magic.pe32 - avast! Antivirus Boot-time Scanner Scheduler

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	magic.pe32
size	144896 (0x23600)
md5	99d47acd008874417e1694f4f72818b1

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: b5 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x54f5444c
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x32a
Magic	0x10b
LinkerVersion	2.0
SizeOfCode	0x7c00
SizeOfInitializedData	0x1b600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x40a7
BaseOfCode	0x1000
BaseOfData	0x9000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x67000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x7acb	0x7c00	RWX CODE
.rdata	0x9000	0x155e	0x1600	R-- IDATA
.bss	0xb000	0x488fc	0x7200	RW- IDATA
.rsrc	0x54000	0x12df4	0x12e00	R-- IDATA DISCARDABLE SHARED

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x9314	0xbd
RESOURCE	0x54000	0x12df4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0x4c
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x9000	0x318
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
BITMAP	#506	74920	1252
MENU	#168	238	1252
MENU	#915	56	1252
MENU	#970	90	1252
DIALOG	#1	770	1252
RCDATA	#377	16	1252
RCDATA	#856	33	1252
VERSION	#1	648	1252

module_name	hint	function_name
msvcrt.dll	137	_amsg_exit
msvcrt.dll	75	_initterm
msvcrt.dll	291	free
msvcrt.dll	205	malloc
msvcrt.dll	183	memset
msvcrt.dll	252	_XcptFilter
msvcrt.dll	45	_vsnwprintf
msvcrt.dll	91	_purecall
msvcrt.dll	34	memcpy
USER32.DLL	106	IsRectEmpty
USER32.DLL	296	GetDesktopWindow
USER32.DLL	253	ReleaseDC
USER32.DLL	168	GetDC
GDI32.dll	146	GetSystemPaletteEntries
KERNEL32.DLL	284	GetSystemInfo
KERNEL32.DLL	233	SetUnhandledExceptionFilter
KERNEL32.DLL	122	DelayLoadFailureHook
KERNEL32.DLL	189	GetCurrentProcess
KERNEL32.DLL	67	GetSystemTimeAsFileTime
KERNEL32.DLL	42	GetCurrentProcessId
KERNEL32.DLL	60	GetCurrentThreadId
KERNEL32.DLL	197	GetTickCount
KERNEL32.DLL	28	RtlUnwind
KERNEL32.DLL	117	Sleep
KERNEL32.DLL	101	InterlockedExchange
KERNEL32.DLL	158	GetModuleFileNameA
KERNEL32.DLL	216	InterlockedIncrement
KERNEL32.DLL	46	InterlockedCompareExchange
KERNEL32.DLL	168	FreeLibrary
KERNEL32.DLL	81	InitializeCriticalSection
KERNEL32.DLL	230	QueryPerformanceCounter
KERNEL32.DLL	243	DeleteCriticalSection
KERNEL32.DLL	19	GetVersion
KERNEL32.DLL	165	GetProcAddress
KERNEL32.DLL	75	GetVersionExW
KERNEL32.DLL	131	LeaveCriticalSection
KERNEL32.DLL	95	EnterCriticalSection
KERNEL32.DLL	186	InterlockedDecrement
KERNEL32.DLL	117	UnhandledExceptionFilter
KERNEL32.DLL	17	LoadLibraryA
KERNEL32.DLL	114	InitAtomTable
KERNEL32.DLL	70	DisconnectNamedPipe
KERNEL32.DLL	243	GlobalAlloc
KERNEL32.DLL	282	GetConsoleInputExeNameW
KERNEL32.DLL	171	SetCommState
KERNEL32.DLL	182	DefineDosDeviceA
KERNEL32.DLL	28	SetUserGeoID
KERNEL32.DLL	145	GetHandleInformation
KERNEL32.DLL	147	FindFirstVolumeMountPointW
KERNEL32.DLL	42	ConnectNamedPipe
KERNEL32.DLL	135	lstrcpyW
KERNEL32.DLL	20	ConvertThreadToFiber
KERNEL32.DLL	268	FindActCtxSectionGuid
KERNEL32.DLL	28	GetProfileStringA
KERNEL32.DLL	169	FreeResource
KERNEL32.DLL	75	HeapUnlock
KERNEL32.DLL	56	PurgeComm
KERNEL32.DLL	237	GetPrivateProfileSectionNamesA
KERNEL32.DLL	168	FindNextVolumeMountPointA
KERNEL32.DLL	19	GetThreadPriorityBoost
KERNEL32.DLL	100	GetConsoleHardwareState
KERNEL32.DLL	87	SetDefaultCommConfigA
KERNEL32.DLL	239	DeviceIoControl
KERNEL32.DLL	23	SetConsoleOS2OemFormat
KERNEL32.DLL	203	GetComputerNameExA
KERNEL32.DLL	102	VerifyConsoleIoHandle
KERNEL32.DLL	28	ReadConsoleA
KERNEL32.DLL	230	SetConsoleCursorMode
KERNEL32.DLL	94	ReadConsoleOutputCharacterA
KERNEL32.DLL	206	OpenJobObjectA
KERNEL32.DLL	81	FlushConsoleInputBuffer
KERNEL32.DLL	228	UTRegister
KERNEL32.DLL	194	GlobalSize
KERNEL32.DLL	128	SetCalendarInfoA
KERNEL32.DLL	105	CancelDeviceWakeupRequest
KERNEL32.DLL	54	FormatMessageW
KERNEL32.DLL	298	_lopen
KERNEL32.DLL	141	CreateToolhelp32Snapshot
KERNEL32.DLL	121	GetConsoleInputWaitHandle
KERNEL32.DLL	143	GlobalFree
KERNEL32.DLL	122	CreateHardLinkA
KERNEL32.DLL	263	GetConsoleKeyboardLayoutNameW
KERNEL32.DLL	30	FindResourceA
KERNEL32.DLL	91	LocalSize
KERNEL32.DLL	262	SetThreadLocale
KERNEL32.DLL	294	FormatMessageA
KERNEL32.DLL	187	CopyFileA
KERNEL32.DLL	263	GlobalMemoryStatusEx
KERNEL32.DLL	211	DeactivateActCtx
KERNEL32.DLL	201	GetACP
KERNEL32.DLL	119	GetEnvironmentVariableW
KERNEL32.DLL	156	GetDevicePowerState
KERNEL32.DLL	262	SetLocaleInfoA
KERNEL32.DLL	198	GetNumberFormatA
KERNEL32.DLL	98	GetConsoleAliasesA
KERNEL32.DLL	100	Heap32Next
KERNEL32.DLL	66	CompareStringA
KERNEL32.DLL	86	InvalidateConsoleDIBits
KERNEL32.DLL	51	GetFileAttributesExA
KERNEL32.DLL	18	GetUserDefaultLangID
KERNEL32.DLL	164	SetPriorityClass
KERNEL32.DLL	228	LocalShrink
KERNEL32.DLL	219	GetLongPathNameW
KERNEL32.DLL	59	AddConsoleAliasA
KERNEL32.DLL	223	RtlCaptureStackBackTrace
KERNEL32.DLL	89	_lwrite
KERNEL32.DLL	154	GlobalWire
KERNEL32.DLL	91	SetComputerNameExA
KERNEL32.DLL	99	ProcessIdToSessionId
KERNEL32.DLL	199	lstrcat
KERNEL32.DLL	106	DebugBreak
KERNEL32.DLL	116	OpenFile
KERNEL32.DLL	248	GetFullPathNameW
KERNEL32.DLL	48	WriteProfileSectionA
KERNEL32.DLL	193	PulseEvent
KERNEL32.DLL	269	DeleteVolumeMountPointA
KERNEL32.DLL	46	GetDateFormatW
KERNEL32.DLL	27	CreateTimerQueueTimer
KERNEL32.DLL	210	SetHandleContext
KERNEL32.DLL	26	LocalUnlock
KERNEL32.DLL	68	ReadConsoleOutputW
KERNEL32.DLL	261	GetGeoInfoA
KERNEL32.DLL	257	PrivCopyFileExW
KERNEL32.DLL	137	IsBadCodePtr
KERNEL32.DLL	245	OpenMutexW
KERNEL32.DLL	121	ExitVDM
KERNEL32.DLL	131	SetCommTimeouts
KERNEL32.DLL	190	Process32NextW
KERNEL32.DLL	288	GetShortPathNameA
KERNEL32.DLL	87	lstrcmpW
KERNEL32.DLL	91	GetComputerNameA
KERNEL32.DLL	241	GetNumaHighestNodeNumber
KERNEL32.DLL	95	_lread
KERNEL32.DLL	284	ExitProcess
KERNEL32.DLL	12	QueryDosDeviceA
KERNEL32.DLL	174	UnlockFileEx
KERNEL32.DLL	65	GlobalFindAtomA
KERNEL32.DLL	278	GetFileAttributesA
KERNEL32.DLL	214	WriteConsoleInputW
KERNEL32.DLL	194	CloseConsoleHandle
KERNEL32.DLL	294	GetConsoleAliasesLengthW
KERNEL32.DLL	205	GetTapePosition
KERNEL32.DLL	54	GetStartupInfoW
KERNEL32.DLL	70	GetVolumeInformationA
KERNEL32.DLL	160	GlobalUnfix
KERNEL32.DLL	177	LZCopy
KERNEL32.DLL	252	SetFileAttributesW
KERNEL32.DLL	41	OpenWaitableTimerW
KERNEL32.DLL	21	DnsHostnameToComputerNameA
KERNEL32.DLL	194	VirtualAllocEx
KERNEL32.DLL	38	FreeConsole
KERNEL32.DLL	91	SetFileTime
KERNEL32.DLL	204	GetCommandLineA
KERNEL32.DLL	105	lstrlenA
KERNEL32.DLL	49	lstrcmpA
OLE32.DLL	44	CoTaskMemAlloc
OLE32.DLL	215	CoTaskMemFree
ADVAPI32.dll	76	RegOpenKeyW
ADVAPI32.dll	260	RegCloseKey
ADVAPI32.dll	242	UnregisterTraceGuids
ADVAPI32.dll	151	RegisterTraceGuidsW
ADVAPI32.dll	204	GetTraceLoggerHandle
ADVAPI32.dll	174	GetTraceEnableFlags
ADVAPI32.dll	193	GetTraceEnableLevel
ADVAPI32.dll	76	RegCreateKeyExW
ADVAPI32.dll	202	TraceEvent
ADVAPI32.dll	110	RegQueryValueExW
ADVAPI32.dll	235	RegSetValueA
ADVAPI32.dll	229	RegSetValueExA
ADVAPI32.dll	13	RegCreateKeyW
ADVAPI32.dll	39	RegOpenKeyExW
ADVAPI32.dll	84	RegSetValueExW
MSDMO.DLL	223	DMORegister
MSDMO.DLL	12	MoCopyMediaType
MSDMO.DLL	64	MoFreeMediaType
MSDMO.DLL	41	MoInitMediaType
MSDMO.DLL	157	DMOUnregister
shell32.dll	94	SHLoadInProc
shell32.dll	273	ShellExecuteW
shell32.dll	299	SHIsFileAvailableOffline
shell32.dll	36	SHAddToRecentDocs
shell32.dll	236	StrChrW
shell32.dll	245	ShellExecuteEx
shell32.dll	278	SHGetFolderPathAndSubDirW
shell32.dll	12	SHGetDiskFreeSpaceExA
shell32.dll	207	CheckEscapesW
shell32.dll	212	WOWShellExecute
shell32.dll	37	SHGetDataFromIDListA
shell32.dll	259	Control_RunDLLA
shell32.dll	299	Shell_NotifyIconW
shell32.dll	38624

StringTable 04090000

FileDescription	avast! Antivirus Boot-time Scanner Scheduler
LegalCopyright	Copyright (c) 2010 AVAST Software
ProductName	avast! Antivirus
CompanyName	Kerio Technologies
ProductVersion	7.5.1.1

VS_FIXEDFILEINFO

FileVersion	1.0.7.0
ProductVersion	7.5.1.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	144896	EXE	03/03/2015 05:19:08	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x0

magic.pe32-

MZ Header

DOS stub

PE Header

Sections

Data Directory

StringTable 04090000

VS_FIXEDFILEINFO

magic.pe32
-