filenameMiracle_Android_Tool_Setup1.1.exe
size37484170 (0x23bf68a)
md5cd7dd1802d5d820c99094f84e4db55fb
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
14729918
10816863
003
1980349
10100
1189661
11816820
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x3dd90d01
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x9000
SizeOfInitializedData0x6000
SizeOfUninitializedData0
AddressOfEntryPoint0x49cb
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x10000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Armadillo v4.x

Sections

namevavsizeraw sizeflags
.text0x10000x87fa0x9000R-X CODE
.rdata0xa0000x17040x2000R-- IDATA
.data0xc0000x27d80x2000RW- IDATA
.rsrc0xf0000x4d00x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xaec80x64
RESOURCE0xf0000x4d0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xa0000x17c
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
DIALOG#1012240
GROUP_ICON#103200
module_namehintordfunction_name
KERNEL32.dll45CreateDirectoryA
KERNEL32.dll776lstrlenA
KERNEL32.dll551RemoveDirectoryA
KERNEL32.dll52CreateFileA
KERNEL32.dll27CloseHandle
KERNEL32.dll274GetFileSize
KERNEL32.dll536ReadFile
KERNEL32.dll735WriteFile
KERNEL32.dll618SetFilePointer
KERNEL32.dll282GetLastError
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll556ResumeThread
KERNEL32.dll647SetThreadPriority
KERNEL32.dll74CreateThread
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll68CreateProcessA
KERNEL32.dll357GetTempPathA
KERNEL32.dll34CompareStringW
KERNEL32.dll33CompareStringA
KERNEL32.dll342GetStringTypeW
KERNEL32.dll339GetStringTypeA
KERNEL32.dll448LCMapStringW
KERNEL32.dll447LCMapStringA
KERNEL32.dll484MultiByteToWideChar
KERNEL32.dll636SetStdHandle
KERNEL32.dll450LoadLibraryA
KERNEL32.dll318GetProcAddress
KERNEL32.dll305GetOEMCP
KERNEL32.dll185GetACP
KERNEL32.dll191GetCPInfo
KERNEL32.dll434IsBadCodePtr
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll277GetFileType
KERNEL32.dll338GetStdHandle
KERNEL32.dll621SetHandleCount
KERNEL32.dll264GetEnvironmentStringsW
KERNEL32.dll262GetEnvironmentStrings
KERNEL32.dll722WideCharToMultiByte
KERNEL32.dll179FreeEnvironmentStringsW
KERNEL32.dll178FreeEnvironmentStringsA
KERNEL32.dll685UnhandledExceptionFilter
KERNEL32.dll440IsBadWritePtr
KERNEL32.dll610SetEnvironmentVariableA
KERNEL32.dll699VirtualAlloc
KERNEL32.dll170FlushFileBuffers
KERNEL32.dll87DeleteFileA
KERNEL32.dll559RtlUnwind
KERNEL32.dll523RaiseException
KERNEL32.dll125ExitProcess
KERNEL32.dll670TerminateProcess
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll368GetTimeZoneInformation
KERNEL32.dll349GetSystemTime
KERNEL32.dll283GetLocalTime
KERNEL32.dll415HeapFree
KERNEL32.dll409HeapAlloc
KERNEL32.dll418HeapReAlloc
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll202GetCommandLineA
KERNEL32.dll372GetVersion
KERNEL32.dll419HeapSize
KERNEL32.dll651SetUnhandledExceptionFilter
KERNEL32.dll413HeapDestroy
KERNEL32.dll411HeapCreate
KERNEL32.dll703VirtualFree
USER32.dll532SendMessageA
USER32.dll466OffsetRect
USER32.dll478PostMessageA
USER32.dll446MessageBoxA
USER32.dll414LoadIconA
USER32.dll326GetSystemMetrics
USER32.dll416LoadImageA
USER32.dll309GetParent
USER32.dll255GetDesktopWindow
USER32.dll348GetWindowRect
USER32.dll258GetDlgItem
USER32.dll603SetWindowPos
USER32.dll342GetWindowLongA
USER32.dll79CreateDialogParamA
USER32.dll684wsprintfA
USER32.dll618ShowWindow
USER32.dll298GetMessageA
USER32.dll392IsDialogMessageA
USER32.dll642TranslateMessage
USER32.dll149DispatchMessageA
USER32.dll142DestroyWindow
USER32.dll480PostQuitMessage
ole32.dll83CoUninitialize
ole32.dll45CoInitialize
COMCTL32.dll67InitCommonControlsEx
offsetsizetypecomment
061440EXE11/18/2002 15:53:37#
15c115HTM#
fd9437120494ZIP#
2376782139491JPG#
239a1cd152576EXE10/18/2003 14:00:53#
23bf5cd189BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 37484170 bytes (36 MiB)


--
Type = zip
WARNINGS:
There are data after the end of archive
Offset = 64916
Physical Size = 37120494
Tail Size = 298760

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2012-05-20 19:36:32 .....       161792        83678  1
2012-05-20 19:36:32 .....        96256        48633  2
2012-05-20 19:36:32 .....        60928        31154  3
2013-01-15 09:54:26 .....       992202       285953  4
2013-12-20 15:44:54 .....     49489041     26244713  5
2011-09-26 11:36:50 .....     16403968      6473327  6
2011-05-03 17:29:32 .....        14903         4045  7
2014-02-04 16:36:20 .....      3159040      3008097  8
2012-12-27 14:54:00 .....       910336       877523  9
2014-01-04 06:23:18 .....          458          230  10
2003-10-18 17:58:34 .....        64512        62235  uninstall.exe
------------------- ----- ------------ ------------  ------------------------
2014-02-04 16:36:20           71353436     37119588  11 files

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK