PanDownload.exe - 网盘下载器

info
MZ
PE
resources
strings
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	PanDownload.exe
size	2397696 (0x249600)
md5	df86c85dfb0a986fd02dbd6666b1ad86

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x130

Rich Header

lib id	version	times used
241	40116	27
243	40116	198
242	40116	32
261	23013	2
257	24215	4
259	24123	27
203	65501	2
132	30729	1
261	24215	89
261	24123	132
260	24123	39
131	30729	16
147	30729	33
1	0	565
265	24215	107
255	24210	1
151	0	1
258	24215	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x5bc70bdf
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.0
SizeOfCode	0x246000
SizeOfInitializedData	0x4000
SizeOfUninitializedData	0x303000
AddressOfEntryPoint	0x549830
BaseOfCode	0x304000
BaseOfData	0x54a000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x54e000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x303000	0	RWX UDATA
UPX1	0x304000	0x246000	0x245c00	RWX IDATA
.rsrc	0x54a000	0x4000	0x3600	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x54d06c	0x3e4
RESOURCE	0x54a000	0x306c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x54d450	0x1c
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x549a5c	0x18
LOAD_CONFIG	0x549a88	0x5c
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x949a74	0x949a80	0x738110	0x949a80	0	0x300000

show previews

type	name	size
EXE	#139	202240
JS	#129	8370
S	#138	3744
SKIN	#137	222295
WAVE	#130	248768
WAVE	#131	129596
WAVE	#132	39336
WAVE	#133	386844
WAVE	#134	126764
WAVE	#135	299786
WAVE	#136	221464
ICON	#1	9640
ICON	#2	1128
MENU	#109	80
DIALOG	#103	300
STRING	#7	76
ACCELERATORS	#109	16
GROUP_ICON	#107	20
GROUP_ICON	#108	20
VERSION	#1	704
MANIFEST	#1	640

lang

string

2052

73 45 0e c8 d5 5e 8c 77  34 14 51 7e 95 da 0b f8  |sE...^.w4.Q~....|
ff 05 fa 64 28 28 bc 0f  48 46 5d 0b 01 b0 0c 27  |...d((..HF]....'|
cc ff ff ff 0e 54 1c 30  16 24 0b ea 14 93 e6 a1  |.....T.0.$......|
da d0 d9 d7 bc 1f 94 86  5a ec 30 df b8 3e ff ff  |........Z.0..>..|
ff ff e4 94 be 23 47 cb  69 ac e5 a4              |.....#G.i...    |

module_name	ord	function_name
ADVAPI32.dll		CopySid
COMCTL32.dll	17
COMDLG32.dll		GetOpenFileNameW
GDI32.dll		SaveDC
gdiplus.dll		GdipFree
IMM32.dll		ImmGetContext
IPHLPAPI.DLL		GetAdaptersAddresses
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		ExitProcess
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
libcurl.dll		curl_easy_init
lua53.dll		lua_type
ole32.dll		OleRun
OLEAUT32.dll	200
SHELL32.dll		DragFinish
SHLWAPI.dll		PathStripPathW
USER32.dll		GetDC
WININET.dll		InternetSetOptionW
WINMM.dll		PlaySoundW
WS2_32.dll	8

StringTable 080404b0

CompanyName	http://pandownload.com/
FileDescription	网盘下载器
FileVersion	2.0.4
InternalName	PanDownload
LegalCopyright	Copyright (C) 2018
OriginalFilename	PanDownload.exe
ProductName	PanDownload
ProductVersion	2.0.4

VS_FIXEDFILEINFO

FileVersion	2.0.4.0
ProductVersion	2.0.4.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	2397696	EXE	10/17/2018 10:15:59	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] string size(35558) > stringtable size(76). truncated to 74

[!] cannot convert "\x0E\xC8\xD5^\x8Cw4\x14Q~\x95\xDA\v\xF8\xFF\x05"... to UTF-16

[!] refusing to read ICODIRENTRY beyond resource size

PanDownload.exe-