| filename | PEview1small.exe | |
|---|---|---|
| size | 40960 (0xa000) | |
| md5 | cb628fb6e0e34afd2b8b6d8abb5302a1 | |
| type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x6c |
| blocks_in_file | 1 |
| num_relocs | 0 |
| header_paragraphs | 2 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0 |
| checksum | 0 |
| ip | 0x11 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0 |
| reserved0 | 0x336e695700000000 |
| oem_id | 0x2032 |
| oem_info | 0x7250 |
| reserved2 | 0x6172676f |
| reserved3 | 0xa0d216d |
| reserved4 | 0xba09b424 |
| reserved5 | 0x21cd0100 |
| reserved6 | 0x21cd4cb4 |
| lfanew | 0x60 |
DOS stub
00000000: 57 69 6e 33 32 20 50 72 6f 67 72 61 6d 21 0d 0a |Win32 Program!..| 00000010: 24 b4 09 ba 00 01 cd 21 b4 4c cd 21 60 00 00 00 |$......!.L.!`...| 00000020: 47 6f 4c 69 6e 6b 2c 20 47 6f 41 73 6d 20 77 77 |GoLink, GoAsm ww| 00000030: 77 2e 47 6f 44 65 76 54 6f 6f 6c 2e 63 6f 6d 00 |w.GoDevTool.com.|
PE Header
Packer / Compiler
UPX v0.89.6 - v1.02 / v1.05 - v1.22 This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0xd000 | 0 | RWX UDATA | |
| UPX1 | 0xe000 | 0x9000 | 0x8800 | RWX IDATA | |
| .rsrc | 0x17000 | 0x2000 | 0x1600 | RW- IDATA |
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0x183d8 | 0x1dc | |
| RESOURCE | 0x17000 | 0x13d8 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0 | 0 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0 | 0 | |
| Delay_IAT | 0 | 0 | |
| CLR_Header | 0 | 0 |
| id | lang | string |
|---|---|---|
| 32 | 4105 | 4e 7e 8a d2 e2 cf de 04 77 8a 82 d1 05 e8 c5 d1 |N~......w.......|
8a 8a 73 1d b8 bb ce 15 8a 82 cd 05 0a b4 06 c6 |..s.............|
41 b0 88 35 db 2a 31 e1 86 ca 0c bd 01 75 5f fd |A..5.*1......u_.|
9b d0 85 33 07 ff 08 4f 1c 15 05 fc 0d 35 b9 04 |...3...O.....5..|
33 bf 34 f3 40 00 ff ff 82 3f 63 f2 af 75 2f 8e |3.4.@....?c..u/.|
8b 77 20 bf 5f aa 40 00 f3 a4 89 f8 f5 80 dd 49 |.w ._.@........I|
d7 d5 66 29 f8 d1 00 0f 43 8a bf d6 3b 35 86 b8 |..f)....C...;5..|
01 98 3b 80 8b 8c 33 85 c7 8a 2f 70 6c 63 2c ae |..;...3.../plc,.|
45 00 c3 0d fc 8a 89 b1 f4 8f 55 45 0c 9d 34 04 |E.........UE..4.|
98 15 38 21 9e 4b c7 ef a8 37 4b 89 31 c0 39 d6 |..8!.K...7K.1.9.|
73 14 8d 7c c3 ff 7f 04 83 c0 02 01 ce 83 e9 08 |s..|............|
78 06 d1 e9 01 c8 eb e8 43 10 22 ba 24 90 7f ff |x.......C.".$...|
e1 41 43 43 eb 04 01 ce 29 c2 2a 89 c8 83 14 fc |.ACC....).*.....|
78 f7 e8 08 d1 e8 31 39 c2 73 ea cf 43 89 27 85 |x.....19.s..C.'.|
8c 88 4c 4d 6a 9e 82 6b 70 77 f4 8a 82 9d 05 44 |..LMj..kpw.....D|
7c 06 44 f0 23 e5 02 9b 5e 81 08 48 39 c2 2e b8 ||.D.#...^..H9...|
21 08 1b 42 50 89 d1 dc 5b c2 0d fd 00 83 c6 08 |!..BP...[.......|
29 d1 ab ce 89 15 97 34 f0 ff 40 18 59 58 89 c2 |)......4..@.YX..|
25 00 f0 00 00 81 e2 ff 68 77 07 77 23 3d 00 30 |%.......hw.w#=.0|
3d 37 bf 95 6a be 74 d1 a4 58 e0 44 32 5d 14 23 |=7..j.t..X.D2].#|
f8 5d ef bf bc a2 40 00 01 76 9c 34 e1 45 fd 62 |.]....@..v.4.E.b|
52 c3 a3 a8 28 73 c0 02 18 d0 51 f1 1f 11 00 00 |R...(s....Q.....|
d6 01 f8 19 e2 bd 05 2b 2a 75 84 fb 03 ec 07 03 |.......+*u......|
60 02 00 00 a0 50 45 36 c0 1c d7 1f 13 e7 8a 72 |`....PE6.......r|
07 4c dc d2 06 5c 70 43 55 00 c5 9c a1 40 93 39 |.L...\pCU....@.9|
aa 3a 22 98 00 f2 aa de 73 54 79 1b 03 44 3c ec |.:".....sTy..D<.|
99 bb 07 03 f5 a7 fb ff 0f 73 0b 0d 00 00 43 75 |.........s....Cu|
73 74 6f 6d 20 28 2a 2e 2a 29 00 04 51 0b 6c 99 |stom (*.*)..Q.l.|
19 09 cc 40 03 73 6c 19 76 0f 54 61 b3 ff 02 31 |...@.sl.v.Ta...1|
41 72 69 61 6c 0c 05 6c 84 99 80 5d 64 1b 08 1b |Arial..l...]d...|
61 83 33 17 ff ff 3f ec 20 00 49 4d 41 47 45 5f |a.3...?. .IMAGE_|
52 45 4c 5f 42 41 53 45 44 5f 48 49 47 48 10 65 |REL_BASED_HIGH.e|
23 ec 4c 4f 57 37 17 29 82 1f 04 4e 00 00 00 5b |#.LOW7.)...N...[|
e9 ba ee bf 1f 01 00 00 14 02 00 00 47 0f 31 07 |............G.1.|
00 03 01 c8 01 98 a6 02 04 c0 80 0c 91 21 6b d5 |.............!k.|
ae 28 e7 3a f2 33 13 32 9f 0a 70 11 7d 2a 00 45 |.(.:.3.2..p.}*.E|
9b ff ee 3b b8 a0 10 40 00 bc 03 30 1d 40 00 14 |...;...@...0.@..|
18 40 00 48 88 17 69 be 69 fe 40 00 dc 1b 40 00 |.@.H..i.i.@...@.|
e8 f0 00 1c 40 00 10 80 ee ff bb a6 90 00 2b 70 |....@.........+p|
26 40 00 50 12 40 00 1c 15 40 00 38 03 a6 69 be |&@.P.@...@.8..i.|
f9 c0 14 40 00 80 6d fe ff ff 6f 6b 64 ba ae f9 |...@..m...okd...|
ff f9 ff ff ff f8 fd ff ff 44 1f 40 00 60 fc 3b |.........D.@.`.;|
c8 03 b8 1d 05 ae 69 a0 24 bf d7 26 6b 08 c2 75 |......i.$..&k..u|
07 27 03 1d 2a 07 aa 72 01 ae 29 03 bb a9 ca 54 |.'..*..r..)....T|
65 92 66 3a ae 2a 57 95 be 99 9a a6 e9 ba 33 1b |e.f:.*W.......3.|
34 03 35 36 39 3a 05 98 a6 69 37 38 3b ee 3f f7 |4.569:...i78;.?.|
5d 61 1c 28 40 00 70 03 a3 74 2a 40 00 cc 03 dc |]a.(@.p..t*@....|
81 bc f9 c0 2b 40 00 24 30 2c 40 00 54 0f fe bb |....+@.$0,@.T...|
ff c3 03 94 19 40 00 c0 34 40 00 78 13 a8 22 40 |.....@..4@.x.."@|
00 34 23 40 00 94 df fd 9b ef 03 24 24 40 00 ac |.4#@.......$$@..|
54 2d 40 00 4d 61 69 6e 66 00 54 6f 6f 6c f7 ff |T-@.Mainf.Tool..|
ff ff 42 61 72 57 69 6e 64 6f 77 33 32 00 6d 73 |..BarWindow32.ms|
63 74 6c 73 5f 73 74 61 74 75 73 62 61 72 12 7a |ctls_statusbar.z|
bf f7 7f 00 53 79 73 54 72 65 65 56 69 65 21 35 |....SysTreeVie!5|
00 00 f7 10 b0 99 29 80 0d 05 82 bd 17 ec a4 0e |......).........|
0a d7 0e 58 ec 35 c4 06 c6 00 ef 0c 04 05 7b 0e |...X.5........{.|
2a fe fb 0e 64 b1 c3 8b 06 5b 0b 0c 04 86 82 60 |*...d....[.....`|
6f 58 13 e2 78 c1 1e 0f 67 05 24 13 0a ae 2a d8 |oX..x...g.$...*.|
7b 77 04 08 13 5e 0c d1 c0 0e 87 13 a0 63 b0 81 |{w...^.......c..|
1d 97 13 2e 00 7f 0e 2e 6a d8 0b b3 bb 1d 1c c1 |........j.......|
c0 63 8f cb 0e 8e a2 81 3b 54 db ec fd ff c0 13 |.c......;T......|
53 6f 66 74 77 61 72 65 5c 57 4a 52 4f 0f ff 7d |Software\WJRO..}|
c3 0f 5c 50 45 76 53 00 46 6f 6e 74 1b 4f 70 65 |..\PEvS.Font.Ope|
6e 44 fb ff e6 ef 69 72 00 07 45 78 74 74 69 6f |nD....ir..Exttio|
6e 73 00 50 6c 61 63 65 6d 65 24 b9 0e 08 37 28 |ns.Placeme$...7(|
7d 2b 07 dc 1f 30 f7 fb 30 07 e6 00 52 65 61 64 |}+...0..0...Read|
79 13 7f d8 bb ff 43 69 6e 67 2e 2e f4 43 6c 6f |y.....Cing...Clo|
73 0b 45 78 70 61 6e b3 ee f0 b0 64 0d 00 00 d4 |s.Expan....d....|
0d 20 8a c1 ff ee ff 20 2d 20 55 6e 74 69 74 6c |. ..... - Untitl|
65 64 43 45 78 65 63 75 74 61 62 6c 65 ef 1c c1 |edCExecutable...|
1d 13 65 78 65 15 06 00 44 79 6e e7 ef bb ff 61 |..exe...Dyn....a|
6d 69 63 20 4c 69 6e 6b 04 62 72 61 72 79 22 64 |mic Link.brary"d|
6c 6c fd 11 fc 70 06 33 74 65 4b 73 79 73 df dd |ll...p.3teKsys..|
ff ee 14 06 00 41 63 74 69 76 65 58 20 43 f0 72 |.....ActiveX C.r|
6f 6c 32 6f f0 0f eb de 63 78 1d 06 00 15 50 61 |ol2o....cx....Pa|
6e 65 6c 20 bb d8 cf dd 00 65 6e 73 ff 25 63 70 |nel .....ens.%cp|
58 06 00 53 f7 fe fe 8e 63 8a 6e 20 53 61 |X..S....c.n Sa |
|
| 48 | 4105 | 72 1a 73 63 72 40 06 9d 3b 7f 7f 00 4f 62 6a 65 |r.scr@..;...Obje|
63 74 14 6f 62 6a 06 88 6d 64 77 ef b3 62 6a 64 |ct.obj..mdw..bjd|
62 67 14 06 00 4c 69 b3 0f ec bb f7 6c 69 62 15 |bg...Li.....lib.|
06 00 54 79 70 65 ce 74 6c 7f a4 8b fd 62 2c 2a |..Type.tl....b,*|
2e 6f 6c 20 0c 3b 00 41 6c 6c 20 46 42 90 82 f7 |.ol .;.All FB...|
69 6c 65 73 69 29 3f 86 3b c3 0f 45 72 72 6f 72 |ilesi)?.;..Error|
3a ea 63 65 70 d5 0f 76 f7 60 17 4c 69 63 cd 65 |:.cep..v.`.Lic.e|
00 00 0f 56 65 72 ff ff ff 63 db 30 2e 39 2e 38 |...Ver...c.0.9.8|
2e 30 0d 0a 43 6f 70 79 72 69 67 68 74 20 a9 20 |.0..Copyright . |
31 39 39 37 7b ff ff ff 2d 32 30 30 37 20 57 61 |1997{...-2007 Wa|
79 6e 65 20 4a 2e 20 52 61 64 62 75 72 6e 2e 20 |yne J. Radburn. |
7c 27 fe ff ff 1f 73 20 72 65 73 65 72 76 65 64 ||'....s reserved|
2e 0d 0a 0d 0a 54 68 65 20 61 75 74 68 6f 72 20 |.....The author |
6c bf e1 10 ce 6b 73 d3 66 30 20 6f 66 20 63 68 |l....ks.f0 of ch|
e3 77 ff ff 61 72 67 65 20 74 6f 20 79 6f 75 20 |.w..arge to you |
6f 6e 20 74 33 66 6f 6c 6c 6f 77 01 7f d7 ed fe |on t3follow.....|
74 65 72 6d 73 16 6c 79 50 59 21 6d 61 79 20 75 |terms.lyPY!may u|
73 65 fc ff bf fb 20 69 74 20 66 56 6e 6f 6e 2d |se.... it fVnon-|
63 6f 6d 6d 65 72 63 69 61 6c 20 65 64 75 63 61 |commercial educa|
3a 0c bf 7b 9f 0b 70 75 72 70 6f 73 10 5a 20 ff |:..{..purpos.Z .|
5f f7 ef 36 0d 0a 61 6c 73 6f 20 63 d3 20 12 64 |_..6..also c. .d|
69 73 74 72 69 62 75 74 f7 66 bb 63 4c 77 69 a6 |istribut.f.cLwi.|
75 74 8f 79 5d ec 5d 90 fe 74 68 69 73 20 73 2c |ut.y].]..this s,|
80 0d 0a 49 66 a7 e6 de e1 7f 64 6f 20 6e 6f 74 |...If.....do not|
20 41 63 4f b2 91 aa 58 17 ec 37 2c 0c 6e 20 1f | AcO...X..7,.n .|
a8 2c 70 37 21 60 ee 2c 20 ab 70 70 51 30 b8 fe |.,p7!`., .ppQ0..|
71 53 65 6c 1d 55 6e 69 6e dd c3 df 0d 86 6f 08 |qSel.Unin.....o.|
72 65 6d 6f 76 12 08 72 65 67 a5 79 21 59 ac fb |remov..reg.y!Y..|
20 73 65 74 74 95 73 f4 3d 61 12 82 fd 09 70 72 | sett.s.=a....pr|
6f 76 69 64 ef 6e 86 fd 4f 58 c2 20 22 61 73 20 |ovid.n..OX. "as |
69 73 22 20 ed 81 6f f8 bb 04 72 61 6e 74 79 0d |is" ..o...ranty.|
0a 8a 61 6e 79 20 6b 72 37 dc 61 b8 2c 20 65 0c |..any kr7.a., e.|
c8 65 78 70 ce 73 65 64 e1 e9 ff 7f bd 69 6d 70 |.exp.sed.....imp|
6c 69 65 64 2c 20 69 6e 63 6c 75 ac 20 3b 87 77 |lied, inclu. ;.w|
3f 82 06 6c 69 6d 69 74 25 74 6f 0d 0a be 38 37 |?..limit%to...87|
d8 60 2a 20 5d 69 93 5e 3f c2 df 3d a3 68 6c 61 |.`* ]i.^?..=.hla|
62 69 6c 69 74 79 83 66 69 74 6e 65 41 f8 ff b3 |bility.fitneA...|
73 d5 61 20 70 61 72 74 69 63 75 6c 61 72 20 bc |s.a particular .|
60 78 c2 0c 21 e3 73 68 61 23 77 88 e5 f8 7a 62 |`x..!.sha#w...zb|
65 52 05 a8 ba c3 65 cf f0 64 69 72 4a 9f 09 63 |eR....e..dirJ..c|
10 1d ae 7f 78 6e 74 61 6c 85 6e 73 65 71 75 af |....xntal.nsequ.|
27 2c b0 a3 fb f8 0d 0a 73 70 65 31 2c 69 6e 31 |',......spe1,in1|
76 65 b0 fb cf 8d a2 73 c9 7e 64 61 6d 61 67 b6 |ve.....s.~damag.|
64 75 bf c3 f5 d0 87 6f d3 20 ae 88 66 20 64 61 |du.....o. ..f da|
74 61 bd a3 fb 0e 0f 72 6f ed 72 f2 61 73 6f 6e |ta.....ro.r.ason|
b1 11 fe df 53 65 76 65 6e 20 69 66 20 61 64 76 |....Seven if adv|
69 35 66 39 7b 43 b0 1d 85 73 69 f4 07 73 75 63 |i5f9{C...si..suc|
68 45 f6 6b f8 98 60 2e 20 49 6e 42 20 39 74 20 |hE.k..`. InB 9t |
dd bd 6f f8 6f 58 63 6c 61 69 6d 2b 20 62 65 0d |..o.oXclaim+ be.|
0a b3 c2 1f 76 7a fc 24 98 65 78 63 65 65 84 f0 |....vz.$.excee..|
91 0c 2e 82 09 c8 20 66 65 65 43 90 de db 44 69 |...... feeC...Di|
64 29 17 7b 21 90 0c 24 8c 07 7e f3 dd 7f 7a f7 |d).{!..$..~...z.|
55 70 d0 65 73 00 00 5c 73 68 6f 75 6c 64 74 20 |Up.es..\shouldt |
63 8e 8e 08 59 8b 66 0f c4 6c c3 c5 72 fd 61 74 |c...Y.f..l..r.at|
65 73 74 20 df 22 c7 85 bd e1 df 34 9b 20 6d 79 |est .".....4. my|
20 77 65 62 70 31 20 61 74 3a fe 77 ff 3f f8 68 | webp1 at:.w.?.h|
74 74 70 3a 2f 2f 77 77 77 2e e7 6d 61 2e 63 61 |ttp://www..ma.ca|
2f 7e 77 6a 72 43 f8 06 fe 1b 49 20 68 26 20 70 |/~wjrC....I h& p|
6c 61 6e f8 07 d3 d9 ff 66 65 77 20 6d 6f 72 65 |lan.....few more|
20 75 8d 2c 74 48 1d 77 99 5e 12 dd 44 63 72 6f | u.,tH.w.^..Dcro|
26 61 fe 67 1d 1d 72 67 ab 72 42 73 6f 6d 65 20 |&a.g..rg.rBsome |
73 75 67 4d 37 3c 19 a9 f3 73 cc 6c 65 61 8a 65 |sugM7<...s.lea.e|
58 17 cc fd 2d 6d 61 69 6c 20 1d 8f 7a 40 88 78 |X...-mail ..z@.x|
10 fb 6f 83 45 6e 6a 6f 79 d7 eb 0e fe 60 31 8f |..o.Enjoy....`1.|
ce 41 63 6b 6e 6f 77 6a c7 43 c3 83 67 db 17 4d |.Acknowj.C..g..M|
8f 74 b8 9b 5c ef 78 6b 73 20 67 0a 6f 20 41 6e |.t..\.xks g.o An|
2a 2b 52 6f 7e d3 0d a6 62 b5 f9 20 4a 65 b3 79 |*+Ro~...b.. Je.y|
20 47 6f 72 64 97 e9 ff f8 0e 53 07 53 63 68 72 | Gord.....S.Schr|
65 69 62 46 |eibF |
|
| 160 | 4105 | 硄⦌൳訊㭈Ⰶ쭧嵾䘬潰콉ᶽ滿㛋槓睠ⲽ晊汵ᯭ壺ᙇ₋棣汥ꑰ轤⃥ |
| 176 | 4105 | 久单䱅䍅瑔ﮩ縛楔敭칄瑓浡൰挊荣䳡麻ᵤ敷ݠ밸휺犋᱂ͧﯦ出ѳ特浡睥牯荫쫿ᘒ能瑓畲瑣ή븺䵵땅ꩰ䠠泝㯼輓湲踼䜊䅯浳⋧㛡剆у⛇谊䴃䉿杵眠楨 |
| module_name | hint | ord | function_name |
|---|---|---|---|
| KERNEL32.DLL | LoadLibraryA | ||
| KERNEL32.DLL | GetProcAddress | ||
| KERNEL32.DLL | VirtualProtect | ||
| KERNEL32.DLL | VirtualAlloc | ||
| KERNEL32.DLL | VirtualFree | ||
| KERNEL32.DLL | ExitProcess | ||
| ADVAPI32.dll | RegCloseKey | ||
| COMCTL32.dll | MenuHelp | ||
| COMDLG32.dll | ChooseFontA | ||
| GDI32.dll | BitBlt | ||
| SHELL32.dll | DragFinish | ||
| USER32.dll | GetDC |
StringTable 040904E4
| CompanyName | Wayne J. Radburn |
| FileDescription | PE/COFF File Viewer |
| FileVersion | 0.9.9.0 |
| InternalName | PEview |
| LegalCopyright | Copyright© 1997-2011 Wayne J. Radburn |
| OriginalFilename | PEview.exe |
| ProductName | PEview |
| ProductVersion | 0.9.9.0 |
VS_FIXEDFILEINFO
| FileVersion | 0.9.9.0 |
| ProductVersion | 0.9.9.0 |
| StrucVersion | 0x10000 |
| FileFlagsMask | 0x3f |
| FileFlags | 0 |
| FileOS | 4 |
| FileType | 1 |
| FileSubtype | 0 |
![]() |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[?] ignoring invalid PEdump::BITMAPINFOHEADER
[!] string size(64668) > stringtable size(1230). truncated to 1228
[!] cannot convert "\x8A\xD2\xE2\xCF\xDE\x04w\x8A\x82\xD1\x05\xE8\xC5\xD1\x8A\x8A"... to UTF-16
[!] string size(13540) > stringtable size(1092). truncated to 1090
[!] cannot convert "scr@\x06\x9D;\x7F\x7F\x00Object"... to UTF-16
[!] string size(25816) > stringtable size(62). truncated to 60
[!] string size(39614) > stringtable size(136). truncated to 134
offset:( 0x )