filenameCCF1752CC8D9DD704B838FBD264C83EEE680BED3FBF128E0674A012C3A39DAF5.bin
size30720 (0x7800)
md5911a8d2a85b1bba7efc93a54d891c6a2
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
150204133
149210222
1312102220
147210224
123507277
1098
132210227
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x51a79cae
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x5400
SizeOfInitializedData0x2000
SizeOfUninitializedData0
AddressOfEntryPoint0x5de7
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x400
CheckSum0x1155c
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x53ef0x5400R-X CODE
.rdata0x70000x13640x1400R-- IDATA
.data0x90000x6c40x200RW- IDATA
.rsrc0xa0000x2b00x400R-- IDATA
.reloc0xb0000x4c80x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x780c0x78
RESOURCE0xa0000x2b0
EXCEPTION00
SECURITY00
BASERELOC0xb0000x3e8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x73a80x40
Bound_IAT00
IAT0x70000x19c
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#15981252
module_namehintordfunction_name
KERNEL32.dll783Module32Next
KERNEL32.dll781Module32First
KERNEL32.dll1170WritePrivateProfileStringA
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll1057Sleep
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll819OpenProcess
KERNEL32.dll1109VirtualAllocEx
KERNEL32.dll544GetProcAddress
KERNEL32.dll152CreateRemoteThread
KERNEL32.dll875ReadProcessMemory
KERNEL32.dll172CreateToolhelp32Snapshot
KERNEL32.dll1174WriteProcessMemory
KERNEL32.dll1112VirtualFreeEx
KERNEL32.dll872ReadFile
KERNEL32.dll468GetFileSize
KERNEL32.dll120CreateFileA
KERNEL32.dll450GetEnvironmentVariableA
KERNEL32.dll1115VirtualProtectEx
KERNEL32.dll754LoadLibraryExA
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll835Process32First
KERNEL32.dll67CloseHandle
KERNEL32.dll1114VirtualProtect
KERNEL32.dll837Process32Next
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll1069TerminateProcess
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll701InterlockedExchange
KERNEL32.dll852QueryPerformanceCounter
USER32.dll400GetWindowThreadProcessId
USER32.dll775wsprintfA
USER32.dll240FindWindowA
ADVAPI32.dll400LookupPrivilegeValueA
ADVAPI32.dll30AdjustTokenPrivileges
ADVAPI32.dll497OpenProcessToken
MSVCP90.dll379public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(void)

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

MSVCP90.dll1588public: char const * __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::c_str(void)const

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

MSVCP90.dll691public: class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > & __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::operator=(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const &)

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

MSVCP90.dll607public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::~basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(void)

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

MSVCP90.dll862public: class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > & __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::operator+=(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const &)

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

MSVCP90.dll367public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const &)

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

MSVCP90.dll2017public: unsigned int __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::find(char, unsigned int)const

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z

MSVCP90.dll374public: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(char const *)

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

MSVCR90.dll1379strtok
MSVCR90.dll522_invalid_parameter_noinfo
MSVCR90.dll90_CxxThrowException
MSVCR90.dll8public: __thiscall std::exception::exception(class std::exception const &)

??0exception@std@@QAE@ABV01@@Z

MSVCR90.dll9public: __thiscall std::exception::exception(void)

??0exception@std@@QAE@XZ

MSVCR90.dll13public: virtual __thiscall std::exception::~exception(void)

??1exception@std@@UAE@XZ

MSVCR90.dll115__CxxFrameHandler3
MSVCR90.dll6public: __thiscall std::exception::exception(char const * const &)

??0exception@std@@QAE@ABQBD@Z

MSVCR90.dll70public: virtual char const * __thiscall std::exception::what(void)const

?what@exception@std@@UBEPBDXZ

MSVCR90.dll998_unlock
MSVCR90.dll150__dllonexit
MSVCR90.dll362_encode_pointer
MSVCR90.dll630_lock
MSVCR90.dll796_onexit
MSVCR90.dll352_decode_pointer
MSVCR90.dll277_amsg_exit
MSVCR90.dll159__getmainargs
MSVCR90.dll300_cexit
MSVCR90.dll17void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR90.dll102_XcptFilter
MSVCR90.dll549_ismbblead
MSVCR90.dll1228exit
MSVCR90.dll253_acmdln
MSVCR90.dll516_initterm
MSVCR90.dll517_initterm_e
MSVCR90.dll316_configthreadlocale
MSVCR90.dll227__setusermatherr
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll203__p__commode
MSVCR90.dll207__p__fmode
MSVCR90.dll224__set_app_type
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll54public: void __thiscall type_info::_type_info_dtor_internal_method(void)

?_type_info_dtor_internal_method@type_info@@QAEXXZ

MSVCR90.dll371_except_handler4_common
MSVCR90.dll523_invoke_watson
MSVCR90.dll319_controlfp_s
MSVCR90.dll1322memset
MSVCR90.dll1367strlen
MSVCR90.dll1361strcpy
MSVCR90.dll1356strcat
MSVCR90.dll1359strcmp
MSVCR90.dll1318memcpy
MSVCR90.dll380_exit
MSVCR90.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR90.dll922_stricmp
offsetsizetypecomment
030720EXE05/30/2013 18:38:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK