClose
KERNEL32.dll	779	IsValidCodePage
KERNEL32.dll	482	GetExitCodeThread
KERNEL32.dll	1224	TlsGetValue
KERNEL32.dll	1211	SuspendThread
ADVAPI32.dll	1590	RegEnumKeyA
ADVAPI32.dll	1390	IsValidSecurityDescriptor
ADVAPI32.dll	1125	CreateProcessAsUserA
ADVAPI32.dll	1094	ControlService
ADVAPI32.dll	1388	IsValidAcl
ADVAPI32.dll	1085	ClearEventLogW
ADVAPI32.dll	1570	RegCreateKeyExW
ADVAPI32.dll	1131	CreateServiceW
ADVAPI32.dll	1385	IsTextUnicode
ADVAPI32.dll	1386	InitializeSid
ADVAPI32.dll	1391	IsValidSid
ADVAPI32.dll	1584	RegDeleteValueA
ADVAPI32.dll	1622	RegQueryValueW
MSCTF.dll	4	DllUnregisterServer
MSCTF.dll	58	TF_InitSystem
MSCTF.dll	1	DllCanUnloadNow
UXTHEME.dll	53	CloseThemeData

show previews

offset	size	type	comment
0	137216	EXE	01/23/2013 18:05:43	#
15c1	15	HTM		#

Scanning the drive for archives:
1 file, 137216 bytes (134 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 34320

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 40464

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 46608

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 52752

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 58896

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62992

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 67088

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 14864

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 26128

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 9571

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 9315

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 9059

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 9315

[?] too many errors getting resource data, stopped on 130 of 1024

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 9968

[?] too many errors getting resource data, stopped on 3 of 4

[?] can't find file_offset of VA 0xffa3a2a3

[?] can't find file_offset of VA 0x14618ea8

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0xee1f58ae

[?] can't find file_offset of VA 0xa226328e

[?] can't find file_offset of VA 0x27a88254

[?] can't find file_offset of VA 0xaf3d73ce

[?] can't find file_offset of VA 0x871d1b

[?] can't find file_offset of VA 0x249e04c3

[?] can't find file_offset of VA 0xfffefcfe

[?] can't find file_offset of VA 0x0