80.jpg

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	80.jpg
size	434176 (0x6a000)
md5	a745aeffdb5bb5d2bb6fec90853223dd

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
123	50727	2
93	4035	23
1	0	23
0	0	1
219	21005	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x56d55ff7
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x307
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x5000
SizeOfInitializedData	0xa7000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x5000
BaseOfCode	0x1000
BaseOfData	0x6000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.1
ImageVersion	0.0
SubsystemVersion	4.1
Reserved1	0
SizeOfImage	0xad000
SizeOfHeaders	0x1000
CheckSum	0x12005000
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2f7f	0x3000	R-X CODE
ordo	0x4000	0x36a	0x1000	R-X CODE
.t	0x5000	0x2e	0x1000	R-X CODE
.rdata	0x6000	0x570	0x1000	R-- IDATA
.data	0x7000	0x5c000	0x19000	RW- IDATA DISCARDABLE
.mrt1	0x63000	0x186b5	0x19000	RW- IDATA
CODE	0x7c000	0x186bb	0x19000	RW- IDATA
.rsrc	0x95000	0x17830	0x18000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x61b4	0x104
RESOURCE	0x95000	0x17830
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x3030	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x6000	0x8c
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	80297
ICON	#2	9640
ICON	#3	4264
ICON	#4	1128
STRING	#1	48
STRING	#7	124
STRING	#63	96
STRING	#64	88
GROUP_ICON	GHGHK	62

id	lang	string
1	1033	n65tjgf
100	1033	njy76iyjghnb
101	1033	Windows NT %d.%d
102	1033	Format Text
103	1033	Tahoma
1001	1033	control.ini
1002	1033	ty7iyuh
1007	1033	r5y4trhfb.thth
1008	1033	oikjhgnfde
1009	1033	gjtjg.h6
1010	1033	jr7i6ighb

module_name	hint	ord	function_name
urlmon.dll	7		CoInternetCombineUrl
comdlg32.dll			ChooseColorA
comdlg32.dll	15		PageSetupDlgW
NTDSAPI.dll	26		DsFreeSpnArrayA
KERNEL32.dll	503		GlobalMemoryStatusEx
KERNEL32.dll	108		CreateThread
KERNEL32.dll	371		GetModuleFileNameA
KERNEL32.dll	531		HeapWalk
KERNEL32.dll	780		SetFirmwareEnvironmentVariableA
KERNEL32.dll	351		GetFirmwareEnvironmentVariableA
KERNEL32.dll	775		SetFilePointerEx
KERNEL32.dll	131		DeleteTimerQueue
KERNEL32.dll	453		GetTapeStatus
msvcrt.dll	1387		wcstoul
msvcrt.dll	1258		memcpy
msvcrt.dll	1213		isalnum
CLUSAPI.dll	95		OpenCluster
USER32.dll	731		wsprintfW
pdh.dll	42		PdhGetCounterInfoW
SETUPAPI.dll	228		SetupBackupErrorA
ole32.dll	245		HMENU_UserUnmarshal
OLEAUT32.dll		225
IMM32.dll	29		ImmDestroyContext

show previews

offset	size	type	comment
0	434176	EXE	03/01/2016 09:25:11	#
15c1	15	HTM		#
52220	80297	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER