filenamescrenc.exe
size65136 (0xfe70)
md5d83151c7aea26124f7c8f06dbf7b513c
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xb8

Rich Header

lib idversiontimes used
617351
00200

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x369f2d21
PointerToSymbolTable0
NumberOfSymbols0x4ad
SizeOfOptionalHeader0xe0
Characteristics0x307
Magic0x10b
LinkerVersion5.12
SizeOfCode0x8e00
SizeOfInitializedData0x7e00
SizeOfUninitializedData0
AddressOfEntryPoint0x2e90
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0x14111
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v5.0

Sections

namevavsizeraw sizeflags
.text0x10000x8cd60x8e00R-X CODE
.rdata0xa0000x14840x1600R-- IDATA
.data0xc0000x50240x3600RW- IDATA
.rsrc0x120000x14500x1600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xad040x64
RESOURCE0x120000x1450
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0xa1600x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xa0000x158
Delay_IAT00
CLR_Header00
typenamesizecp
STRING#113280
STRING#237260
idlangstring
11033Usage: screnc [/?] [/s] [/f] [/xl] [/l ScriptLanguage] [/e DefaultExtension] <source> <destination>
21033Unrecognized flag: %1
31033Source and destination are the same ('%1'). Use -f switch to override
41033Cannot open file '%1' for reading
51033Cannot open file '%1' for writing
61033Bad format for file '%1'
71033Out of memory
81033Scripting encoder object ("Scripting.Encoder") not found
91033Scripting encoder object ("Scripting.Encoder") failed on %1
101033OleInitialize failed
111033OleUnInitialize failed
121033Internal error
131033Input file (%1) does not specify a valid extension, use -e option
141033File %1 has a special attribute (read-only, hidden, sysytem), it will not be encoded
151033Missing <source>
161033Missing <destination>
171033Encode embedded script. /? - Help /s - Silent: display no messages /f - Force: allow file(s) overwrite (source == destination) /xl - Exclude Language: does not add the language directive in asp files /l ScriptLanguage - Script Default Language: specify the default script language to be used when encoding /e DefaultExtension - Default Extension: override actual file extension. Control the encoder to be loaded. <source> The file to encode. It can have wildcard characters. <destination> The destination file. When <source> contains wildcard characters, <destination> is the directory where to place the encoded files; files will keep the same name. When <source> and <destination> are the same /f must be used. Examples: screnc test.html encode.html encode test.html into encode.html screnc /f test.html encode and override test.html screnc /e html test.txt test1.txt treat text.txt as an html file, encode it into text1.txt screnc test.asp c:\myDir\test.asp encode test.asp into c:\myDir\test.asp screnc *.asp c:\myDir encode all the asp files in the current directory and place them in c:\myDir screnc -s -f *.sct encode all the scriptlet files in the current directory and override them. No message is displayed screnc -e asp *.* c:\myDir encode *all* the files in the current directory as asp files. Place these files in c:\myDir screnc -e asp -xl *.inc c:\myDir encode all the files with .inc extension as asp files. Does not add the @LANGUAGE directive at the top of the file screnc -l vbscript test.html encode.html encode test.html into encode.html. When a script tag with no language attribute is found, VBScript is assumed to be the default language. If -l is not specified, JScript is assumed for html and VBScript is the default for asp
181033Incomplete flag: %1
module_namehintordfunction_name
KERNEL32.dll298GetStdHandle
KERNEL32.dll667lstrcpyA
KERNEL32.dll427MultiByteToWideChar
KERNEL32.dll24CloseHandle
KERNEL32.dll595UnmapViewOfFile
KERNEL32.dll420MapViewOfFile
KERNEL32.dll50CreateFileMappingA
KERNEL32.dll237GetFileSize
KERNEL32.dll49CreateFileA
KERNEL32.dll622WideCharToMultiByte
KERNEL32.dll144FlushViewOfFile
KERNEL32.dll254GetModuleHandleA
KERNEL32.dll592UnhandledExceptionFilter
KERNEL32.dll209GetCurrentDirectoryA
KERNEL32.dll398LCMapStringW
KERNEL32.dll397LCMapStringA
KERNEL32.dll369HeapReAlloc
KERNEL32.dll529SetEnvironmentVariableA
KERNEL32.dll31CompareStringW
KERNEL32.dll366HeapFree
KERNEL32.dll247GetLocaleInfoW
KERNEL32.dll246GetLocaleInfoA
KERNEL32.dll302GetStringTypeW
KERNEL32.dll107ExitProcess
KERNEL32.dll582TerminateProcess
KERNEL32.dll211GetCurrentProcess
KERNEL32.dll244GetLastError
KERNEL32.dll240GetFullPathNameA
KERNEL32.dll130FindFirstFileA
KERNEL32.dll135FindNextFileA
KERNEL32.dll126FindClose
KERNEL32.dll120FileTimeToSystemTime
KERNEL32.dll119FileTimeToLocalFileTime
KERNEL32.dll485RtlUnwind
KERNEL32.dll170GetCommandLineA
KERNEL32.dll332GetVersion
KERNEL32.dll163GetCPInfo
KERNEL32.dll157GetACP
KERNEL32.dll265GetOEMCP
KERNEL32.dll377InitializeCriticalSection
KERNEL32.dll76DeleteCriticalSection
KERNEL32.dll88EnterCriticalSection
KERNEL32.dll399LeaveCriticalSection
KERNEL32.dll539SetHandleCount
KERNEL32.dll673lstrlenA
KERNEL32.dll239GetFileType
KERNEL32.dll296GetStartupInfoA
KERNEL32.dll360HeapAlloc
KERNEL32.dll30CompareStringA
KERNEL32.dll223GetDriveTypeA
KERNEL32.dll299GetStringTypeA
KERNEL32.dll606VirtualFree
KERNEL32.dll252GetModuleFileNameA
KERNEL32.dll150FreeEnvironmentStringsA
KERNEL32.dll151FreeEnvironmentStringsW
KERNEL32.dll225GetEnvironmentStrings
KERNEL32.dll227GetEnvironmentStringsW
KERNEL32.dll214GetCurrentThreadId
KERNEL32.dll587TlsSetValue
KERNEL32.dll584TlsAlloc
KERNEL32.dll542SetLastError
KERNEL32.dll586TlsGetValue
KERNEL32.dll364HeapDestroy
KERNEL32.dll362HeapCreate
KERNEL32.dll278GetProcAddress
KERNEL32.dll635WriteFile
KERNEL32.dll379InterlockedDecrement
KERNEL32.dll382InterlockedIncrement
KERNEL32.dll603VirtualAlloc
KERNEL32.dll142FlushFileBuffers
KERNEL32.dll328GetTimeZoneInformation
KERNEL32.dll400LoadLibraryA
KERNEL32.dll537SetFilePointer
KERNEL32.dll553SetStdHandle
USER32.dll387LoadStringA
ole32.dll183OleInitialize
ole32.dll5CLSIDFromProgID
ole32.dll12CoCreateInstance
ole32.dll206OleUninitialize
OLEAUT32.dll7
OLEAUT32.dll6
OLEAUT32.dll4
offsetsizetypecomment
062464EXE01/15/1999 11:57:21#
15c115HTM#
f4002672BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK