pe-scan_En.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	pe-scan_En.exe
size	54272 (0xd400)
md5	956ab00ac6bb641de40264d7658cc1a0

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
12	7291	1
19	8034	10
14	7299	2
10	8168	11
11	8168	3
4	8168	5
1	0	203
22	8168	16
6	1720	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x3da1fd78
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0xd000
SizeOfInitializedData	0x1000
SizeOfUninitializedData	0x95000
AddressOfEntryPoint	0xa2192
BaseOfCode	0x96000
BaseOfData	0xa3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xa4000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX Protector v1.0x (2)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

va	vsize	raw size	flags
0x1000	0x95000	0	RWX UDATA
0x96000	0xd000	0xc400	RWX IDATA
0xa3000	0x1000	0xc00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa38b4	0x198
RESOURCE	0xa3000	0x8b4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#6	308
BITMAP	#251	6364
BITMAP	#253	25704
BITMAP	#263	10280
ICON	#1	744
ICON	#2	744
ICON	#3	744
ICON	#4	744
ICON	#5	744
DIALOG	#134	1170
DIALOG	#137	124
DIALOG	#153	694
DIALOG	#155	82
DIALOG	#180	184
DIALOG	#234	900
DIALOG	#243	224
DIALOG	#244	642
DIALOG	#259	202
DIALOG	#266	574
DIALOG	#267	538
DIALOG	#268	120
GROUP_CURSOR	#178	20
GROUP_ICON	#132	20
GROUP_ICON	#196	20
GROUP_ICON	#198	20
GROUP_ICON	#225	20
GROUP_ICON	#227	20

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		ExitProcess
ADVAPI32.dll		RegCloseKey
GDI32.dll		GetObjectA
MFC42.DLL	1576
MSVCRT.dll		exit
SHELL32.dll		ShellExecuteA
USER32.dll		IsIconic

show previews

offset	size	type	comment
0	54272	EXE	10/07/2002 21:32:40	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x95a28

[?] can't find file_offset of VA 0x95b78

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x94e28

[?] can't find file_offset of VA 0x95128

[?] can't find file_offset of VA 0x95428

[?] can't find file_offset of VA 0x95728

[?] can't find file_offset of VA 0x935b0

[?] can't find file_offset of VA 0x93a48

[?] can't find file_offset of VA 0x93ac8

[?] can't find file_offset of VA 0x93d80

[?] can't find file_offset of VA 0x93dd8

[?] can't find file_offset of VA 0x93e90

[?] can't find file_offset of VA 0x94218

[?] can't find file_offset of VA 0x942f8

[?] can't find file_offset of VA 0x94580

[?] can't find file_offset of VA 0x94650

[?] can't find file_offset of VA 0x94890

[?] can't find file_offset of VA 0x94ab0

[?] can't find file_offset of VA 0x95b60

[?] can't find file_offset of VA 0x95110

[?] can't find file_offset of VA 0x95710

[?] can't find file_offset of VA 0x95410

[?] can't find file_offset of VA 0x95a10