filenamefoo.exe
size194560 (0x2f800)
md58f8800c81ebfdcf5aa42d87d5f6c72b7
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
189307161
187307161
1853071617
10160
1883071618
192307169
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5010a6fc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion10.10
SizeOfCode0x7c00
SizeOfInitializedData0x27800
SizeOfUninitializedData0
AddressOfEntryPoint0x807c
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion6.1
Reserved10
SizeOfImage0x36000
SizeOfHeaders0x400
CheckSum0x3281b
Subsystem2
DllCharacteristics0x8160
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

AVI movie file

Sections

namevavsizeraw sizeflags
.text0x10000x7be80x7c00R-X CODE
.data0x90000x20800x600RW- IDATA
.pdata0xc0000x3f00x400R-- IDATA
.idata0xd0000x15b00x1600R-- IDATA
.rsrc0xf0000x254700x25600R-- IDATA
.reloc0x350000x6c0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xd0000xb4
RESOURCE0xf0000x25470
EXCEPTION0xc0000x3f0
SECURITY00
BASERELOC0x350000x14
DEBUG0x10400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13800x70
Bound_IAT00
IAT0xd5d80x520
Delay_IAT00
CLR_Header00
typenamesizecp
AVI#3001118021252
ICON#116401252
ICON#27441252
ICON#34881252
ICON#42961252
ICON#537521252
ICON#622161252
ICON#717361252
ICON#813841252
ICON#9557621252
ICON#1096401252
ICON#1142641252
ICON#1224401252
ICON#1311281252
DIALOG#20017541252
DIALOG#20024321252
DIALOG#20033581252
DIALOG#20044481252
DIALOG#20053041252
DIALOG#20062881252
STRING#631401252
STRING#7613121252
STRING#7714841252
STRING#8012001252
STRING#8310981252
STRING#859741252
RCDATAADMQCMD71252
RCDATACABINET419411252
RCDATAEXTRACTOPT41252
RCDATAFILESIZES361252
RCDATAFINISHMSG71252
RCDATALICENSE71252
RCDATAPACKINSTSPACE41252
RCDATAPOSTRUNPROGRAM71252
RCDATAREBOOT41252
RCDATARUNPROGRAM621252
RCDATASHOWWINDOW41252
RCDATATITLE81252
RCDATAUPROMPT491252
RCDATAUSRQCMD71252
RCDATAVERCHECK1961252
GROUP_ICON#30001881252
VERSION#110641252
MANIFEST#13671252
idlangstring
10001033Please select a folder to store the extracted files.
10011033%s
12001033Failed to get disk space information from: %s. System Message: %s.
12011033A required resource cannot be located.
12021033Are you sure you want to cancel?
12041033Unable to retrieve operating system version information.
12051033Memory allocation request failed.
12081033Unable to create extraction thread.
12101033Cabinet is not valid.
12111033Filetable full.
12121033Can not change to destination folder.
12131033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.
12141033That folder is invalid. Please make sure the folder exists and is writable.
12151033You must specify a folder with fully qualified pathname or choose Cancel.
12161033Could not update folder edit box.
12171033Could not load functions required for browser dialog.
12181033Could not load Shell32.dll required for browser dialog.
12201033Error creating process <%s>. Reason: %s
12211033The cluster size in this system is not supported.
12221033A required resource appears to be corrupted.
12231033Windows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
12241033Error loading %s
12251033GetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used.
12261033Windows 95 or Windows NT is required to install
12271033Could not create folder '%s'
12281033To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue. Do you still want to continue?
12641033Error retrieving Windows folder
12691033NT Shutdown: OpenProcessToken error.
12701033NT Shutdown: AdjustTokenPrivileges error.
12711033NT Shutdown: ExitWindowsEx error.
12721033Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.
12731033The setup program could not retrieve the volume information for drive (%s) . System message: %s.
12741033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.
12751033The installation program appears to be damaged or corrupted. Contact the vendor of this application.
13121033Command line option syntax error. Type Command /? for Help.
13131033Command line options: /Q -- Quiet modes for package, /T:<full path> -- Specifies temporary working folder, /C -- Extract files only to the folder when used also with /T. /C:<Cmd> -- Override Install Command defined by author.
13141033You must restart your computer before the new settings will take effect. Do you want to restart your computer now?
13161033Another copy of the '%s' package is already running on your system. Do you want to run another copy?
13171033Could not find the file: %s.
13511033You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
13541033The folder '%s' does not exist. Do you want to create it?
13551033Another copy of the '%s' package is already running on your system. You can only run one copy at a time.
13561033The '%s' package is not compatible with the version of Windows you are running.
13571033The '%s' package is not compatible with the version of the file: %s on your system.
module_namehintordfunction_name
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll367GetTokenInformation
ADVAPI32.dll677RegSetValueExA
ADVAPI32.dll280EqualSid
ADVAPI32.dll661RegQueryValueExA
ADVAPI32.dll428LookupPrivilegeValueA
ADVAPI32.dll608RegCreateKeyExA
ADVAPI32.dll648RegOpenKeyExA
ADVAPI32.dll655RegQueryInfoKeyA
ADVAPI32.dll623RegDeleteValueA
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll307FreeSid
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll600RegCloseKey
KERNEL32.dll690GetPrivateProfileIntA
KERNEL32.dll592GetFileAttributesA
KERNEL32.dll900IsDBCSLeadByte
KERNEL32.dll753GetSystemDirectoryA
KERNEL32.dll848GlobalUnlock
KERNEL32.dll731GetShortPathNameA
KERNEL32.dll193CreateDirectoryA
KERNEL32.dll398FindFirstFileA
KERNEL32.dll624GetLastError
KERNEL32.dll700GetProcAddress
KERNEL32.dll1186RemoveDirectoryA
KERNEL32.dll1295SetFileAttributesA
KERNEL32.dll837GlobalFree
KERNEL32.dll394FindClose
KERNEL32.dll696GetPrivateProfileStringA
KERNEL32.dll963LoadLibraryA
KERNEL32.dll972LocalAlloc
KERNEL32.dll1542WritePrivateProfileStringA
KERNEL32.dll642GetModuleFileNameA
KERNEL32.dll415FindNextFileA
KERNEL32.dll164CompareStringA
KERNEL32.dll1565_lopen
KERNEL32.dll142CloseHandle
KERNEL32.dll976LocalFree
KERNEL32.dll289DeleteFileA
KERNEL32.dll371ExitProcess
KERNEL32.dll312DosDateTimeToFileTime
KERNEL32.dll206CreateFileA
KERNEL32.dll423FindResourceA
KERNEL32.dll1303SetFilePointer
KERNEL32.dll449FreeResource
KERNEL32.dll969LoadResource
KERNEL32.dll1483WaitForSingleObject
KERNEL32.dll1291SetEvent
KERNEL32.dll647GetModuleHandleW
KERNEL32.dll441FormatMessageA
KERNEL32.dll1307SetFileTime
KERNEL32.dll1537WriteFile
KERNEL32.dll575GetDriveTypeA
KERNEL32.dll813GetVolumeInformationA
KERNEL32.dll1407TerminateThread
KERNEL32.dll1389SizeofResource
KERNEL32.dll199CreateEventA
KERNEL32.dll588GetExitCodeProcess
KERNEL32.dll235CreateProcessA
KERNEL32.dll1116ReadFile
KERNEL32.dll1277SetCurrentDirectoryA
KERNEL32.dll773GetTempFileNameA
KERNEL32.dll1202ResetEvent
KERNEL32.dll987LockResource
KERNEL32.dll757GetSystemInfo
KERNEL32.dll964LoadLibraryExA
KERNEL32.dll226CreateMutexA
KERNEL32.dll546GetCurrentDirectoryA
KERNEL32.dll811GetVersionExA
KERNEL32.dll810GetVersion
KERNEL32.dll775GetTempPathA
KERNEL32.dll256CreateThread
KERNEL32.dll974LocalFileTimeToFileTime
KERNEL32.dll830GlobalAlloc
KERNEL32.dll822GetWindowsDirectoryA
KERNEL32.dll374ExpandEnvironmentStringsA
KERNEL32.dll841GlobalLock
KERNEL32.dll553GetCurrentProcess
KERNEL32.dll446FreeLibrary
KERNEL32.dll1563_llseek
KERNEL32.dll1572lstrcmpA
KERNEL32.dll1390Sleep
KERNEL32.dll734GetStartupInfoW
KERNEL32.dll1211RtlCaptureContext
KERNEL32.dll1218RtlLookupFunctionEntry
KERNEL32.dll1225RtlVirtualUnwind
KERNEL32.dll1440UnhandledExceptionFilter
KERNEL32.dll1375SetUnhandledExceptionFilter
KERNEL32.dll1406TerminateProcess
KERNEL32.dll1087QueryPerformanceCounter
KERNEL32.dll554GetCurrentProcessId
KERNEL32.dll558GetCurrentThreadId
KERNEL32.dll763GetSystemTimeAsFileTime
KERNEL32.dll791GetTickCount
KERNEL32.dll338EnumResourceLanguagesA
KERNEL32.dll1006MulDiv
KERNEL32.dll569GetDiskFreeSpaceA
KERNEL32.dll1561_lclose
GDI32.dll491GetDeviceCaps
USER32.dll696SendMessageA
USER32.dll728SetForegroundWindow
USER32.dll598MsgWaitForMultipleObjects
USER32.dll691SendDlgItemMessageA
USER32.dll454GetWindowLongPtrA
USER32.dll462GetWindowRect
USER32.dll427GetSystemMetrics
USER32.dll584MessageBoxA
USER32.dll621PeekMessageA
USER32.dll678ReleaseDC
USER32.dll319GetDlgItem
USER32.dll787SetWindowPos
USER32.dll804ShowWindow
USER32.dll783SetWindowLongPtrA
USER32.dll181DispatchMessageA
USER32.dll791SetWindowTextA
USER32.dll229EnableWindow
USER32.dll29CallWindowProcA
USER32.dll175DialogBoxIndirectParamA
USER32.dll321GetDlgItemTextA
USER32.dll562LoadStringA
USER32.dll583MessageBeep
USER32.dll57CharUpperA
USER32.dll47CharNextA
USER32.dll261ExitWindowsEx
USER32.dll50CharPrevA
USER32.dll232EndDialog
USER32.dll314GetDesktopWindow
USER32.dll724SetDlgItemTextA
USER32.dll311GetDC
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll196_commode
msvcrt.dll281_fmode
msvcrt.dll148_acmdln
msvcrt.dll83__C_specific_handler
msvcrt.dll367_initterm
msvcrt.dll130__setusermatherr
msvcrt.dll395_ismbblead
msvcrt.dll179_cexit
msvcrt.dll256_exit
msvcrt.dll1060exit
msvcrt.dll128__set_app_type
msvcrt.dll113__getmainargs
msvcrt.dll160_amsg_exit
msvcrt.dll82_XcptFilter
msvcrt.dll1157memcpy_s
msvcrt.dll853_vsnprintf
msvcrt.dll1156memcpy
msvcrt.dll1160memset
COMCTL32.dll17
Cabinet.dll23
Cabinet.dll21
Cabinet.dll22
Cabinet.dll20
VERSION.dllGetFileVersionInfoA
VERSION.dll4GetFileVersionInfoSizeA
VERSION.dll15VerQueryValueA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWin32 Cabinet Self-Extractor
FileVersion10.00.9200.16384 (win8_rtm.120725-1247)
InternalNameWextract
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWEXTRACT.EXE .MUI
ProductNameWindows® Internet Explorer
ProductVersion10.00.9200.16384

VS_FIXEDFILEINFO

FileVersion10.0.9200.16384
ProductVersion10.0.9200.16384
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
aa3811794AVI#
1083455762PNG(256 x 256)#
1e20671162BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 194560 bytes (190 KiB)


--
Type = PE
Physical Size = 194560
CPU = x64
64-bit = +
Characteristics = Executable LargeAddress
Created = 2012-07-26 02:10:04
Headers Size = 1024
Checksum = 206875
Name = WEXTRACT.EXE            .MUI
Image Size = 221184
Section Alignment = 4096
File Alignment = 512
Code Size = 31744
Initialized Data Size = 161792
Uninitialized Data Size = 0
Linker Version = 10.10
OS Version = 6.2
Image Version = 6.2
Subsystem Version = 6.1
Subsystem = Windows GUI
DLL Characteristics = Relocated NX-Compatible TerminalServerAware 0x20
Stack Reserve = 524288
Stack Commit = 8192
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 5368709120
Comment = FileVersion: 10.0.9200.16384
FileVersion: 10.00.9200.16384 (win8_rtm.120725-1247)
ProductVersion: 10.0.9200.16384
ProductVersion: 10.00.9200.16384
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Windows® Internet Explorer
----
Path = .rsrc/RCDATA/CABINET
Size = 41941
Packed Size = 41941
--
Path = .rsrc/RCDATA/CABINET
Type = Cab
Physical Size = 41941
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 20804

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2015-04-01 01:22:50 ....A        11543               eb596ff5-558b-4e9c-9b35-11b7dde35770.inf
2015-04-01 01:22:50 ....A          155               eb596ff5-558b-4e9c-9b35-11b7dde35770.cmp
2015-04-01 01:22:50 ....A         3616               eb596ff5-558b-4e9c-9b35-11b7dde35770.cms
2015-04-01 01:22:50 ....A           71               routes.txt
2015-04-01 01:22:48 ....A        35840               cmroute.dll
2015-04-01 01:22:50 ....A         1030               eb596ff5-558b-4e9c-9b35-11b7dde35770.cer
2015-04-01 01:22:50 ....A         2284               eb596ff5-558b-4e9c-9b35-11b7dde35770.pbk
2015-04-01 01:22:50 ....A         5430               azurebox16.ico
2015-04-01 01:22:50 ....A         4286               azurebox32.ico
2015-04-01 01:22:50 ....A       138934               azurevpnbanner.bmp
------------------- ----- ------------ ------------  ------------------------
2015-04-01 01:22:50             203189       194560  10 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER