filenamearial32.exe
size554208 (0x874e0)
md59637df0e91703179f0723ec095a36cb5
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x33cb637c
PointerToSymbolTable0
NumberOfSymbols0x2e3
SizeOfOptionalHeader0xe0
Characteristics0x303
Magic0x10b
LinkerVersion6.0
SizeOfCode0x9000
SizeOfInitializedData0x7ca00
SizeOfUninitializedData0
AddressOfEntryPoint0x2723
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion5.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x89000
SizeOfHeaders0x200
CheckSum0x16187
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0 SPx

Sections

namevavsizeraw sizeflags
.text0x10000x8e480x9000R-X CODE
.data0xa0000x1c0c0x400RW- IDATA
.rsrc0xc0000x7d0000x7c600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x93640x8c
RESOURCE0xc0000x7c5a0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12000x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x1fc
Delay_IAT00
CLR_Header00
typenamesizecp
AVI#3001118021252
ICON#17441252
ICON#22961252
DIALOG#20017161252
DIALOG#20023941252
DIALOG#20033201252
DIALOG#20044061252
DIALOG#20052701252
DIALOG#20062501252
STRING#631401252
STRING#66641252
STRING#7615461252
STRING#7715241252
STRING#8012001252
STRING#827921252
STRING#8312721252
STRING#8513161252
RCDATAADMQCMD71252
RCDATACABINET4781031252
RCDATAEXTRACTOPT41252
RCDATAFILESIZES361252
RCDATAFINISHMSG361252
RCDATALICENSE49251252
RCDATAPACKINSTSPACE41252
RCDATAPOSTRUNPROGRAM71252
RCDATAREBOOT41252
RCDATARUNPROGRAM131252
RCDATASHOWWINDOW41252
RCDATATITLE261252
RCDATAUPROMPT71252
RCDATAUSRQCMD71252
GROUP_ICON#3000341252
VERSION#110001252
idlangstring
10001033Please select a folder to store the extracted files.
10011033%s
10501033DEBUG: <%s> <%s>
12001033Failed to get disk space information from: %s. System Message: %s.
12011033A required resource cannot be located.
12021033Are you sure you want to cancel?
12041033Unable to retrieve operating system version information.
12051033Memory allocation request failed.
12061033Unable to register window class.
12071033Failed to create requested window.
12081033Unable to create extraction thread.
12091033No valid folder can be located for extracted files.
12101033Cabinet is not valid.
12111033Filetable full.
12121033Can not change to destination folder.
12131033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.
12141033That folder is invalid. Please make sure the folder exists and is writable.
12151033You must specify a folder with fully qualified pathname or choose Cancel.
12161033Could not update folder edit box.
12171033Could not load functions required for browser dialog.
12181033Could not load Shell32.dll required for browser dialog.
12191033Installation failed.
12201033Error creating process <%s>. Reason: %s
12211033The cluster size in this system is not supported.
12221033A required resource appears to be corrupted.
12231033Windows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
12241033Error loading %s
12251033GetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used.
12261033Windows 95 or Windows NT is required to install
12271033Could not create folder '%s'
12281033To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue. Do you still want to continue?
12641033Error retrieving Windows folder
12691033NT Shutdown: OpenProcessToken error.
12701033NT Shutdown: AdjustTokenPrivileges error.
12711033NT Shutdown: ExitWindowsEx error.
12721033Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.
12731033The setup program could not retrieve the volume information for drive (%s) . System message: %s.
12741033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.
12751033The installation program appears to be damaged or corrupted. Contact the vendor of this application.
13001033FDI Extraction completed successfully.
13011033Cabinet file not found.
13021033Cabinet is not formed properly.
13041033Cabinet data is corrupt. This executable is damaged and installation is not possible.
13051033FDI memory allocation failure.
13061033FDI compression type not supported.
13071033FDI decompression failure.
13081033Unable to create a requested file.
13091033Cabinet reserve size mismatch.
13101033Wrong cabinet file.
13111033FDI user canceled or halted.
13121033Command line option syntax error. Type Command /? for Help.
13131033Command line options: /Q -- Quiet modes for package, /T:<full path> -- Specifies temporary working folder, /C -- Extract files only to the folder when used also with /T. /C:<Cmd> -- Override Install Command defined by author.
13141033You must restart your computer before the new settings will take effect. Do you want to restart your computer now?
13151033You must restart your computer before the new settings will take effect. Do you want to restart your computer now?
13161033Another copy of the '%s' package is already running on your system. Do you want to run another copy?
13511033You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
13521033There is not enough free space in the Windows temp folder or in the current folder. Please enter a new folder below.
13531033The setup program is preparing to run. Please wait...
13541033The folder '%s' does not exist. Do you want to create it?
13551033Another copy of the '%s' package is already running on your system. You can only run one copy at a time.
13561033The '%s' package is not compatible with the version of Windows you are running.
13571033The '%s' package is not compatible with the version of the file: %s on your system.
module_namehintordfunction_name
ADVAPI32.dll303RegCloseKey
ADVAPI32.dll135EqualSid
ADVAPI32.dll19AllocateAndInitializeSid
ADVAPI32.dll183GetTokenInformation
ADVAPI32.dll283OpenProcessToken
ADVAPI32.dll18AdjustTokenPrivileges
ADVAPI32.dll215LookupPrivilegeValueA
ADVAPI32.dll137FreeSid
ADVAPI32.dll312RegDeleteValueA
ADVAPI32.dll326RegOpenKeyExA
ADVAPI32.dll345RegSetValueExA
ADVAPI32.dll334RegQueryValueExA
ADVAPI32.dll307RegCreateKeyExA
ADVAPI32.dll329RegQueryInfoKeyA
KERNEL32.dll695lstrcatA
KERNEL32.dll239GetFileAttributesA
KERNEL32.dll303GetShortPathNameA
KERNEL32.dll283GetPrivateProfileStringA
KERNEL32.dll277GetPrivateProfileIntA
KERNEL32.dll218GetCurrentProcess
KERNEL32.dll710lstrlenA
KERNEL32.dll701lstrcmpiA
KERNEL32.dll704lstrcpyA
KERNEL32.dll261GetModuleFileNameA
KERNEL32.dll157FreeLibrary
KERNEL32.dll421LocalAlloc
KERNEL32.dll251GetLastError
KERNEL32.dll314GetSystemDirectoryA
KERNEL32.dll415LoadLibraryA
KERNEL32.dll131FindClose
KERNEL32.dll140FindNextFileA
KERNEL32.dll79DeleteFileA
KERNEL32.dll562SetFileAttributesA
KERNEL32.dll698lstrcmpA
KERNEL32.dll135FindFirstFileA
KERNEL32.dll688_lclose
KERNEL32.dll690_llseek
KERNEL32.dll691_lopen
KERNEL32.dll346GetWindowsDirectoryA
KERNEL32.dll287GetProcAddress
KERNEL32.dll505RemoveDirectoryA
KERNEL32.dll368GlobalUnlock
KERNEL32.dll361GlobalLock
KERNEL32.dll350GlobalAlloc
KERNEL32.dll112ExitProcess
KERNEL32.dll263GetModuleHandleA
KERNEL32.dll305GetStartupInfoA
KERNEL32.dll24CloseHandle
KERNEL32.dll420LoadResource
KERNEL32.dll142FindResourceA
KERNEL32.dll56CreateMutexA
KERNEL32.dll559SetEvent
KERNEL32.dll46CreateEventA
KERNEL32.dll551SetCurrentDirectoryA
KERNEL32.dll67CreateThread
KERNEL32.dll507ResetEvent
KERNEL32.dll610TerminateThread
KERNEL32.dll342GetVersionExA
KERNEL32.dll425LocalFree
KERNEL32.dll237GetExitCodeProcess
KERNEL32.dll652WaitForSingleObject
KERNEL32.dll61CreateProcessA
KERNEL32.dll326GetTempPathA
KERNEL32.dll159FreeResource
KERNEL32.dll434LockResource
KERNEL32.dll601SizeofResource
KERNEL32.dll49CreateFileA
KERNEL32.dll493ReadFile
KERNEL32.dll669WriteFile
KERNEL32.dll564SetFilePointer
KERNEL32.dll565SetFileTime
KERNEL32.dll423LocalFileTimeToFileTime
KERNEL32.dll84DosDateTimeToFileTime
KERNEL32.dll324GetTempFileNameA
KERNEL32.dll316GetSystemInfo
KERNEL32.dll226GetDiskFreeSpaceA
KERNEL32.dll230GetDriveTypeA
KERNEL32.dll707lstrcpynA
KERNEL32.dll344GetVolumeInformationA
KERNEL32.dll216GetCurrentDirectoryA
KERNEL32.dll416LoadLibraryExA
KERNEL32.dll177GetCommandLineA
KERNEL32.dll42CreateDirectoryA
KERNEL32.dll357GlobalFree
KERNEL32.dll152FormatMessageA
KERNEL32.dll406IsDBCSLeadByte
GDI32.dll224GetDeviceCaps
USER32.dll185EndDialog
USER32.dll660wsprintfA
USER32.dll211ExitWindowsEx
USER32.dll35CharNextA
USER32.dll45CharUpperA
USER32.dll250GetDesktopWindow
USER32.dll581SetWindowLongA
USER32.dll331GetWindowLongA
USER32.dll20CallWindowProcA
USER32.dll253GetDlgItem
USER32.dll542SetForegroundWindow
USER32.dll587SetWindowTextA
USER32.dll509SendDlgItemMessageA
USER32.dll183EnableWindow
USER32.dll255GetDlgItemTextA
USER32.dll514SendMessageA
USER32.dll149DispatchMessageA
USER32.dll414LoadStringA
USER32.dll463PeekMessageA
USER32.dll432MessageBoxA
USER32.dll38CharPrevA
USER32.dll584SetWindowPos
USER32.dll497ReleaseDC
USER32.dll248GetDC
USER32.dll336GetWindowRect
USER32.dll599ShowWindow
USER32.dll144DialogBoxIndirectParamA
USER32.dll538SetDlgItemTextA
USER32.dll431MessageBeep
USER32.dll444MsgWaitForMultipleObjects
COMCTL32.dll17
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dll10VerQueryValueA
VERSION.dllGetFileVersionInfoA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWin32 Cabinet Self-Extractor
FileVersion4.71.1015.0
InternalNameWextract
LegalCopyrightCopyright (C) Microsoft Corp. 1995
OriginalFilenameWEXTRACT.EXE
ProductNameMicrosoft(R) Windows NT(R) Operating System
ProductVersion4.71.1015.0

VS_FIXEDFILEINFO

FileVersion4.71.1015.0
ProductVersion4.71.1015.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0551424EXE07/15/1997 11:48:12#
15c115HTM#
ac0011794AVI#
86a002784BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 554208 bytes (542 KiB)


--
Type = PE
WARNING = Checksum error
Physical Size = 554208
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoDebugInfo
Created = 1997-07-15 11:48:12
Headers Size = 512
Checksum = 90503
Name = WEXTRACT.EXE            
Image Size = 561152
Section Alignment = 4096
File Alignment = 512
Code Size = 36864
Initialized Data Size = 510464
Uninitialized Data Size = 0
Linker Version = 6.0
OS Version = 5.0
Image Version = 5.0
Subsystem Version = 4.0
Subsystem = Windows GUI
Stack Reserve = 262144
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 16777216
Comment = FileVersion: 4.71.1015.0
ProductVersion: 4.71.1015.0
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
InternalName: Wextract                
LegalCopyright: Copyright (C) Microsoft Corp. 1995
OriginalFilename: WEXTRACT.EXE            
ProductName: Microsoft(R) Windows NT(R) Operating System
----
Path = .rsrc/RCDATA/CABINET
Size = 478103
Packed Size = 478103
--
Path = .rsrc/RCDATA/CABINET
Type = Cab
Physical Size = 478103
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 5747

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
1998-11-12 19:43:34 .....        45568               FONTINST.EXE
2000-07-17 09:59:56 ....A           58               fontinst.inf
2000-05-11 11:45:10 ....A       206132               Ariali.TTF
2000-05-11 11:45:04 ....A       286620               Arialbd.TTF
2000-05-11 11:45:06 ....A       224692               Arialbi.TTF
2000-05-11 11:45:02 ....A       275572               Arial.TTF
------------------- ----- ------------ ------------  ------------------------
2000-07-17 09:59:56            1038642       554208  6 files

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK