filenamemini_installer_new.exe
size25919488 (0x18b8000)
md5c6421e567e51169a92801be28e0ccc32
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
1053
147307297
132307296
148210221
15102
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x52a08fc4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x2c00
SizeOfInitializedData0x18b5000
SizeOfUninitializedData0
AddressOfEntryPoint0x3220
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x18ba000
SizeOfHeaders0x400
CheckSum0x18c3c35
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2b420x2c00R-X CODE
.data0x40000x100RW- IDATA
.rsrc0x50000x18b4fc40x18b5000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x363c0x50
RESOURCE0x50000x18b4fc4
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x10e00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000xe0
Delay_IAT00
CLR_Header00
typenamesizecp
B7CHROME.PACKED.7Z253987071252
BLSETUP.EX_5054081252
ICON#17441252
GROUP_ICON#107201252
VERSION#19641252
MANIFEST#17781252
module_namehintordfunction_name
SHELL32.dll225SHGetSpecialFolderPathW
SHELL32.dll6CommandLineToArgvW
KERNEL32.dll586GetProcessHeap
KERNEL32.dll719HeapFree
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll960ReadFile
KERNEL32.dll1317WriteFile
KERNEL32.dll82CloseHandle
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1121SetFileAttributesW
KERNEL32.dll1130SetFileTime
KERNEL32.dll838LocalFileTimeToFileTime
KERNEL32.dll228DosDateTimeToFileTime
KERNEL32.dll143CreateFileW
KERNEL32.dll581GetProcAddress
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll1358lstrlenW
KERNEL32.dll479GetExitCodeProcess
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll715HeapAlloc
KERNEL32.dll1027RemoveDirectoryW
KERNEL32.dll214DeleteFileW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll659GetTickCount
KERNEL32.dll302FindClose
KERNEL32.dll325FindNextFileW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll864MoveFileExW
KERNEL32.dll514GetLastError
KERNEL32.dll258EnumResourceNamesW
KERNEL32.dll645GetTempPathW
KERNEL32.dll308FindFirstFileExW
KERNEL32.dll1156SetProcessWorkingSetSize
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll281ExitProcess
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll334FindResourceW
KERNEL32.dll1201SizeofResource
KERNEL32.dll852LockResource
KERNEL32.dll833LoadResource
KERNEL32.dll391GetCommandLineW
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll840LocalFree
KERNEL32.dll168CreateProcessW
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll572RegCreateKeyW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW

StringTable 040904b0

CompanyNameThe Orbitum Authors
FileDescriptionOrbitum
FileVersion21.0.1231.0
InternalNamemini_installer
LegalCopyrightCopyright (C) 2006-2012 The Orbitum Authors. All Rights Reserved.
ProductNameOrbitum
ProductVersion21.0.1231.0
CompanyShortNameThe Orbitum Authors
ProductShortNameOrbitum
LastChange140975
Official Build0

VS_FIXEDFILEINFO

FileVersion21.0.1231.0
ProductVersion21.0.1231.0
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d025913904BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 25919488 bytes (25 MiB)


--
Type = PE
Physical Size = 25919488
CPU = x86
Characteristics = Executable 32-bit NoRelocs
Created = 2013-12-05 14:37:56
Headers Size = 1024
Checksum = 25967669
Image Size = 25927680
Section Alignment = 4096
File Alignment = 512
Code Size = 11264
Initialized Data Size = 25907200
Uninitialized Data Size = 0
Linker Version = 9.0
OS Version = 5.0
Image Version = 0.0
Subsystem Version = 5.0
Subsystem = Windows GUI
DLL Characteristics = NX-Compatible TerminalServerAware
Stack Reserve = 1048576
Stack Commit = 4096
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 21.0.1231.0
ProductVersion: 21.0.1231.0
CompanyName: The Orbitum Authors
FileDescription: Orbitum
InternalName: mini_installer
LegalCopyright: Copyright (C) 2006-2012 The Orbitum Authors. All Rights Reserved.
ProductName: Orbitum
CompanyShortName: The Orbitum Authors
ProductShortName: Orbitum
LastChange: 140975
Official Build: 0
----
Path = .rsrc/B7/CHROME.PACKED.7Z
Size = 25398707
Packed Size = 25398707
--
Path = .rsrc/B7/CHROME.PACKED.7Z
Type = 7z
Physical Size = 25398707
Headers Size = 177
Method = LZMA:96m BCJ2
Solid = -
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2013-12-05 14:37:10 ....A     95743437     25398530  chrome.7z
------------------- ----- ------------ ------------  ------------------------
2013-12-05 14:37:10           95743437     25398530  1 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK