GR422001-20190507001.exe - uplifter.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	GR422001-20190507001.exe
size	742400 (0xb5400)
md5	aa85394a6207e454e3757319d2e0763e

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
225	21005	25
223	21005	16
224	21005	101
126	50727	27
131	30729	27
1	0	77
147	30729	9
149	30729	1
224	30501	1
219	21005	1
222	30501	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5cd00d6a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	12.0
SizeOfCode	0x1a000
SizeOfInitializedData	0x9b000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4889
BaseOfCode	0x1000
BaseOfData	0x1b000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xb9000
SizeOfHeaders	0x400
CheckSum	0xbc3c8
Subsystem	3
DllCharacteristics	0x8040
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x19fb4	0x1a000	R-X CODE
.rdata	0x1b000	0x5de8	0x5e00	R-- IDATA
.data	0x21000	0xa0e4	0x8200	RW- IDATA
.rsrc	0x2c000	0x8ae25	0x8b000	R-- IDATA
.reloc	0xb7000	0x1ec0	0x2000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x20664	0x64
RESOURCE	0x2c000	0x8ae25
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xb7000	0x1ec0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x20198	0x40
Bound_IAT	0	0
IAT	0x1b000	0x144
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
IPGXAQLVZLIM	JEDGRBKR	566272	1252
IPGXAQLVZLIM	VJHFLZJC	252	1252
DIALOG	#102	118	1252
DIALOG	#110	186	1252
DIALOG	#111	250	1252
DIALOG	#113	138	1252
VERSION	#1	704	0
MANIFEST	#1	381	1252

module_name	hint	function_name
SHELL32.dll	176	SHFormatDrive
KERNEL32.dll	586	GetProcessHeap
KERNEL32.dll	1127	SetFilePointerEx
KERNEL32.dll	337	FindVolumeMountPointClose
KERNEL32.dll	954	ReadConsoleOutputAttribute
KERNEL32.dll	255	EnumResourceNamesA
KERNEL32.dll	1058	SetCommBreak
KERNEL32.dll	627	GetSystemInfo
KERNEL32.dll	331	FindResourceA
KERNEL32.dll	828	LoadLibraryA
KERNEL32.dll	354	FreeLibrary
KERNEL32.dll	97	CompareStringA
KERNEL32.dll	748	InterlockedExchange
KERNEL32.dll	533	GetModuleHandleA
KERNEL32.dll	1139	SetLastError
KERNEL32.dll	1159	SetStdHandle
KERNEL32.dll	428	GetConsoleMode
KERNEL32.dll	410	GetConsoleCP
KERNEL32.dll	343	FlushFileBuffers
KERNEL32.dll	667	GetUserDefaultLCID
KERNEL32.dll	780	IsValidLocale
KERNEL32.dll	724	HeapSize
KERNEL32.dll	722	HeapReAlloc
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	1048	RtlUnwind
KERNEL32.dll	1069	SetConsoleCtrlHandler
KERNEL32.dll	768	IsDebuggerPresent
KERNEL32.dll	567	GetOEMCP
KERNEL32.dll	360	GetACP
KERNEL32.dll	719	HeapFree
KERNEL32.dll	288	FatalAppExitA
KERNEL32.dll	390	GetCommandLineA
KERNEL32.dll	514	GetLastError
KERNEL32.dll	452	GetCurrentThread
KERNEL32.dll	453	GetCurrentThreadId
KERNEL32.dll	234	EncodePointer
KERNEL32.dll	202	DecodePointer
KERNEL32.dll	281	ExitProcess
KERNEL32.dll	535	GetModuleHandleExW
KERNEL32.dll	21	AreFileApisANSI
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	612	GetStdHandle
KERNEL32.dll	499	GetFileType
KERNEL32.dll	209	DeleteCriticalSection
KERNEL32.dll	531	GetModuleFileNameA
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	935	QueryPerformanceCounter
KERNEL32.dll	449	GetCurrentProcessId
KERNEL32.dll	633	GetSystemTimeAsFileTime
KERNEL32.dll	772	IsProcessorFeaturePresent
KERNEL32.dll	1235	UnhandledExceptionFilter
KERNEL32.dll	1189	SetUnhandledExceptionFilter
KERNEL32.dll	739	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1202	Sleep
KERNEL32.dll	448	GetCurrentProcess
KERNEL32.dll	1216	TerminateProcess
KERNEL32.dll	1221	TlsAlloc
KERNEL32.dll	1223	TlsGetValue
KERNEL32.dll	1224	TlsSetValue
KERNEL32.dll	1222	TlsFree
KERNEL32.dll	659	GetTickCount
KERNEL32.dll	238	EnterCriticalSection
KERNEL32.dll	825	LeaveCriticalSection
USER32.dll	166	DestroyWindow
USER32.dll	16	BringWindowToTop
USER32.dll	206	DrawTextExA
USER32.dll	86	CountClipboardFormats
USER32.dll	513	LookupIconIdFromDirectoryEx
USER32.dll	521	MapWindowPoints
USER32.dll	100	CreateIcon
ole32.dll	66	CoInstall
ole32.dll	122	CreateClassMoniker
ole32.dll	26	CoFileTimeToDosDateTime
ole32.dll	193	HPALETTE_UserMarshal
ole32.dll	187	HMETAFILEPICT_UserUnmarshal
ole32.dll	290	OleCreateLinkEx
ole32.dll	94	CoRevertToSelf

StringTable 040904b0

CompanyName	stonebass
FileDescription	jeweller
FileVersion	7.7.6.0
InternalName	todder.exe
LegalCopyright	Copyright (C) Mohall 2018
OriginalFilename	uplifter.exe
ProductName	imprevisible
ProductVersion	3.3.2.5

VS_FIXEDFILEINFO

FileVersion	7.7.6.0
ProductVersion	3.3.2.5
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	742400	EXE	05/06/2019 10:33:14	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

GR422001-20190507001.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

GR422001-20190507001.exe
-