filenameSkyTa03.exe
size736768 (0xb3e00)
md58e72115782d7de3dc39d10fe4672354f
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0x4100
oem_info0xdf18
reserved20xb73b46e7
reserved30x2eccd7
reserved40x9f00
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
2727410813471
2727410027050
4844714745624
1080478716309
4816814417960
5844711927578
1089661441831

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4dd65aa9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x41a00
SizeOfInitializedData0x72000
SizeOfUninitializedData0
AddressOfEntryPoint0x3bab3
BaseOfCode0x1000
BaseOfData0x43000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x123000
SizeOfHeaders0x400
CheckSum0xb7bb3
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text=0x10000x418290x41a00R-X CODE
.data�0x430000x9b8080x2fa00RW- IDATA
.rdata�0xdf0000x65610x6600RW- IDATA
.rsrc�0xe60000x3ac300x3ae00R-- IDATA
.reloc)0x1210000x20000x1200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xe315c0x8c
RESOURCE0xe60000x3ac30
EXCEPTION00
SECURITY00
BASERELOC0x1210000x1014
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xdf0000x15c
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#135532500
DIALOG#197432500
DIALOG#176732500
DIALOG#108532500
DIALOG#135132500
DIALOG#150532500
DIALOG#179232500
DIALOG#114032500
DIALOG#134632500
DIALOG#134732500
DIALOG#190432500
DIALOG#118032500
DIALOG#183832500
DIALOG#133032500
DIALOG#164232500
DIALOG#100632500
DIALOG#167032500
DIALOG#144932500
DIALOG#164532500
DIALOG#110632500
DIALOG#154632500
DIALOG#128432500
DIALOG#155332500
DIALOG#157732500
DIALOG#139832500
DIALOG#170832500
DIALOG#192432500
DIALOG#169432500
DIALOG#116232500
DIALOG#128332500
DIALOG#127132500
DIALOG#139932500
DIALOG#136032500
DIALOG#143132500
DIALOG#147132500
DIALOG#186032500
DIALOG#183532500
DIALOG#150232500
DIALOG#163932500
DIALOG#124532500
DIALOG#121232500
DIALOG#112832500
DIALOG#100432500
DIALOG#101332500
DIALOG#127032500
DIALOG#150932500
DIALOG#138632500
DIALOG#192532500
DIALOG#140732500
DIALOG#106232500
DIALOG#144032500
DIALOG#191532500
DIALOG#107532500
DIALOG#183232500
DIALOG#194632500
DIALOG#101932500
DIALOG#153932500
DIALOG#172232500
DIALOG#126832500
DIALOG#114032500
DIALOG#133932500
DIALOG#155932500
DIALOG#176032500
DIALOG#148332500
DIALOG#188532500
DIALOG#196532500
DIALOG#129032500
DIALOG#108232500
DIALOG#138032500
DIALOG#149832500
DIALOG#188032500
DIALOG#132233910
#13#266192120
VERSION#18480
module_namehintordfunction_name
KERNEL32.dllIsProcessorFeaturePresent
KERNEL32.dllSetUnhandledExceptionFilter
KERNEL32.dllGetACP
KERNEL32.dllGetOEMCP
KERNEL32.dllEnumLanguageGroupLocalesA
KERNEL32.dllGetModuleHandleA
KERNEL32.dllCreateHardLinkW
KERNEL32.dllRtlUnwind
KERNEL32.dllExitProcess
KERNEL32.dllGetCommandLineA
USER32.dllGetWindowRect
USER32.dllWinHelpW
USER32.dllDestroyWindow
USER32.dllGetMenu
USER32.dllIsIconic
USER32.dllIsZoomed
USER32.dllDrawTextW
USER32.dllDrawMenuBar
USER32.dllUnionRect
USER32.dllDefWindowProcW
USER32.dllGetMessageW
USER32.dllMoveWindow
USER32.dllLoadAcceleratorsW
USER32.dllShowWindow
USER32.dllMessageBoxA
USER32.dllLoadBitmapW
USER32.dllInvertRect
USER32.dllSetCapture
USER32.dllOffsetRect
USER32.dllGetClientRect
USER32.dllSetRect
USER32.dllRegisterClassW
USER32.dllGetDlgItem
USER32.dllwsprintfW
USER32.dllFillRect
USER32.dllGetWindowPlacement
USER32.dllCreateWindowExW
USER32.dllInvalidateRect
USER32.dllLoadStringA
USER32.dllDialogBoxParamW
USER32.dllGetForegroundWindow
USER32.dllBeginPaint
USER32.dllMessageBoxW
USER32.dllReleaseCapture
USER32.dllGetClassInfoA
USER32.dllIntersectRect
USER32.dllGetSubMenu
USER32.dllGetDesktopWindow
USER32.dllCheckRadioButton
USER32.dllFrameRect
USER32.dllDispatchMessageW
USER32.dllEnableMenuItem
USER32.dllEndDialog
USER32.dllPtInRect
USER32.dllLoadIconW
USER32.dllIsDlgButtonChecked
USER32.dllPostMessageW
USER32.dllEndPaint
USER32.dllSendMessageW
USER32.dllGetDlgItemTextW
USER32.dllSetDlgItemTextW
USER32.dllGetDC
USER32.dllGetSystemMetrics
USER32.dllWaitMessage
USER32.dllPeekMessageW
USER32.dllReleaseDC
USER32.dllLoadCursorW
USER32.dllCheckDlgButton
USER32.dllTranslateAcceleratorW
USER32.dllUpdateWindow
IPHLPAPI.dllGetIpNetTable
SHLWAPI.dllPathCanonicalizeW
SHLWAPI.dllPathAppendW
COMCTL32.dllInitCommonControlsEx
ADVAPI32.dllRegQueryValueExW
ADVAPI32.dllRegQueryValueExA
ADVAPI32.dllRegOpenKeyExA
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllRegSetValueExW
ADVAPI32.dllRegCloseKey
ADVAPI32.dllRegCreateKeyExW

StringTable 040904B0

OriginalFilenameLmlrnx.exe
ProductVersion10, 9
LegalCopyright2004
CompanyNameSpace Sciences Laboratory, U.C. Berkeley
InternalNameYby
LegalTrademarksYtoho Xose Jojibu Itedym Cigywov Vojo Sirafi Bud
FileDescriptionIryci Nokadi Tises
ProductNameBiz
FileVersion10, 9, 10

VS_FIXEDFILEINFO

FileVersion10.9.0.0
ProductVersion10.9.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0736768EXE05/20/2011 12:12:25#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK