filename0000203955.doddresc.b714678d913a98d61cbb6ab45aafecd8.exe.vir
size176128 (0x2b000)
md5b714678d913a98d61cbb6ab45aafecd8
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 94 65 43 4e d0 04 2d 1d  d0 04 2d 1d d0 04 2d 1d  |.eCN..-...-...-.|
00000050: d9 7c b8 1d dd 04 2d 1d  d0 04 2c 1d bd 04 2d 1d  |.|....-...,...-.|
00000060: d9 7c be 1d e7 04 2d 1d  cb 99 82 1d d9 05 2d 1d  |.|....-.......-.|
00000070: cb 99 b7 1d 75 04 2d 1d  cb 99 b0 1d 57 04 2d 1d  |....u.-.....W.-.|
00000080: 82 6d 4e 75 d0 04 2d 1d  6d 47 79 62 65 62 75 62  |.mNu..-.mGybebub|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4f52713a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion34.0
SizeOfCode0x28000
SizeOfInitializedData0x2c00
SizeOfUninitializedData0
AddressOfEntryPoint0x174d2
BaseOfCode0x1000
BaseOfData0x29000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x2d000
SizeOfHeaders0x400
CheckSum0x39a5e
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x27f040x28000RWX CODE
.refee0x290000xbb0x200R-- IDATA
.rsrc0x2a0000x19f40x1a00R-- IDATA
.reloc0x2c0000xfbc0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x283d00x52
IMPORT0x2a0000x8c
RESOURCE0x2a08c0x1968
EXCEPTION00
SECURITY00
BASERELOC0x2c0000xf6c
DEBUG0x2cfa00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x28d500x1b4
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
COMCTL32.dll23DestroyPropertySheetPage
COMCTL32.dll92PropertySheetW
COMCTL32.dll91PropertySheetA
COMCTL32.dll78ImageList_ReplaceIcon
COMCTL32.dll49ImageList_Destroy
COMCTL32.dll64ImageList_GetImageCount
COMCTL32.dll76ImageList_Remove
USER32.dll87CreateDialogIndirectParamW
USER32.dll562SetCaretPos
USER32.dll314GetMessageA
USER32.dll178DrawFrameControl
USER32.dll280GetIconInfo
USER32.dll763TrackPopupMenu
USER32.dll473MonitorFromRect
USER32.dll57CharUpperW
USER32.dll574SetDlgItemTextA
USER32.dll636ShowOwnedPopups
USER32.dll536RemovePropW
USER32.dll639ShowWindow
USER32.dll27CallWindowProcW
USER32.dll438LoadMenuA
USER32.dll644SwitchToThisWindow
USER32.dll544ScrollWindowEx
USER32.dll143DefWindowProcW
USER32.dll49CharPrevW
USER32.dll684ValidateRect
USER32.dll307GetMenuItemID
USER32.dll557SendNotifyMessageW
USER32.dll432LoadIconW
USER32.dll417IsWindowEnabled
USER32.dll277GetForegroundWindow
USER32.dll373GetWindowTextA
USER32.dll318GetMessageW
USER32.dll555SendMessageW
USER32.dll559SetActiveWindow
USER32.dll516RegisterClassExW
USER32.dll545SendDlgItemMessageA
USER32.dll317GetMessageTime
USER32.dll29CascadeWindows
USER32.dll223ExitWindowsEx
USER32.dll498PostMessageW
USER32.dll356GetUpdateRgn
USER32.dll648TabbedTextOutW
USER32.dll425LoadBitmapA
USER32.dll184DrawStateW
USER32.dll375GetWindowTextLengthW
USER32.dll56CharUpperBuffW
USER32.dll295GetKeyboardType
USER32.dll331GetPropW
USER32.dll77CopyRect
USER32.dll45CharNextW
USER32.dll400IsCharLowerA
USER32.dll296GetLastActivePopup
USER32.dll443LoadStringA
USER32.dll365GetWindowLongW
USER32.dll457MapWindowPoints
USER32.dll53CharToOemW
ntdll.dll914RtlInitAnsiString
KERNEL32.dll517GetLocaleInfoW
KERNEL32.dll581GetProcAddress
KERNEL32.dll211CreateFileMappingW
KERNEL32.dll1064SetHandleCount
KERNEL32.dll220CreateMailslotW
KERNEL32.dll399GetAtomNameA
KERNEL32.dll608GetSystemWindowsDirectoryA
KERNEL32.dll831LoadLibraryW
KERNEL32.dll657GlobalAlloc
KERNEL32.dll1170VirtualQuery
KERNEL32.dll503GetFileType
KERNEL32.dll370FindResourceW
KERNEL32.dll824MoveFileW
KERNEL32.dll886RaiseException
KERNEL32.dll402GetBinaryTypeA
KERNEL32.dll1057SetFileAttributesA
KERNEL32.dll822MoveFileExA
KERNEL32.dll191CopyFileA
KERNEL32.dll881QueryPerformanceCounter
KERNEL32.dll1065SetHandleInformation
KERNEL32.dll278EnterCriticalSection
KERNEL32.dll383FoldStringW
KERNEL32.dll1245lstrlenA
KERNEL32.dll414GetCommTimeouts
KERNEL32.dll628GetThreadTimes
GDI32.dll438Polygon
GDI32.dll364GetObjectW
GDI32.dll179DeleteDC
GDI32.dll465SelectObject
GDI32.dll491SetMapMode
GDI32.dll457RoundRect
GDI32.dll118BitBlt
GDI32.dll443RealizePalette
GDI32.dll381GetSystemPaletteUse
GDI32.dll392GetTextExtentPointA
GDI32.dll459ScaleViewportExtEx
GDI32.dll463SelectClipRgn
GDI32.dll509SetTextColor
GDI32.dll424PathToRegion
GDI32.dll129CombineRgn
GDI32.dll172CreateRectRgnIndirect
GDI32.dll410LineTo
GDI32.dll162CreateICW
GDI32.dll445RectVisible
GDI32.dll165CreatePalette
ordentry_vafunction_name
10x22044SetAnchorOriginal@12
module_nameidxido.com
flags0
timestamp2012-03-03 19:30:02
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x28d20
Functions(1)0x28d00
NameOrdinals(1)0x28d10
offsetsizetypecomment
0176128EXE03/03/2012 19:30:02#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find resource section for va=0x2a08c