cf免费刷枪软件.exe - 2014最新软件

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	cf免费刷枪软件.exe
size	2484736 (0x25ea00)
md5	a9af22bfb456387c69f5f33d9b9a30f3

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Trojan.Agent-204211 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
12	7291	3
11	8047	1
14	7299	43
19	8022	44
19	8034	21
1	0	611
10	9782	190
11	9782	93
11	8168	93
0	0	32
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x53e84524
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x91000
SizeOfInitializedData	0x24e000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x305001
BaseOfCode	0x1000
BaseOfData	0x91000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x309000
SizeOfHeaders	0x600
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.12

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x90000	0x51600	RW- IDATA
.rdata	0x91000	0x22f000	0x1ff600	RW- IDATA
.data	0x2c0000	0x3e000	0x8000	RW- IDATA
.rsrc	0x2fe000	0x6000	0x1e00	RW- IDATA
.text	0x304000	0x1000	0x1000	RW- IDATA
.aspack	0x305000	0x3000	0x2a00	RW- IDATA
.adata	0x308000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x305fac	0x27c
RESOURCE	0x2fe000	0x5ca4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x305f54	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size	cp
TEXTINCLUDE	#1	11	1252
TEXTINCLUDE	#2	22	1252
TEXTINCLUDE	#3	337	1252
CURSOR	#1	308	1252
CURSOR	#2	308	1252
CURSOR	#3	308	1252
CURSOR	#4	180	1252
BITMAP	#1031	584	1252
BITMAP	#1038	324	1252
BITMAP	#1138	344	1252
BITMAP	#1139	344	1252
BITMAP	#1140	344	1252
BITMAP	#1141	344	1252
BITMAP	#1142	344	1252
BITMAP	#1143	344	1252
BITMAP	#1144	344	1252
BITMAP	#1145	344	1252
BITMAP	#26567	1508	1252
BITMAP	#30994	184	1252
BITMAP	#30995	364	1252
BITMAP	#30996	324	1252
ICON	#1	744	1252
ICON	#2	296	1252
ICON	#3	3240	1252
ICON	#4	872	1252
MENU	#127	12	1252
MENU	#1039	644	1252
DIALOG	#150	152	1252
DIALOG	#286	378	1252
DIALOG	#554	250	1252
DIALOG	#1037	234	1252
DIALOG	#1084	2222	1252
DIALOG	#1124	178	1252
DIALOG	#1134	204	1252
DIALOG	#1150	178	1252
DIALOG	#30721	226	1252
DIALOG	#30722	396	1252
STRING	#3841	80	1252
STRING	#3842	44	1252
STRING	#3843	120	1252
STRING	#3857	452	1252
STRING	#3858	298	1252
STRING	#3859	326	1252
STRING	#3865	64	1252
STRING	#3866	100	1252
STRING	#3867	472	1252
STRING	#3868	276	1252
STRING	#3869	36	1252
GROUP_CURSOR	#1032	20	1252
GROUP_CURSOR	#1033	20	1252
GROUP_CURSOR	#30977	34	1252
GROUP_ICON	DEFAULT_ICON	34	1252
GROUP_ICON	#1151	20	1252
GROUP_ICON	#1152	20	1252
VERSION	#1	584	1252

module_name	ord	function_name
kernel32.dll		GetProcAddress
kernel32.dll		GetModuleHandleA
kernel32.dll		LoadLibraryA
user32.dll		wsprintfA
gdi32.dll		CreatePolygonRgn
winmm.dll		midiStreamRestart
winspool.drv		ClosePrinter
advapi32.dll		RegQueryValueExA
shell32.dll		ShellExecuteA
ole32.dll		OleUninitialize
oleaut32.dll	186
comctl32.dll		ImageList_Destroy
ws2_32.dll	17
comdlg32.dll		GetFileTitleA

StringTable 080404B0

FileVersion	1.5.2.6
FileDescription	2014最新软件
ProductName	2014最新软件
ProductVersion	1.5.2.6
CompanyName	2014最新软件
LegalCopyright	2014最新软件
Comments	2014最新软件

VS_FIXEDFILEINFO

FileVersion	1.5.2.6
ProductVersion	1.5.2.6
StrucVersion	0
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	2484736	EXE	08/11/2014 04:23:00	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x2ffe40

[?] can't find file_offset of VA 0x2fff98

[?] can't find file_offset of VA 0x30057c

[?] can't find file_offset of VA 0x300634

[?] can't find file_offset of VA 0x3007a0

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x301d04

[?] can't find file_offset of VA 0x301d10

[?] can't find file_offset of VA 0x301f94

[?] can't find file_offset of VA 0x30202c

[?] can't find file_offset of VA 0x3021a8

[?] can't find file_offset of VA 0x3022a4

[?] can't find file_offset of VA 0x302390

[?] can't find file_offset of VA 0x302c40

[?] can't find file_offset of VA 0x302cf4

[?] can't find file_offset of VA 0x302dc0

[?] can't find file_offset of VA 0x302e74

[?] can't find file_offset of VA 0x302f58

[?] can't find file_offset of VA 0x3030e4

[?] can't find file_offset of VA 0x303134

[?] can't find file_offset of VA 0x303160

[?] can't find file_offset of VA 0x3031d8

[?] can't find file_offset of VA 0x30339c

[?] can't find file_offset of VA 0x3034c8

[?] can't find file_offset of VA 0x303610

[?] can't find file_offset of VA 0x303650

[?] can't find file_offset of VA 0x3036b4

[?] can't find file_offset of VA 0x30388c

[?] can't find file_offset of VA 0x3039a0

[?] can't find file_offset of VA 0x3039c4

[?] can't find file_offset of VA 0x3039d8

[?] can't find file_offset of VA 0x3039ec

[?] can't find file_offset of VA 0x0

cf免费刷枪软件.exe- -