filenameAAD7A4BFF282356B19CFD198201585F8.cdm
size88576 (0x15a00)
md5aad7a4bff282356b19cfd198201585f8
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
125507273
1091
1235072713
1095072724
110507273
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x4397c67a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x14800
SizeOfInitializedData0x1000
SizeOfUninitializedData0
AddressOfEntryPoint0xf658
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x18000
SizeOfHeaders0x400
CheckSum0x1dfd0
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v.8 (h-good sig, but is it MSVC?)

Sections

namevavsizeraw sizeflags
.text0x10000x147ce0x14800R-X CODE
.data0x160000x3f00x200RW- IDATA
.rsrc0x170000xae80xc00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x14fbc0x8c
RESOURCE0x170000xae8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x11a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x63600x40
Bound_IAT00
IAT0x10000x17c
Delay_IAT00
CLR_Header00
typenamesizecp
TEXTINCLUDE#1110
TEXTINCLUDE#2220
TEXTINCLUDE#34590
VERSION#19080
VXD#10010240
module_namehintordfunction_name
msvcrt.dll204__p__fmode
msvcrt.dll199__p__commode
msvcrt.dll259_adjust_fdiv
msvcrt.dll226__setusermatherr
msvcrt.dll271_amsg_exit
msvcrt.dll493_initterm
msvcrt.dll160__initenv
msvcrt.dll1172exit
msvcrt.dll115_XcptFilter
msvcrt.dll368_exit
msvcrt.dll290_cexit
msvcrt.dll159__getmainargs
msvcrt.dll224__set_app_type
msvcrt.dll1313strstr
msvcrt.dll1330toupper
msvcrt.dll1350wcschr
msvcrt.dll774_purecall
msvcrt.dll976_vsnwprintf
msvcrt.dll971_vsnprintf
msvcrt.dll1317strtoul
msvcrt.dll1265memset
msvcrt.dll432_fullpath
msvcrt.dll1376wprintf
msvcrt.dll1263memcpy
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll309_controlfp
msvcrt.dll880_strnicmp
msvcrt.dll870_stricmp
msvcrt.dll1270printf
ADVAPI32.dll456MD5Final
ADVAPI32.dll458MD5Update
ADVAPI32.dll457MD5Init
KERNEL32.dll464GetModuleHandleW
KERNEL32.dll647InterlockedCompareExchange
KERNEL32.dll1000Sleep
KERNEL32.dll650InterlockedExchange
KERNEL32.dll988SetUnhandledExceptionFilter
KERNEL32.dll1029UnhandledExceptionFilter
KERNEL32.dll391GetCurrentProcess
KERNEL32.dll1012TerminateProcess
KERNEL32.dll549GetSystemTimeAsFileTime
KERNEL32.dll392GetCurrentProcessId
KERNEL32.dll395GetCurrentThreadId
KERNEL32.dll572GetTickCount
KERNEL32.dll795QueryPerformanceCounter
KERNEL32.dll628HeapCreate
KERNEL32.dll857RtlUnwind
KERNEL32.dll630HeapFree
KERNEL32.dll416GetEnvironmentVariableA
KERNEL32.dll129CreateProcessA
KERNEL32.dll1066WaitForSingleObjectEx
KERNEL32.dll932SetFilePointer
KERNEL32.dll431GetFileSize
KERNEL32.dll815ReadFile
KERNEL32.dll108CreateFileMappingA
KERNEL32.dll725MapViewOfFile
KERNEL32.dll1032UnmapViewOfFile
KERNEL32.dll107CreateFileA
KERNEL32.dll461GetModuleHandleA
KERNEL32.dll1097WriteFile
KERNEL32.dll62CloseHandle
KERNEL32.dll1037UpdateResourceA
KERNEL32.dll629HeapDestroy
KERNEL32.dll502GetProcAddress
KERNEL32.dll301FreeLibrary
KERNEL32.dll722LockResource
KERNEL32.dll999SizeofResource
KERNEL32.dll707LoadResource
KERNEL32.dll703LoadLibraryExA
KERNEL32.dll447GetLastError
KERNEL32.dll626HeapAlloc
KERNEL32.dll505GetProcessHeap
KERNEL32.dll926SetFileAttributesA
KERNEL32.dll91CopyFileA
KERNEL32.dll166DeleteFileA
KERNEL32.dll36BeginUpdateResourceA
KERNEL32.dll587GetVersionExA
KERNEL32.dll702LoadLibraryA
KERNEL32.dll280FindResourceExA
KERNEL32.dll739MultiByteToWideChar
KERNEL32.dll210EnumResourceTypesA
KERNEL32.dll206EnumResourceNamesA
KERNEL32.dll202EnumResourceLanguagesA
KERNEL32.dll186EndUpdateResourceA
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
imagehlp.dll33MapFileAndCheckSumA
USER32.dll41CharLowerA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMuirct.exe MUI build tool
FileVersion6.0.5270.6 (winmain_idx03.051207-1830)
InternalNamemuirct
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamemuirct.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.0.5270.6

VS_FIXEDFILEINFO

FileVersion6.0.5270.6
ProductVersion6.0.5270.6
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
088576EXE12/08/2005 05:36:58#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK