POSTNORD_info_53779.exe

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	POSTNORD_info_53779.exe
size	558121 (0x88429)
md5	a875dcfbd2a9f9880a47d4f525e20b04

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
14	7299	232
10	8168	199
4	8168	4
1	0	122
19	8034	10
0	0	26
11	8168	190
6	1720	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x44bfac88
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x10000
SizeOfInitializedData	0x77000
SizeOfUninitializedData	0
AddressOfEntryPoint	0xfd66
BaseOfCode	0x1000
BaseOfData	0x11000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x88000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xf122	0x10000	R-X CODE
.rdata	0x11000	0xa7c	0x1000	R-- IDATA
.data	0x12000	0x1f54	0x2000	RW- IDATA
.rsrc	0x14000	0x736a8	0x74000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x11448	0xb4
RESOURCE	0x14000	0x736a8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x11000	0x208
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
vE174	X8q4l2CM23e	5
nU747	B1gxq77re43	16
G2O40T	obG33267XA	15
P52g7477	#4012	6
c66sv2	X5X0O8	16
YpEWHX025t	cdF5toip55	2
n37aR04Jc3	yLrdk72371O	2
GV55YLPX	A13rRXC	5
enjcd748J	R1A1S8rdj	1
P3FJN2k	Tm74l2L	2
A68mJhx	#2938	2
k8gn6IM0	iY2CDk667	6
per4j5sGHq	df4N25s788	7
ICON	#3031	17032
ICON	#3032	10249
ICON	#3033	5263
ICON	#3034	2009
ICON	#3035	67765
ICON	#3036	270607
ICON	#3037	1175
ICON	#3038	1889
ICON	#3039	4760
ICON	#3040	2105
DIALOG	#428	31
DIALOG	#21250	421
DIALOG	#21251	202
DIALOG	#21252	235
DIALOG	#21253	149
DIALOG	#21254	191
RCDATA	#2131	937
GROUP_ICON	#1969	90
GROUP_ICON	#1970	20
GROUP_ICON	#1971	20
GROUP_ICON	#1972	20
GROUP_ICON	#1973	20
VERSION	#1	684

module_name	hint	ord	function_name
IMM32.dll	27		ImmGetCompositionStringA
IMM32.dll	95		ImmSetStatusWindowPos
KERNEL32.dll	336		GetStartupInfoA
KERNEL32.dll	365		GetTickCount
KERNEL32.dll	6		Module32Next
KERNEL32.dll	366		GetTimeFormatA
KERNEL32.dll	348		GetSystemPowerStatus
KERNEL32.dll	272		GetFileAttributesW
KERNEL32.dll	361		GetThreadPriority
KERNEL32.dll	409		HeapAlloc
KERNEL32.dll	410		HeapCompact
KERNEL32.dll	294		GetModuleHandleA
RASAPI32.dll	22		RasEnumDevicesA
GDI32.dll	361		GetTextColor
GDI32.dll	345		GetROP2
GDI32.dll	155		ExtEscape
GDI32.dll	368		GetTextExtentPointA
GDI32.dll	493		SetRectRgn
GDI32.dll	30		CombineRgn
GDI32.dll	299		GetEnhMetaFileBits
GDI32.dll	43		CreateDCA
GDI32.dll	10		Arc
GDI32.dll	367		GetTextExtentPoint32W
GDI32.dll	64		CreateMetaFileA
GDI32.dll	462		SetBkMode
GDI32.dll	263		GetBkColor
GDI32.dll	417		PolyPolyline
GDI32.dll	81		DeleteEnhMetaFile
GDI32.dll	456		SelectPalette
KERNEL32.dll	336		GetStartupInfoA
KERNEL32.dll	365		GetTickCount
KERNEL32.dll	6		Module32Next
KERNEL32.dll	366		GetTimeFormatA
KERNEL32.dll	348		GetSystemPowerStatus
KERNEL32.dll	272		GetFileAttributesW
KERNEL32.dll	361		GetThreadPriority
KERNEL32.dll	409		HeapAlloc
KERNEL32.dll	410		HeapCompact
KERNEL32.dll	294		GetModuleHandleA
USER32.dll	183		keybd_event
MSVCRT.dll	202		_mbsnicoll
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	106		__p__commode
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	271		_initterm
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	143		_acmdln
MSVCRT.dll	585		atoi
MSVCRT.dll	72		wcspbrk
MSVCRT.dll	211		_fcvt
MSVCRT.dll	390		_onexit
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	16		signal
MSVCRT.dll	73		__p__tzname
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	183		_controlfp
MFC42.DLL		1576
MFC42.DLL		324
MFC42.DLL		3597
MFC42.DLL		1028
MFC42.DLL		4627
MFC42.DLL		5277
MFC42.DLL		2124
MFC42.DLL		2446
MFC42.DLL		5261
MFC42.DLL		1727
MFC42.DLL		5065
MFC42.DLL		3749
MFC42.DLL		6376
MFC42.DLL		2055
MFC42.DLL		2648
MFC42.DLL		4441
MFC42.DLL		4837
MFC42.DLL		3798
MFC42.DLL		5280
MFC42.DLL		1043
MFC42.DLL		4274
MFC42.DLL		815
MFC42.DLL		2514
MFC42.DLL		1001
MFC42.DLL		1094
MFC42.DLL		4486
MFC42.DLL		2554
MFC42.DLL		2512
MFC42.DLL		5731
MFC42.DLL		3922
MFC42.DLL		1089
MFC42.DLL		5199
MFC42.DLL		2396
MFC42.DLL		3346
MFC42.DLL		5300
MFC42.DLL		5302
MFC42.DLL		2725
MFC42.DLL		4079
MFC42.DLL		4698
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		1057
MFC42.DLL		2982
MFC42.DLL		3147
MFC42.DLL		3259
MFC42.DLL		4465
MFC42.DLL		3136
MFC42.DLL		3262
MFC42.DLL		2985
MFC42.DLL		3081
MFC42.DLL		2976
MFC42.DLL		3830
MFC42.DLL		3831
MFC42.DLL		3825
MFC42.DLL		3079
MFC42.DLL		1029
MFC42.DLL		1092
MFC42.DLL		1034
MFC42.DLL		1076
MFC42.DLL		561
MFC42.DLL		4234
MFC42.DLL		5265
MFC42.DLL		1053
MFC42.DLL		4853
MFC42.DLL		4998
MFC42.DLL		1052
MFC42.DLL		4078
MFC42.DLL		1775
MFC42.DLL		4407
MFC42.DLL		1007
MFC42.DLL		2385
MFC42.DLL		5163
MFC42.DLL		6374
MFC42.DLL		4353
MFC42.DLL		1168

StringTable Practisi

CompanyName
Development	j!FileDescriptio�
uarks Separateness Romanticises
FileVersion	0.39.188.233
InternalName	Permute
LegalCopyright	2014 (C) 2013
ProductVersion	0.109.247.205
ProductName	Provincial Railway

VS_FIXEDFILEINFO

FileVersion	0.95.216.228
ProductVersion	0.81.148.199
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0x28
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	557056	EXE	07/20/2006 16:17:12	#
15c1	15	HTM		#
88000	1065	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 558121 bytes (546 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VS_VERSIONINFO child type "P\x00o\x00s\x00"