VJF 1.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	VJF 1.exe
size	282624 (0x45000)
md5	92f41793668b39e40b15e613178ef72e

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
138	21022	22
123	50727	16
203	50214	3
1	0	159
131	21022	1
132	21022	47
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x56c73669
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x19000
SizeOfInitializedData	0x2ea00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x15bfd
BaseOfCode	0x1000
BaseOfData	0x1a000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x4b000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8540
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x18f6e	0x19000	R-X CODE
.rdata	0x1a000	0x1bff4	0x1c000	R-- IDATA
.data	0x36000	0x1119c	0xe400	RW- IDATA
.CRT	0x48000	0x10	0x200	R-- IDATA
.reloc	0x49000	0x15b6	0x1600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3528c	0xc8
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x49000	0x1420
DEBUG	0x1a2a0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1a000	0x2a0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
ntdll.dll	92		memset
ntdll.dll	39		_stricmp
ntdll.dll	113		strtoul
ntdll.dll	100		strchr
ntdll.dll	109		strrchr
ntdll.dll	61		atoi
ntdll.dll	41		_strnicmp
ntdll.dll	106		strncmp
ntdll.dll	91		memmove
ntdll.dll	116		tolower
ntdll.dll	76		isspace
ntdll.dll	74		isprint
ntdll.dll	52		_wcsicmp
ntdll.dll	101		strcmp
ntdll.dll	89		memcmp
ntdll.dll	128		wcslen
ntdll.dll	135		wcsstr
ntdll.dll	22		_chkstk
ntdll.dll	104		strlen
ntdll.dll	90		memcpy
ntdll.dll	14		_allrem
ntdll.dll	10		_alldiv
ntdll.dll	50		_vsnprintf
ntdll.dll	16		_allshr
WS2_32.dll		2
WS2_32.dll		13
WS2_32.dll		18
WS2_32.dll		9
WS2_32.dll		11
WS2_32.dll		3
WS2_32.dll		151
WS2_32.dll		16
WS2_32.dll		19
WS2_32.dll		52
WS2_32.dll		22
WS2_32.dll		23
WS2_32.dll		4
WS2_32.dll		10
WS2_32.dll		1
WS2_32.dll		111
WS2_32.dll		115
KERNEL32.dll	1146		WideCharToMultiByte
KERNEL32.dll	819		OpenProcess
KERNEL32.dll	554		GetProcessTimes
KERNEL32.dll	852		QueryPerformanceCounter
KERNEL32.dll	700		InterlockedDecrement
KERNEL32.dll	704		InterlockedIncrement
KERNEL32.dll	518		GetNativeSystemInfo
KERNEL32.dll	1057		Sleep
KERNEL32.dll	428		GetCurrentThread
KERNEL32.dll	260		ExitProcess
KERNEL32.dll	264		ExpandEnvironmentStringsW
KERNEL32.dll	502		GetModuleHandleA
KERNEL32.dll	614		GetTickCount
KERNEL32.dll	67		CloseHandle
KERNEL32.dll	163		CreateThread
KERNEL32.dll	117		CreateEventW
KERNEL32.dll	692		InitializeCriticalSection
KERNEL32.dll	190		DeleteCriticalSection
KERNEL32.dll	261		ExitThread
KERNEL32.dll	906		ResetEvent
KERNEL32.dll	751		LeaveCriticalSection
KERNEL32.dll	217		EnterCriticalSection
KERNEL32.dll	1124		WaitForSingleObject
KERNEL32.dll	979		SetEvent
KERNEL32.dll	909		ResumeThread
KERNEL32.dll	151		CreateProcessW
KERNEL32.dll	127		CreateFileW
KERNEL32.dll	195		DeleteFileW
KERNEL32.dll	1165		WriteFile
KERNEL32.dll	991		SetFilePointer
KERNEL32.dll	973		SetEndOfFile
KERNEL32.dll	872		ReadFile
KERNEL32.dll	468		GetFileSize
KERNEL32.dll	838		Process32NextW
KERNEL32.dll	836		Process32FirstW
KERNEL32.dll	114		CreateEventA
KERNEL32.dll	426		GetCurrentProcessId
KERNEL32.dll	486		GetLastError
KERNEL32.dll	425		GetCurrentProcess
KERNEL32.dll	875		ReadProcessMemory
KERNEL32.dll	505		GetModuleHandleW
KERNEL32.dll	152		CreateRemoteThread
KERNEL32.dll	1069		TerminateProcess
KERNEL32.dll	547		GetProcessHeap
KERNEL32.dll	669		HeapAlloc
KERNEL32.dll	676		HeapReAlloc
KERNEL32.dll	673		HeapFree
KERNEL32.dll	1116		VirtualQuery
KERNEL32.dll	544		GetProcAddress
KERNEL32.dll	753		LoadLibraryA
KERNEL32.dll	1112		VirtualFreeEx
KERNEL32.dll	1109		VirtualAllocEx
KERNEL32.dll	837		Process32Next
KERNEL32.dll	835		Process32First
KERNEL32.dll	202		DeviceIoControl
KERNEL32.dll	120		CreateFileA
KERNEL32.dll	630		GetVersionExW
KERNEL32.dll	765		LocalFree
KERNEL32.dll	1111		VirtualFree
KERNEL32.dll	1108		VirtualAlloc
KERNEL32.dll	148		CreateProcessA
KERNEL32.dll	761		LocalAlloc
KERNEL32.dll	101		CopyFileW
KERNEL32.dll	986		SetFileAttributesW
KERNEL32.dll	896		RemoveDirectoryW
KERNEL32.dll	887		ReleaseMutex
KERNEL32.dll	816		OpenMutexW
KERNEL32.dll	142		CreateMutexW
KERNEL32.dll	1093		UnregisterWait
KERNEL32.dll	756		LoadLibraryW
KERNEL32.dll	882		RegisterWaitForSingleObject
KERNEL32.dll	807		OpenEventA
KERNEL32.dll	139		CreateMutexA
KERNEL32.dll	853		QueryPerformanceFrequency
KERNEL32.dll	629		GetVersionExA
KERNEL32.dll	1174		WriteProcessMemory
KERNEL32.dll	649		GlobalFindAtomW
KERNEL32.dll	644		GlobalAddAtomW
KERNEL32.dll	546		GetProcessHandleCount
KERNEL32.dll	1115		VirtualProtectEx
KERNEL32.dll	212		DuplicateHandle
KERNEL32.dll	332		FreeLibrary
KERNEL32.dll	794		MultiByteToWideChar
KERNEL32.dll	1122		WaitForMultipleObjects
KERNEL32.dll	172		CreateToolhelp32Snapshot
KERNEL32.dll	1004		SetLastError
USER32.dll	528		OpenDesktopA
USER32.dll	85		CreateDesktopA
USER32.dll	72		CloseDesktop
USER32.dll	74		CloseWindowStation
USER32.dll	756		VkKeyScanA
USER32.dll	605		SendInput
USER32.dll	626		SetCursorPos
USER32.dll	669		SetThreadDesktop
USER32.dll	653		SetProcessWindowStation
USER32.dll	453		IsWindow
USER32.dll	106		CreateWindowStationW
USER32.dll	45		CharNextA
ADVAPI32.dll	497		OpenProcessToken
ADVAPI32.dll	30		AdjustTokenPrivileges
ADVAPI32.dll	282		FreeSid
ADVAPI32.dll	77		CheckTokenMembership
ADVAPI32.dll	31		AllocateAndInitializeSid
ADVAPI32.dll	103		ConvertSidToStringSidA
ADVAPI32.dll	340		GetTokenInformation
ADVAPI32.dll	688		SetSecurityDescriptorDacl
ADVAPI32.dll	689		SetSecurityDescriptorGroup
ADVAPI32.dll	369		InitializeSecurityDescriptor
ADVAPI32.dll	337		GetSidSubAuthority
ADVAPI32.dll	370		InitializeSid
ADVAPI32.dll	336		GetSidLengthRequired
ADVAPI32.dll	599		RegNotifyChangeKeyValue
ADVAPI32.dll	401		LookupPrivilegeValueW
SHELL32.dll	169		SHFileOperationW
ole32.dll	315		StringFromGUID2
ole32.dll	15		CoCreateGuid
SHLWAPI.dll	57		PathCombineA
PSAPI.DLL	18		GetPerformanceInfo

show previews

offset	size	type	comment
0	282624	EXE	02/19/2016 15:36:09	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK