filenameinstall.exe
size5190144 (0x4f3200)
md5c83bf1616e1bee34701b192fb640bf7a
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
19807880
18844410
4288031
002
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4f0e23dc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.12
SizeOfCode0x1800
SizeOfInitializedData0x4f1600
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x4f6000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C# v7.0 / Basic .NET

Sections

namevavsizeraw sizeflags
.text0x10000x171a0x1800R-X CODE
.rdata0x30000x7960x800R-- IDATA
.data0x40000x4cbbe80x4cbc00RW- IDATA
.rsrc0x4d00000x250d00x25200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x31280x78
RESOURCE0x4d00000x250d0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x30000x128
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP#700655760
BITMAP#701655760
ICON#196400
ICON#242640
ICON#342640
DIALOG#20002440
DIALOG#30002480
GROUP_ICON#500200
GROUP_ICON#501200
GROUP_ICON#502200
VERSION#17040
MANIFEST#14290
module_namehintordfunction_name
gdi32.dll46CreateFontA
gdi32.dll221GetStockObject
user32.dll491SetCapture
user32.dll466ReleaseCapture
user32.dll382LoadBitmapA
user32.dll328GetWindowRect
user32.dll323GetWindowLongA
user32.dll241GetDlgCtrlID
user32.dll590UpdateWindow
user32.dll578TranslateMessage
user32.dll557ShowWindow
user32.dll546SetWindowTextA
user32.dll544SetWindowPos
user32.dll541SetWindowLongA
user32.dll512SetMenu
user32.dll508SetForegroundWindow
user32.dll507SetFocus
user32.dll482SendMessageA
user32.dll456RegisterClassExA
user32.dll447PostQuitMessage
user32.dll416MessageBoxIndirectA
user32.dll394LoadMenuA
user32.dll388LoadIconA
user32.dll384LoadCursorA
user32.dll308GetSystemMetrics
user32.dll292GetParent
user32.dll281GetMessageA
user32.dll242GetDlgItem
user32.dll173EndDialog
user32.dll140DispatchMessageA
user32.dll138DialogBoxParamA
user32.dll136DialogBoxIndirectParamA
user32.dll126DefWindowProcA
user32.dll84CreateWindowExA
user32.dll19CallWindowProcA
user32.dll4AnimateWindow
kernel32.dll83DeleteFileA
kernel32.dll670WriteFile
kernel32.dll169FlushFileBuffers
kernel32.dll503ReadFile
kernel32.dll245GetFileSize
kernel32.dll48CreateFileA
kernel32.dll147FindFirstFileA
kernel32.dll143FindClose
kernel32.dll608Sleep
kernel32.dll595SetThreadPriority
kernel32.dll579SetPriorityClass
kernel32.dll334GetThreadPriority
kernel32.dll238GetExitCodeProcess
kernel32.dll221GetCurrentThread
kernel32.dll64CreateProcessA
kernel32.dll26CloseHandle
kernel32.dll660WinExec
kernel32.dll609SleepEx
kernel32.dll553SetCurrentDirectoryA
kernel32.dll511RemoveDirectoryA
kernel32.dll455MultiByteToWideChar
kernel32.dll366GlobalFree
kernel32.dll359GlobalAlloc
kernel32.dll348GetVolumeInformationA
kernel32.dll265GetModuleHandleA
kernel32.dll257GetLogicalDriveStringsA
kernel32.dll232GetDriveTypeA
kernel32.dll217GetCurrentDirectoryA
kernel32.dll200GetCommandLineA
kernel32.dll128ExitProcess
kernel32.dll41CreateDirectoryA
comctl32.dll63InitCommonControlsEx
shell32.dll103ShellExecuteA

StringTable 040904B0

CompanyNameThe MASM32 SDK
FileDescriptionMASM32 Installation
FileVersion11.0
InternalNameInstall
OriginalFilenameinstall.exe
LegalCopyright© 2011 The MASM32 SDK
ProductNameMASM32 SDK
ProductVersion11.0

VS_FIXEDFILEINFO

FileVersion11.0.0.0
ProductVersion11.0.0.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
3c284096EXE09/27/2011 14:46:55#
4c50175616EXE06/28/2005 18:16:10#
2fa504994992BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK