filenameIVNMoqEHGuUfSuT.exe
size448000 (0x6d600)
md591d3c6e43d04bef843b266221ceafa92
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xac8

Rich Header

lib idversiontimes used
Rich Header present, but decode failed.
Checkhexdump&log

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x3456627a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x306
Magic0x10b
LinkerVersion2.2
SizeOfCode0x4000
SizeOfInitializedData0x15000
SizeOfUninitializedData0x6b000
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion3.0
ImageVersion4.0
SubsystemVersion4.2
Reserved10
SizeOfImage0x821a0
SizeOfHeaders0xe00
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
code0x10000x41000xc00R-- UDATA DISCARDABLE
.data0x60000x13f000x4e00RW- CODE UDATA
.RSRC0x1a0000x670000x66a00R-- CODE UDATA
reloc0x810000x6000x200RW- CODE UDATA
.date0x820000x1a00x200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x62300x154
RESOURCE0x1a0000x66a00
EXCEPTION00
SECURITY0x10000x2c86
BASERELOC0x70000xc90
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x60000x230
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#14130
ICON#1169360
GROUP_ICON#1200
MENU#322150
MENU#332210
MENU#341120
MENU#354210
MENU#34240
module_namehintordfunction_name
advapi32.dllAddAuditAccessAce
advapi32.dllAddAuditAccessAceEx
advapi32.dllAddAuditAccessObjectAce
advapi32.dllAddUsersToEncryptedFile
advapi32.dllAdjustTokenGroups
advapi32.dllAdjustTokenPrivileges
advapi32.dllAllocateAndInitializeSid
advapi32.dllAllocateLocallyUniqueId
advapi32.dllAreAllAccessesGranted
advapi32.dllAreAnyAccessesGranted
advapi32.dllBackupEventLogA
advapi32.dllBackupEventLogW
authz.dllAuthziAllocateAuditParams
authz.dllAuthziFreeAuditEventType
authz.dllAuthziFreeAuditParams
authz.dllAuthziFreeAuditQueue
authz.dllAuthziInitializeAuditEvent
authz.dllAuthziInitializeAuditEventType
authz.dllAuthziInitializeAuditParams
authz.dllAuthziInitializeAuditParamsFromArray
authz.dllAuthziInitializeAuditParamsWithRM
authz.dllAuthziInitializeAuditQueue
authz.dllAuthziLogAuditEvent
authz.dllAuthziModifyAuditEvent
authz.dllAuthziModifyAuditEventType
authz.dllAuthziModifyAuditQueue
authz.dllAuthziSourceAudit
authz.dllAuthzFreeAuditEvent
avicap32.DLLcapCreateCaptureWindowA
avicap32.DLLcapGetDriverDescriptionA
msvcrt.dllfread
msvcrt.dllfopen
rasman.dllRasConnectionEnum
kernel32.dllSetErrorMode
kernel32.dllSetFilePointer
kernel32.dllDecodePointer
kernel32.dllCreateMutexA
kernel32.dllGetOEMCP
kernel32.dllExitProcess
kernel32.dllGetCommState
kernel32.dllGetCommandLineA
kernel32.dllGetSystemDirectoryA
DNSAPI.dllDnsQueryConfig
DNSAPI.dllDnsQueryConfigAllocEx
DNSAPI.dllDnsQueryConfigDword
DNSAPI.dllDnsQueryExA
DNSAPI.dllDnsQueryExUTF8
DNSAPI.dllDnsQueryExW
NDdeApi.dllNDdeGetErrorStringA
pstorec.dllPStoreCreateInstance
rasman.dllIsRasmanProcess
rasman.dllRasActivateRoute
rasman.dllRasActivateRouteEx
rasman.dllRasAddConnectionPort
rasman.dllRasPortSetInfo
rasman.dllRasAllocateRoute
rasman.dllRasBundleClearStatistics
rasman.dllRasBundleClearStatisticsEx
rasman.dllRasBundleGetPort
rasman.dllRasBundleGetStatistics
rasman.dllRasBundleGetStatisticsEx
rasman.dllRasCompressionGetInfo
rasman.dllRasCompressionSetInfo
rasman.dllRasConnectionEnum
rasman.dllRasConnectionGetStatistics
rasman.dllRasCreateConnection
rasman.dllRasDeAllocateRoute
rasman.dllRasDestroyConnection
rasman.dllRasDeviceConnect
REGAPI.dllRegBuildNumberQuery
REGAPI.dllRegCdCreateA
REGAPI.dllRegCdCreateW
REGAPI.dllRegCdDeleteA
REGAPI.dllRegCdDeleteW
REGAPI.dllRegCdEnumerateA
REGAPI.dllRegCdEnumerateW
REGAPI.dllRegCdQueryA
REGAPI.dllRegCdQueryW
REGAPI.dllRegCloseServer
REGAPI.dllRegConsoleShadowQueryA
REGAPI.dllRegConsoleShadowQueryW
REGAPI.dllRegDefaultUserConfigQueryA
REGAPI.dllRegDefaultUserConfigQueryW
atl.dllAtlAxAttachControl
atl.dllAtlComPtrAssign
mprapi.dllMprAdminInterfaceCreate
DNSAPI.dllDnsQueryConfig
DNSAPI.dllDnsQueryConfigAllocEx
DNSAPI.dllDnsQueryConfigDword
DNSAPI.dllDnsQueryExA
DNSAPI.dllDnsQueryExUTF8
DNSAPI.dllDnsQueryExW
DNSAPI.dllDnsQuery_A
DNSAPI.dllDnsQuery_UTF8
DNSAPI.dllDnsQuery_W
DNSAPI.dllDnsRecordBuild_UTF8
DNSAPI.dllDnsRecordBuild_W
DNSAPI.dllDnsRecordCompare
DNSAPI.dllDnsRecordCopyEx
DNSAPI.dllDnsRecordListFree
DNSAPI.dllDnsRecordSetCompare
DNSAPI.dllDnsRecordSetCopyEx
netapi32.dllDsGetDcCloseW
netapi32.dllDsGetDcNameA
netapi32.dllDsGetDcNameW
netapi32.dllDsGetDcNameWithAccountA
netapi32.dllDsGetDcNameWithAccountW
netapi32.dllDsGetDcNextA
netapi32.dllDsGetDcNextW
netapi32.dllDsGetDcOpenA
netapi32.dllDsGetDcOpenW
netapi32.dllDsGetDcSiteCoverageA
netapi32.dllDsGetDcSiteCoverageW
netapi32.dllDsGetForestTrustInformationW
netapi32.dllDsGetSiteNameA
netapi32.dllDsGetSiteNameW
quartz.dllAmpFactorToDB

No certificates in

undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass
No certificates in
undefined method `type' for nil:NilClass

Cannot call to_der on

undefined method `type' for nil:NilClass
offsetsizetypecomment
15c115HTM#
15d0442416BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[!] PEdump::WIN_CERTIFICATE: too big length 2215575801
[!] PEdump::WIN_CERTIFICATE: too big length 3296973291
[!] PEdump::WIN_CERTIFICATE: too big length 4294966869
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 3498796754
[!] PEdump::WIN_CERTIFICATE: too big length 63111997
[!] PEdump::WIN_CERTIFICATE: too big length 3921740514
[!] PEdump::WIN_CERTIFICATE: too big length 1752432640
[!] PEdump::WIN_CERTIFICATE: too big length 4218908
[!] PEdump::WIN_CERTIFICATE: too big length 3246508339
[!] PEdump::WIN_CERTIFICATE: too big length 79987536
[!] PEdump::WIN_CERTIFICATE: too big length 1499083263
[!] PEdump::WIN_CERTIFICATE: too big length 301105152
[!] PEdump::WIN_CERTIFICATE: too big length 2337281672
[!] PEdump::WIN_CERTIFICATE: too big length 3296942320
[!] PEdump::WIN_CERTIFICATE: too big length 3677608755
[!] PEdump::WIN_CERTIFICATE: too big length 4294967074
[!] PEdump::WIN_CERTIFICATE: too big length 3347185663
[!] PEdump::WIN_CERTIFICATE: too big length 258009087
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 67372164
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 2316208644
[!] PEdump::WIN_CERTIFICATE: too big length 2215575801
[!] PEdump::WIN_CERTIFICATE: too big length 3296973291
[!] PEdump::WIN_CERTIFICATE: too big length 4294966869
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 3498796754
[!] PEdump::WIN_CERTIFICATE: too big length 63111997
[!] PEdump::WIN_CERTIFICATE: too big length 3921740514
[!] PEdump::WIN_CERTIFICATE: too big length 1752432640
[!] PEdump::WIN_CERTIFICATE: too big length 4218908
[!] PEdump::WIN_CERTIFICATE: too big length 3246508339
[!] PEdump::WIN_CERTIFICATE: too big length 79987536
[!] PEdump::WIN_CERTIFICATE: too big length 1499083263
[!] PEdump::WIN_CERTIFICATE: too big length 301105152
[!] PEdump::WIN_CERTIFICATE: too big length 2337281672
[!] PEdump::WIN_CERTIFICATE: too big length 3296942320
[!] PEdump::WIN_CERTIFICATE: too big length 3677608755
[!] PEdump::WIN_CERTIFICATE: too big length 4294967074
[!] PEdump::WIN_CERTIFICATE: too big length 3347185663
[!] PEdump::WIN_CERTIFICATE: too big length 258009087
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 67372164
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 2316208644
[?] PEdump::RichHdr: dexored size(36) must be a multiple of 8
[!] PEdump::WIN_CERTIFICATE: too big length 2215575801
[!] PEdump::WIN_CERTIFICATE: too big length 3296973291
[!] PEdump::WIN_CERTIFICATE: too big length 4294966869
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 3498796754
[!] PEdump::WIN_CERTIFICATE: too big length 63111997
[!] PEdump::WIN_CERTIFICATE: too big length 3921740514
[!] PEdump::WIN_CERTIFICATE: too big length 1752432640
[!] PEdump::WIN_CERTIFICATE: too big length 4218908
[!] PEdump::WIN_CERTIFICATE: too big length 3246508339
[!] PEdump::WIN_CERTIFICATE: too big length 79987536
[!] PEdump::WIN_CERTIFICATE: too big length 1499083263
[!] PEdump::WIN_CERTIFICATE: too big length 301105152
[!] PEdump::WIN_CERTIFICATE: too big length 2337281672
[!] PEdump::WIN_CERTIFICATE: too big length 3296942320
[!] PEdump::WIN_CERTIFICATE: too big length 3677608755
[!] PEdump::WIN_CERTIFICATE: too big length 4294967074
[!] PEdump::WIN_CERTIFICATE: too big length 3347185663
[!] PEdump::WIN_CERTIFICATE: too big length 258009087
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 67372164
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 2316208644
[!] PEdump::WIN_CERTIFICATE: too big length 2215575801
[!] PEdump::WIN_CERTIFICATE: too big length 3296973291
[!] PEdump::WIN_CERTIFICATE: too big length 4294966869
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 3498796754
[!] PEdump::WIN_CERTIFICATE: too big length 63111997
[!] PEdump::WIN_CERTIFICATE: too big length 3921740514
[!] PEdump::WIN_CERTIFICATE: too big length 1752432640
[!] PEdump::WIN_CERTIFICATE: too big length 4218908
[!] PEdump::WIN_CERTIFICATE: too big length 3246508339
[!] PEdump::WIN_CERTIFICATE: too big length 79987536
[!] PEdump::WIN_CERTIFICATE: too big length 1499083263
[!] PEdump::WIN_CERTIFICATE: too big length 301105152
[!] PEdump::WIN_CERTIFICATE: too big length 2337281672
[!] PEdump::WIN_CERTIFICATE: too big length 3296942320
[!] PEdump::WIN_CERTIFICATE: too big length 3677608755
[!] PEdump::WIN_CERTIFICATE: too big length 4294967074
[!] PEdump::WIN_CERTIFICATE: too big length 3347185663
[!] PEdump::WIN_CERTIFICATE: too big length 258009087
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 67372164
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 2316208644
[!] PEdump::WIN_CERTIFICATE: too big length 2215575801
[!] PEdump::WIN_CERTIFICATE: too big length 3296973291
[!] PEdump::WIN_CERTIFICATE: too big length 4294966869
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 3498796754
[!] PEdump::WIN_CERTIFICATE: too big length 63111997
[!] PEdump::WIN_CERTIFICATE: too big length 3921740514
[!] PEdump::WIN_CERTIFICATE: too big length 1752432640
[!] PEdump::WIN_CERTIFICATE: too big length 4218908
[!] PEdump::WIN_CERTIFICATE: too big length 3246508339
[!] PEdump::WIN_CERTIFICATE: too big length 79987536
[!] PEdump::WIN_CERTIFICATE: too big length 1499083263
[!] PEdump::WIN_CERTIFICATE: too big length 301105152
[!] PEdump::WIN_CERTIFICATE: too big length 2337281672
[!] PEdump::WIN_CERTIFICATE: too big length 3296942320
[!] PEdump::WIN_CERTIFICATE: too big length 3677608755
[!] PEdump::WIN_CERTIFICATE: too big length 4294967074
[!] PEdump::WIN_CERTIFICATE: too big length 3347185663
[!] PEdump::WIN_CERTIFICATE: too big length 258009087
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 67372164
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 2316208644
[!] PEdump::WIN_CERTIFICATE: too big length 2215575801
[!] PEdump::WIN_CERTIFICATE: too big length 3296973291
[!] PEdump::WIN_CERTIFICATE: too big length 4294966869
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 3498796754
[!] PEdump::WIN_CERTIFICATE: too big length 63111997
[!] PEdump::WIN_CERTIFICATE: too big length 3921740514
[!] PEdump::WIN_CERTIFICATE: too big length 1752432640
[!] PEdump::WIN_CERTIFICATE: too big length 4218908
[!] PEdump::WIN_CERTIFICATE: too big length 3246508339
[!] PEdump::WIN_CERTIFICATE: too big length 79987536
[!] PEdump::WIN_CERTIFICATE: too big length 1499083263
[!] PEdump::WIN_CERTIFICATE: too big length 301105152
[!] PEdump::WIN_CERTIFICATE: too big length 2337281672
[!] PEdump::WIN_CERTIFICATE: too big length 3296942320
[!] PEdump::WIN_CERTIFICATE: too big length 3677608755
[!] PEdump::WIN_CERTIFICATE: too big length 4294967074
[!] PEdump::WIN_CERTIFICATE: too big length 3347185663
[!] PEdump::WIN_CERTIFICATE: too big length 258009087
[!] PEdump::WIN_CERTIFICATE: too big length 75763460
[!] PEdump::WIN_CERTIFICATE: too big length 67372164
[!] PEdump::WIN_CERTIFICATE: too big length 251921412
[!] PEdump::WIN_CERTIFICATE: too big length 2316208644