filenamed643ad46eb2dfd2815c1bbff4d8bcb62.mal
size638976 (0x9c000)
md5d643ad46eb2dfd2815c1bbff4d8bcb62
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
Rich Header present, but decode failed.
Checkhexdump&log

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4f771a66
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x8a000
SizeOfInitializedData0x11000
SizeOfUninitializedData0
AddressOfEntryPoint0x5a550
BaseOfCode0x1000
BaseOfData0x8b000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x9c000
SizeOfHeaders0x1000
CheckSum0xa12b9
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++

Sections

namevavsizeraw sizeflags
.text0x10000x897e00x8a000R-X CODE
.rdata0x8b0000x21760x3000R-- IDATA
.data0x8e0000x2a900x3000RW- IDATA
.rsrc0x910000xa8180xb000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x8cb240x78
RESOURCE0x910000xa818
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x8b0000x140
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP#130394640
DIALOG#1278520
STRING#40787080
STRING#407911620
MANIFEST#14750
idlangstring
652320Failed to store GIF on clipboard
652330Image exceeds Logical Screen size
652340No global or local color table defined
652350Invalid pixel coordinates
652360Unsupported PixelFormat
652370Invalid image dimensions
652380Image has no DIB
652390Invalid stream operation
652400Color not in color table
652410Color table is empty
652420Image is empty
652430Invalid reduction method
652440GIF Image
652450Loading...
652460Saving...
652470Converting...
652480Invalid JPG signature
652490Invalid number of colors specified in Screen Descriptor
652500Invalid number of colors specified in Image Descriptor
652510Unknown extension type
652520Invalid extension introducer
652530Failed to allocate memory for JPG DIB
652540Decoder bit buffer under-run
652550Circular decoder table entry
652560Invalid Image trailer
652570Internal error: Extension Instance does not match Extension Label
652580Unsupported Application Extension block size
652590Unknown JPG block type
652600Object type not supported for operation
652610Invalid JPG data
652620Image height too small for contained frames
652630Image width too small for contained frames
module_namehintordfunction_name
USER32.dll289GetDC
USER32.dll613ReleaseDC
USER32.dll345GetMessageA
USER32.dll764TranslateMessage
USER32.dll174DispatchMessageA
USER32.dll492LoadIconA
USER32.dll488LoadCursorA
USER32.dll588RegisterClassExA
USER32.dll14BeginPaint
USER32.dll276GetClientRect
USER32.dll220EndPaint
USER32.dll567PostQuitMessage
USER32.dll155DefWindowProcA
USER32.dll565PostMessageA
USER32.dll166DestroyWindow
USER32.dll171DialogBoxParamA
USER32.dll218EndDialog
USER32.dll486LoadBitmapA
USER32.dll631SendMessageA
USER32.dll109CreateWindowExA
USER32.dll735ShowWindow
USER32.dll785UpdateWindow
USER32.dll205DrawTextA
KERNEL32.dll136CreateFileA
KERNEL32.dll960ReadFile
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll514GetLastError
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll499GetFileType
KERNEL32.dll567GetOEMCP
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll370GetCPInfo
KERNEL32.dll360GetACP
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll1222TlsFree
KERNEL32.dll1221TlsAlloc
KERNEL32.dll281ExitProcess
KERNEL32.dll1139SetLastError
KERNEL32.dll778IsValidCodePage
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll1135SetHandleCount
KERNEL32.dll1317WriteFile
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1223TlsGetValue
KERNEL32.dll612GetStdHandle
GDI32.dll459GetDeviceCaps
GDI32.dll19BitBlt
GDI32.dll624SaveDC
GDI32.dll617RestoreDC
GDI32.dll638SetBkColor
GDI32.dll507GetObjectA
COMCTL32.dll17
MSVCRT.dll658memcpy
MSVCRT.dll601free
MSVCRT.dll652malloc
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll207_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll580exit
MSVCRT.dll103__p__acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll267_initterm
MSVCRT.dll129__setusermatherr
MSVCRT.dll154_adjust_fdiv
MSVCRT.dll105__p__commode
MSVCRT.dll110__p__fmode
MSVCRT.dll127__set_app_type
MSVCRT.dll198_except_handler3
MSVCRT.dll179_controlfp
MSVCRT.dll660memset
offsetsizetypecomment
0638976EXE03/31/2012 14:53:26#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] PEdump::RichHdr: dexored size(92) must be a multiple of 8