| filename | PEview9small.exe | |
|---|---|---|
| size | 34304 (0x8600) | |
| md5 | b01bbfb9fbcc5bade27fe87816badab7 | |
| type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x6c |
| blocks_in_file | 1 |
| num_relocs | 0 |
| header_paragraphs | 2 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0 |
| checksum | 0 |
| ip | 0x11 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0 |
| reserved0 | 0x336e695700000000 |
| oem_id | 0x2032 |
| oem_info | 0x7250 |
| reserved2 | 0x6172676f |
| reserved3 | 0xa0d216d |
| reserved4 | 0xba09b424 |
| reserved5 | 0x21cd0100 |
| reserved6 | 0x21cd4cb4 |
| lfanew | 0x60 |
DOS stub
00000000: 57 69 6e 33 32 20 50 72 6f 67 72 61 6d 21 0d 0a |Win32 Program!..| 00000010: 24 b4 09 ba 00 01 cd 21 b4 4c cd 21 60 00 00 00 |$......!.L.!`...| 00000020: 47 6f 4c 69 6e 6b 2c 20 47 6f 41 73 6d 20 77 77 |GoLink, GoAsm ww| 00000030: 77 2e 47 6f 44 65 76 54 6f 6f 6c 2e 63 6f 6d 00 |w.GoDevTool.com.|
PE Header
Packer / Compiler
UPX Modified >> *$igBy Ahmed18 This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0xf000 | 0 | RWX UDATA | |
| UPX1 | 0x10000 | 0x7000 | 0x6e00 | RWX IDATA | |
| .rsrc | 0x17000 | 0x2000 | 0x1600 | RW- IDATA |
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0x183d8 | 0x1dc | |
| RESOURCE | 0x17000 | 0x13d8 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0 | 0 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0 | 0 | |
| Delay_IAT | 0 | 0 | |
| CLR_Header | 0 | 0 |
| id | lang | string |
|---|---|---|
| 32 | 4105 | 00 20 06 19 92 a6 24 18 dc 2f 8c 4d 9e 43 26 e4 |. ....$../.M.C&.|
52 c0 f6 27 97 9c a0 96 24 d1 e9 74 2b 36 a4 03 |R..'....$..t+6..|
f2 1c 22 e8 28 69 62 93 ad 9b 64 bc 63 32 0c f0 |..".(ib...d.c2..|
ec 73 87 52 63 34 50 4d 42 3a c0 81 52 f0 9b 9c |.s.Rc4PMB:..R...|
0b 64 83 e9 28 57 d9 6b 45 30 35 34 1d 8d 09 ed |.d..(W.kE054....|
80 f8 5e 03 3e 01 5b 15 f0 34 64 40 8a 33 aa d4 |..^.>.[..4d@.3..|
75 45 83 0e c1 06 6b 0a 78 58 f1 27 af 18 1c ba |uE....k.xX.'....|
9c 66 57 4b e4 9b 03 c8 a6 3a 4a e4 3f e4 3e e4 |.fWK.....:J.?.>.|
be 99 40 3e 98 e3 01 04 74 25 eb 3a a9 44 46 b8 |..@>....t%.:.DF.|
73 e3 a5 df 61 8e 59 1f 76 f0 05 1d 28 61 c4 e3 |s...a.Y.v...(a..|
f6 c3 52 89 f2 8e 03 15 01 bf dc 61 41 6c 4b b9 |..R........aAlK.|
20 00 78 db 46 cc 55 ca 47 f0 05 56 82 5d 6c 06 | .x.F.U.G..V.]l.|
c5 88 c7 79 78 3f 3f 64 3b bc 31 ac 63 13 2a 8d |...yx??d;.1.c.*.|
14 03 b2 04 1f e8 bf 56 aa 15 02 42 54 0b 92 5e |.......V...BT..^|
60 f7 81 ff a0 11 72 ee 4d 81 e9 50 ce 8a 70 e4 |`.....r.M..P..p.|
76 c1 e6 3e 35 e0 33 3b 99 6e ec 11 16 b7 3b 5e |v..>5.3;.n....;^|
77 44 57 4f 5f 50 fc 9b ad 99 39 4b 41 9a 77 2c |wDWO_P....9KA.w,|
c7 07 20 2d 3e 20 18 65 ae 00 fc ff 5f 92 cd 25 |.. -> .e...._..%|
61 86 c7 50 2c 68 2c 21 96 44 27 02 c0 12 19 22 |a..P,h,!.D'...."|
65 4a 8d 07 3b 16 86 7f 07 eb 68 be 6c 90 46 3b |eJ..;.....h.l.F;|
05 a1 2c be 47 1e 12 3b 05 0a be 58 19 12 9a 84 |..,.G..;...X....|
16 96 41 4e 73 54 10 01 b4 18 6f e8 d6 de bb b7 |..ANsT....o.....|
20 be ab a3 d7 13 39 c6 74 0c d7 eb f0 0a f1 de | .....9.t.......|
54 c0 ff eb 08 2b 24 6b 01 c8 94 ed 75 57 24 ab |T....+$k....uW$.|
d8 f8 39 92 ef be 78 83 11 15 8d 34 12 cf 51 f0 |..9...x....4..Q.|
59 5d e8 34 33 b5 32 ef c4 21 7b 68 67 40 69 84 |Y].43.2..!{hg@i.|
66 9e 49 2e e4 90 d1 e2 02 8c 10 6b b2 86 42 90 |f.I........k..B.|
a1 68 9d d4 ae 74 26 9d 6c 0f 5b 4c 21 1f ea 21 |.h...t&.l.[L!..!|
d0 ac 6c 99 ea d3 0c e0 08 cd 76 fc 42 04 af 0b |..l.......v.B...|
1c 7b 61 3d 4b 84 d6 74 6d 37 08 d4 c0 92 3c 93 |.{a=K..tm7....<.|
3e f8 33 60 2e 39 19 a8 22 0a 80 de ed 0a 19 2e |>.3`.9..".......|
a1 08 04 39 c2 77 5d 59 ef 6c 56 9f 3d b4 e8 f8 |...9.w]Y.lV.=...|
24 09 30 97 bd 27 18 cf a9 61 2d d1 46 9f 40 e2 |$.0..'...a-.F.@.|
f8 13 26 5c 1b 36 72 60 32 55 3b 9e 3d 20 96 ff |..&\.6r`2U;.= ..|
a0 61 10 a1 10 a5 a2 99 c3 15 8a 74 7c 4b 0e 3b |.a.........t|K.;|
a4 c2 42 7b 6c 0c 9d 5b b6 c1 74 66 06 02 6b 07 |..B{l..[..tf..k.|
06 01 9d 30 67 ba 40 69 40 7a c2 72 2c f0 65 85 |...0g.@i@z.r,.e.|
84 a9 3d 39 8b 55 04 6b 57 2a 5a 7b ea 3a 8c d4 |..=9.U.kW*Z{.:..|
c9 58 7d 65 2d c2 90 50 89 6b 3d 1c f9 e0 bf f4 |.X}e-..P.k=.....|
74 c4 4a a3 57 89 b1 77 c6 8e c2 a3 0c 0a 10 6c |t.J.W..w.......l|
27 b3 d6 d0 5a e5 37 f1 10 6a ef 6f 08 7e 49 c7 |'...Z.7..j.o.~I.|
66 57 56 51 af 1d 8b 57 f4 ad 11 2c 45 9e 16 85 |fWVQ...W...,E...|
09 f8 52 59 b6 f8 05 08 fc 19 ef 10 eb e2 ec 01 |..RY............|
d7 0d bb 77 0c 6a 6c 3b 59 67 9a 6d 76 73 06 61 |...w.jl;Yg.mvs.a|
0d 14 76 07 28 58 47 ae 30 34 0a 5c a1 5b df 2d |..v.(XG.04.\.[.-|
6c 59 5e 62 03 17 10 41 65 94 c9 b1 90 aa 30 43 |lY^b...Ae.....0C|
64 e7 96 5c 6e 7c 4c e5 60 e5 9d 23 65 6e ab 06 |d..\n|L.`..#en..|
0b f5 19 14 09 b7 a9 5b db b5 47 44 31 50 5d 48 |.......[..GD1P]H|
c0 04 e9 32 c8 76 f7 f7 c2 c2 80 78 ee 8b 08 08 |...2.v.....x....|
cd 76 ec 33 0c d8 89 07 eb d0 37 04 25 87 7d 5b |.v.3......7.%.}[|
2b c5 5c 13 38 bd 42 75 a8 dd 1b c0 f6 5a 1f 07 |+.\.8.Bu.....Z..|
01 c1 99 eb 9f f3 90 8e 61 db 98 58 c3 eb 1a 20 |........a..X... |
47 b4 94 64 c4 6c 4e 96 5e e0 17 8d 24 ed f2 f7 |G..d.lN.^...$...|
f1 07 b9 49 64 fb 20 b0 59 26 b9 22 d0 29 fd b4 |...Id. .Y&.".)..|
94 19 83 0e ea 88 63 4c f0 4d ef e7 a1 84 3c 9c |......cL.M....<.|
e4 e4 07 62 85 c8 e0 22 eb 37 43 16 ec bb f7 82 |...b...".7C.....|
5f ce c7 16 50 ba 8c 6d c5 13 62 46 97 e7 d0 36 |_...P..m..bF...6|
98 c8 90 ec da 5d f0 af 33 5e 28 c0 70 89 21 07 |.....]..3^(.p.!.|
04 93 3b 04 4b c3 cc 41 c0 39 57 f6 3b f7 46 bc |..;.K..A.9W.;.F.|
75 06 05 aa 03 eb ea 88 e6 90 57 fe c2 46 74 05 |u.........W..Ft.|
4b 13 1e ab 0a 0d 16 b6 9a 87 67 ef 5a 8e 0f 16 |K.........g.Z...|
03 41 74 17 28 da 7f 0c bd c3 4a aa 9f 2d 84 04 |.At.(.....J..-..|
0a 89 f0 eb f1 63 30 06 c4 47 af 8f 33 0d 96 28 |.....c0..G..3..(|
75 9f f5 75 4e e9 76 fe 96 07 e5 6d b6 90 ae 36 |u..uN.v....m...6|
0f 23 33 ab 52 cc 8a 9f 28 69 68 62 42 c1 10 d5 |.#3.R...(ihbB...|
ee 46 21 dd 77 4b 2f 48 5f 6c b8 f8 e4 46 07 80 |.F!.wK/H_l...F..|
59 2d 61 7e e1 85 7c 67 cb 83 34 10 7b 0e 0e e1 |Y-a~..|g..4.{...|
c6 8c 00 6a 3b 0c 94 75 6c 21 df 47 eb 6e b8 00 |...j;..ul!.G.n..|
2e 0d 24 6c ac c1 34 ce 37 a9 db 44 72 fa 24 4c |..$l..4.7..Dr.$L|
8c 51 ef 07 8d 74 b0 e0 48 94 35 c0 ba 4a 09 e3 |.Q...t..H.5..J..|
26 3e 51 1c 08 41 68 39 d1 72 84 5c 08 48 74 c1 |&>Q..Ah9.r.\.Ht.|
06 f6 cf bf 1c 74 84 26 c2 86 4a ba 89 17 ae 95 |.....t.&..J.....|
b6 c0 c1 74 49 60 4d 0a 64 d0 8a 4c 9e 15 0c df |...tI`M.d..L....|
81 c0 d2 70 36 18 44 fd 32 c7 92 05 de dd 01 df |...p6.D.2.......|
10 60 b4 a1 4a bc 20 f0 40 a9 40 06 3b 0e 4d 61 |.`..J. .@.@.;.Ma|
04 47 3e 5b 68 75 c4 72 32 b6 52 cd ca c0 2e ae |.G>[hu.r2.R.....|
4b b1 09 19 6b 02 4f 24 42 28 bc f4 c0 02 |K...k.O$B(.... |
|
| 48 | 4105 | 18 ca c2 03 0d 30 1b 81 81 cc 52 6d d4 a1 2f ec |.....0....Rm../.| 19 35 fe 4a 39 c8 72 2f 57 66 84 8b 39 07 b6 13 |.5.J9.r/Wf..9...| d9 91 72 32 25 38 87 0e 60 5f c0 34 af 00 23 c5 |..r2%8..`_.4..#.| 6c 4e f8 16 c1 42 53 89 fa 29 da b6 6f a8 57 16 |lN...BS..)..o.W.| fb 67 4c 37 0c 66 03 04 0e 0b 0b 34 02 4a 2e 35 |.gL7.f.....4.J.5| b3 37 c1 87 ed 6a 08 60 78 1f 09 79 0c 25 bf db |.7...j.`x..y.%..| e8 5c 02 3c 61 ec dd 06 62 24 72 0e eb d4 d0 a1 |.\. |
| 160 | 4105 | c0 24 22 25 3b de 25 9a cd 20 04 7a 03 c7 40 48 |.$"%;.%.. .z..@H| 8f 20 d8 fe dd f5 fe c5 6b 38 cd 76 0a 16 10 b7 |. ......k8.v....| b5 a3 f5 17 63 fd 72 08 39 03 81 80 8c 9c 70 eb |....c.r.9.....p.| df 51 1b c9 c8 be 9e bc 34 59 2c 02 75 0b |.Q......4Y,.u. | |
| 176 | 4105 | 54 c9 cb 0d 4e 2a 19 d0 61 04 48 83 06 04 58 ba |T...N*..a.H...X.|
ee 05 03 02 76 6a 42 9e d0 6c c4 e9 c3 50 78 e9 |....vjB..l...Px.|
52 dc 2c d1 60 08 23 eb 3e bb 0c 22 d2 50 1d 71 |R.,.`.#.>..".P.q|
a1 7c a4 c0 54 b4 4d 08 03 46 10 93 4b 58 02 7d |.|..T.M..F..KX.}|
7b c8 87 1c 06 99 cc 07 85 c1 72 84 b3 30 c7 7d |{.........r..0.}|
4e 5f de b7 57 80 0b 79 97 2d 57 01 90 0d f1 63 |N_..W..y.-W....c|
3a 6c 9c a1 54 af 3d 5c b2 4c f2 10 0f c8 7e 71 |:l..T.=\.L....~q|
02 1e 1e e2 41 d6 50 33 fc 7e 71 1c 3f 97 cd 49 |....A.P3.~q.?..I|
ea 00 6c b2 60 b2 4d 8b |..l.`.M. |
|
| module_name | hint | ord | function_name |
|---|---|---|---|
| KERNEL32.DLL | LoadLibraryA | ||
| KERNEL32.DLL | GetProcAddress | ||
| KERNEL32.DLL | VirtualProtect | ||
| KERNEL32.DLL | VirtualAlloc | ||
| KERNEL32.DLL | VirtualFree | ||
| KERNEL32.DLL | ExitProcess | ||
| ADVAPI32.dll | RegCloseKey | ||
| COMCTL32.dll | MenuHelp | ||
| COMDLG32.dll | ChooseFontA | ||
| GDI32.dll | BitBlt | ||
| SHELL32.dll | DragFinish | ||
| USER32.dll | GetDC |
StringTable 040904E4
| CompanyName | Wayne J. Radburn |
| FileDescription | PE/COFF File Viewer |
| FileVersion | 0.9.9.0 |
| InternalName | PEview |
| LegalCopyright | Copyright© 1997-2011 Wayne J. Radburn |
| OriginalFilename | PEview.exe |
| ProductName | PEview |
| ProductVersion | 0.9.9.0 |
VS_FIXEDFILEINFO
| FileVersion | 0.9.9.0 |
| ProductVersion | 0.9.9.0 |
| StrucVersion | 0x10000 |
| FileFlagsMask | 0x3f |
| FileFlags | 0 |
| FileOS | 4 |
| FileType | 1 |
| FileSubtype | 0 |
![]() |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[?] ignoring invalid PEdump::BITMAPINFOHEADER
[!] string size(16384) > stringtable size(1230). truncated to 1228
[!] cannot convert "\x06\x19\x92\xA6$\x18\xDC/\x8CM\x9EC&\xE4R\xC0"... to UTF-16
[!] string size(103472) > stringtable size(1092). truncated to 1090
[!] cannot convert "\xC2\x03\r0\e\x81\x81\xCCRm\xD4\xA1/\xEC\x195"... to UTF-16
[!] string size(18816) > stringtable size(62). truncated to 60
[!] cannot convert "\"%;\xDE%\x9A\xCD \x04z\x03\xC7@H\x8F "... to UTF-16
[!] string size(103080) > stringtable size(136). truncated to 134
[!] cannot convert "\xCB\rN*\x19\xD0a\x04H\x83\x06\x04X\xBA\xEE\x05"... to UTF-16
offset:( 0x )