OrderPlaced.jsp.exe - AGREEMENT BETWEEN USER AND Sistema de Información - AGREEMENT BETWEEN USER AND Sistema de Información

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	OrderPlaced.jsp.exe
size	1210880 (0x127a00)
md5	a64b5bc7e000b500f0ef7306bd9c49f2

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x5411cb6e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x122000
SizeOfInitializedData	0x7000
SizeOfUninitializedData	0xd2e000
AddressOfEntryPoint	0xe500b0
BaseOfCode	0xd2f000
BaseOfData	0xe51000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0xe58000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0xd2e000	0	RWX UDATA
UPX1	0xd2f000	0x122000	0x121400	RWX IDATA
.rsrc	0xe51000	0x7000	0x6200	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xe56d3c	0x31c
RESOURCE	0xe51000	0x5d3c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xe50260	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x23f000	0x7e2
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x1250278	0x12502d0	0x629c14	0	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	PREVIEWGLYPH	232
ICON	#1	16936
DIALOG	DLGTEMPLATE	82
DIALOG	TEXTFILEDLG	82
STRING	#4056	136
STRING	#4057	3056
STRING	#4058	1256
STRING	#4059	952
STRING	#4060	992
STRING	#4061	1012
STRING	#4062	824
STRING	#4063	1136
STRING	#4064	4084
STRING	#4065	2708
STRING	#4066	2556
STRING	#4067	2328
STRING	#4068	1768
STRING	#4069	1000
STRING	#4070	996
STRING	#4071	984
STRING	#4072	1088
STRING	#4073	856
STRING	#4074	916
STRING	#4075	612
STRING	#4076	1360
STRING	#4077	1012
STRING	#4078	992
STRING	#4079	988
STRING	#4080	156
STRING	#4081	332
STRING	#4082	588
STRING	#4083	848
STRING	#4084	1020
STRING	#4085	1212
STRING	#4086	660
STRING	#4087	1348
STRING	#4088	956
STRING	#4089	968
STRING	#4090	944
STRING	#4091	204
STRING	#4092	176
STRING	#4093	668
STRING	#4094	972
STRING	#4095	824
STRING	#4096	752
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	3920
RCDATA	PLATFORMTARGETS	2
RCDATA	TFB01	1103
RCDATA	TFB02	2935233
RCDATA	TFORM1	1748
RCDATA	TFORM4	1362
RCDATA	TFORM5	1280960
RCDATA	TFORM6	1673
RCDATA	TFORM7	5149056
RCDATA	TFORM8	971
RCDATA	TFORM9	2973725
RCDATA	TFUNC	271
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	20
VERSION	#1	1404
MANIFEST	#1	714

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			ExitProcess
advapi32.dll			RegFlushKey
comctl32.dll			ImageList_Add
gdi32.dll			Pie
msimg32.dll			AlphaBlend
msvcrt.dll			memset
ole32.dll			OleDraw
oleacc.dll			LresultFromObject
oleaut32.dll			VariantInit
shell32.dll			ShellExecuteW
user32.dll			GetDC
version.dll			VerQueryValueW
winmm.dll			timeGetTime

StringTable 040904E4

CompanyName	AGREEMENT BETWEEN USER AND Sistema de Información
FileDescription	AGREEMENT BETWEEN USER AND Sistema de Información
FileVersion	12.0.0.0
InternalName	AGREEMENT BETWEEN USER AND Sistema de Información
LegalCopyright	AGREEMENT BETWEEN USER AND Sistema de Información
LegalTrademarks	AGREEMENT BETWEEN USER AND Sistema de Información
OriginalFilename	AGREEMENT BETWEEN USER AND Sistema de Información
ProductName	AGREEMENT BETWEEN USER AND Sistema de Información
ProductVersion	12.0.0.0
Comments	AGREEMENT BETWEEN USER AND Sistema de Información

VS_FIXEDFILEINFO

FileVersion	12.0.0.0
ProductVersion	12.0.0.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	1210880	EXE	09/11/2014 16:18:54	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2732a8

[?] can't find file_offset of VA 0x2733dc

[?] can't find file_offset of VA 0x273510

[?] can't find file_offset of VA 0x273644

[?] can't find file_offset of VA 0x273778

[?] can't find file_offset of VA 0x2738ac

[?] can't find file_offset of VA 0x2739e0

[?] can't find file_offset of VA 0x273b14

[?] can't find file_offset of VA 0x273ce4

[?] can't find file_offset of VA 0x273ec8

[?] can't find file_offset of VA 0x274098

[?] can't find file_offset of VA 0x274268

[?] can't find file_offset of VA 0x274438

[?] can't find file_offset of VA 0x274608

[?] can't find file_offset of VA 0x2747d8

[?] can't find file_offset of VA 0x2749a8

[?] can't find file_offset of VA 0x274b78

[?] can't find file_offset of VA 0x274d48

[?] can't find file_offset of VA 0x279058

[?] can't find file_offset of VA 0x2790ac

[?] can't find file_offset of VA 0x279100

[?] can't find file_offset of VA 0x279188

[?] can't find file_offset of VA 0x279d78

[?] can't find file_offset of VA 0x27a260

[?] can't find file_offset of VA 0x27a618

[?] can't find file_offset of VA 0x27a9f8

[?] can't find file_offset of VA 0x27adec

[?] can't find file_offset of VA 0x27b124

[?] can't find file_offset of VA 0x27b594

[?] can't find file_offset of VA 0x27c588

[?] can't find file_offset of VA 0x27d01c

[?] can't find file_offset of VA 0x27da18

[?] can't find file_offset of VA 0x27e330

[?] can't find file_offset of VA 0x27ea18

[?] can't find file_offset of VA 0x27ee00

[?] can't find file_offset of VA 0x27f1e4

[?] can't find file_offset of VA 0x27f5bc

[?] can't find file_offset of VA 0x27f9fc

[?] can't find file_offset of VA 0x27fd54

[?] can't find file_offset of VA 0x2800e8

[?] can't find file_offset of VA 0x28034c

[?] can't find file_offset of VA 0x28089c

[?] can't find file_offset of VA 0x280c90

[?] can't find file_offset of VA 0x281070

[?] can't find file_offset of VA 0x28144c

[?] can't find file_offset of VA 0x2814e8

[?] can't find file_offset of VA 0x281634

[?] can't find file_offset of VA 0x281880

[?] can't find file_offset of VA 0x281bd0

[?] can't find file_offset of VA 0x281fcc

[?] can't find file_offset of VA 0x282488

[?] can't find file_offset of VA 0x28271c

[?] can't find file_offset of VA 0x282c60

[?] can't find file_offset of VA 0x28301c

[?] can't find file_offset of VA 0x2833e4

[?] can't find file_offset of VA 0x283794

[?] can't find file_offset of VA 0x283860

[?] can't find file_offset of VA 0x283910

[?] can't find file_offset of VA 0x283bac

[?] can't find file_offset of VA 0x283f78

[?] can't find file_offset of VA 0x2842b0

[?] can't find file_offset of VA 0x2845a0

[?] can't find file_offset of VA 0x2845b0

[?] can't find file_offset of VA 0x285500

[?] can't find file_offset of VA 0x285504

[?] can't find file_offset of VA 0x285954

[?] can't find file_offset of VA 0x552318

[?] can't find file_offset of VA 0x5529ec

[?] can't find file_offset of VA 0x552f40

[?] can't find file_offset of VA 0x68bb00

[?] can't find file_offset of VA 0x68c18c

[?] can't find file_offset of VA 0xb7530c

[?] can't find file_offset of VA 0xb756d8

[!] refusing to read CURDIRENTRY beyond resource size

[?] can't find file_offset of VA 0x229c14

[?] can't find file_offset of VA 0x23f000

OrderPlaced.jsp.exe-