filenameWinRAR.v3.80_KEYGEN-FFF.exe
size385024 (0x5e000)
md5c90a5e6759b8d03df89de8f9255854fd
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1323072937
1493072929
13130729136
1089666
1235072717
10169
1383072914
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x49a46e9d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x18e00
SizeOfInitializedData0x3ea00
SizeOfUninitializedData0
AddressOfEntryPoint0x94a9
BaseOfCode0x1000
BaseOfData0x1a000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x5f000
SizeOfHeaders0x400
CheckSum0x3f149
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.nfJBg860x10000x590000x59000RW- IDATA
.nfJBg860x5a0000x20000x2000RW- IDATA
.nfJBg860x5c0000x320x32R-X CODE
.idata20x5d0000x10000xe00RW- IDATA
.mackt�0x5e0000x10000x1000RWX CODE IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x5e0000xa0
RESOURCE0x5a0000xa5c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
PNG#1081053980
PNG#11214430
ICON#122160
RCDATA#11135520
RCDATA#113691680
GROUP_ICON#109200
module_namehintordfunction_name
advapi32.dll485RegOpenKeyExA
advapi32.dll495RegQueryValueExA
advapi32.dll152CryptGenRandom
advapi32.dll162CryptReleaseContext
advapi32.dll136CryptAcquireContextW
advapi32.dll459RegCloseKey
comdlg32.dll112GetSaveFileNameA
gdi32.dll51CreateDIBSection
gdi32.dll71CreatePatternBrush
gdi32.dll144DeleteObject
gdi32.dll496Polyline
gdi32.dll72CreatePen
gdi32.dll574SetTextColor
gdi32.dll59CreateFontIndirectA
gdi32.dll535SetBkColor
gdi32.dll536SetBkMode
gdi32.dll3AddFontMemResourceEx
gdi32.dll440GetTextExtentPointA
gdi32.dll592TextOutA
gdi32.dll19BitBlt
gdi32.dll528SelectObject
gdi32.dll46CreateCompatibleDC
gdi32.dll409GetObjectW
gdi32.dll141DeleteDC
kernel32.dll437GetStringTypeW
kernel32.dll434GetStringTypeA
kernel32.dll231FlushFileBuffers
kernel32.dll806SetStdHandle
kernel32.dll911WriteConsoleW
kernel32.dll303GetConsoleOutputCP
kernel32.dll901WriteConsoleA
kernel32.dll538InitializeCriticalSectionAndSpinCount
kernel32.dll80CreateFileA
kernel32.dll666RaiseException
kernel32.dll375GetModuleHandleA
kernel32.dll449GetSystemTimeAsFileTime
kernel32.dll317GetCurrentProcessId
kernel32.dll661QueryPerformanceCounter
kernel32.dll336GetEnvironmentStringsW
kernel32.dll240FreeEnvironmentStringsW
kernel32.dll334GetEnvironmentStrings
kernel32.dll239FreeEnvironmentStringsA
kernel32.dll568LCMapStringW
kernel32.dll616MultiByteToWideChar
kernel32.dll567LCMapStringA
kernel32.dll562IsValidCodePage
kernel32.dll364GetLocaleInfoA
kernel32.dll769SetEndOfFile
kernel32.dll413GetProcessHeap
kernel32.dll679ReadFile
kernel32.dll530HeapSize
kernel32.dll581LoadLibraryA
kernel32.dll183ExitProcess
kernel32.dll409GetProcAddress
kernel32.dll834SizeofResource
kernel32.dll600LockResource
kernel32.dll494GlobalAlloc
kernel32.dll469GetTickCount
kernel32.dll378GetModuleHandleW
kernel32.dll586LoadResource
kernel32.dll227FindResourceW
kernel32.dll778SetFilePointer
kernel32.dll835Sleep
kernel32.dll396GetOEMCP
kernel32.dll247GetACP
kernel32.dll254GetCPInfo
kernel32.dll351GetFileType
kernel32.dll373GetModuleFileNameA
kernel32.dll433GetStdHandle
kernel32.dll528HeapReAlloc
kernel32.dll879VirtualAlloc
kernel32.dll128DeleteCriticalSection
kernel32.dll818SetThreadPriority
kernel32.dll109CreateThread
kernel32.dll361GetLastError
kernel32.dll524HeapFree
kernel32.dll518HeapAlloc
kernel32.dll266GetCommandLineA
kernel32.dll431GetStartupInfoA
kernel32.dll843TerminateProcess
kernel32.dll316GetCurrentProcess
kernel32.dll860UnhandledExceptionFilter
kernel32.dll823SetUnhandledExceptionFilter
kernel32.dll558IsDebuggerPresent
kernel32.dll151EnterCriticalSection
kernel32.dll580LeaveCriticalSection
kernel32.dll712RtlUnwind
kernel32.dll912WriteFile
kernel32.dll899WideCharToMultiByte
kernel32.dll284GetConsoleCP
kernel32.dll301GetConsoleMode
kernel32.dll50CloseHandle
kernel32.dll850TlsGetValue
kernel32.dll848TlsAlloc
kernel32.dll851TlsSetValue
kernel32.dll849TlsFree
kernel32.dll545InterlockedIncrement
kernel32.dll706SetLastError
kernel32.dll319GetCurrentThreadId
kernel32.dll541InterlockedDecrement
kernel32.dll520HeapCreate
kernel32.dll882VirtualFree
msimg32.dll2AlphaBlend
user32.dll144DefWindowProcW
user32.dll700UpdateWindow
user32.dll98CreateWindowExW
user32.dll659ShowWindow
user32.dll644SetWindowPos
user32.dll445LoadIconW
user32.dll537RegisterClassExW
user32.dll269GetDC
user32.dll249GetClassInfoExW
user32.dll368GetWindowLongW
user32.dll642SetWindowLongW
user32.dll154DestroyWindow
user32.dll536RegisterClassExA
user32.dll248GetClassInfoExA
user32.dll97CreateWindowExA
user32.dll236GetActiveWindow
user32.dll512PostMessageA
user32.dll590SetCursor
user32.dll319GetMessageW
user32.dll514PostQuitMessage
user32.dll513PostMessageW
user32.dll443LoadCursorW
user32.dll572SendMessageA
user32.dll683TranslateMessage
user32.dll477MessageBoxA
user32.dll555ReleaseDC
user32.dll268GetCursorPos
user32.dll604SetLayeredWindowAttributes
user32.dll350GetSystemMetrics
user32.dll577SendMessageW
user32.dll490MoveWindow
user32.dll163DispatchMessageW
user32.dll698UpdateLayeredWindow
user32.dll635SetTimer
user32.dll373GetWindowRect
winmm.dll186waveOutClose
winmm.dll207waveOutWrite
winmm.dll200waveOutPrepareHeader
winmm.dll198waveOutOpen
winmm.dll206waveOutUnprepareHeader
winmm.dll201waveOutReset
winmm.dll195waveOutGetPosition
ole32.dll147CreateStreamOnHGlobal
offsetsizetypecomment
0385024EXE02/24/2009 22:03:09#
15c115HTM#
2d000105398PNG(359 x 264)#
46bb81443PNG(96 x 38)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK