guard.exe - Nethost

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	guard.exe
size	933376 (0xe3e00)
md5	e090572a3eb5ac6f1453926eae14ecec

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
152	20115	7
158	40219	29
170	40219	205
132	30729	1
131	30729	4
171	40219	100
1	0	260
147	30729	25
223	30501	1
175	40219	103
155	40219	1
154	40219	1
151	0	1
157	40219	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x548b06d5
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0xad400
SizeOfInitializedData	0x36600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x834fb
BaseOfCode	0x1000
BaseOfData	0xaf000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xea000
SizeOfHeaders	0x400
CheckSum	0xe4f58
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xad3f2	0xad400	R-X CODE
.rdata	0xaf000	0x224c0	0x22600	R-- IDATA
.data	0xd2000	0x7dec	0x5200	RW- IDATA
.rsrc	0xda000	0x4d0	0x600	R-- IDATA
.reloc	0xdb000	0xe6c6	0xe800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0xd0e90	0x630
IMPORT	0xcfdc4	0xc8
RESOURCE	0xda000	0x4d0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xdb000	0x90fc
DEBUG	0xb01f0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xc1788	0x40
Bound_IAT	0	0
IAT	0xaf000	0x36c
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
RCDATA	#101	33	1252
RCDATA	#103	33	1252
RCDATA	#104	39	1252
VERSION	#1	432	1252
MANIFEST	#1	357	1252

module_name	hint	ord	function_name
RPCRT4.dll	507		UuidCreate
RPCRT4.dll	498		RpcStringFreeW
RPCRT4.dll	516		UuidToStringW
KERNEL32.dll	168		CreateProcessW
KERNEL32.dll	214		DeleteFileW
KERNEL32.dll	1273		WaitForSingleObject
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	190		CreateToolhelp32Snapshot
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	918		Process32FirstW
KERNEL32.dll	920		Process32NextW
KERNEL32.dll	896		OpenProcess
KERNEL32.dll	864		MoveFileExW
KERNEL32.dll	129		CreateDirectoryW
KERNEL32.dll	158		CreateMutexW
KERNEL32.dll	334		FindResourceW
KERNEL32.dll	833		LoadResource
KERNEL32.dll	1252		VerSetConditionMask
KERNEL32.dll	659		GetTickCount
KERNEL32.dll	1201		SizeofResource
KERNEL32.dll	350		FormatMessageW
KERNEL32.dll	1202		Sleep
KERNEL32.dll	676		GetVersionExW
KERNEL32.dll	490		GetFileAttributesW
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	645		GetTempPathW
KERNEL32.dll	1256		VerifyVersionInfoW
KERNEL32.dll	302		FindClose
KERNEL32.dll	852		LockResource
KERNEL32.dll	627		GetSystemInfo
KERNEL32.dll	1018		ReleaseMutex
KERNEL32.dll	1297		WideCharToMultiByte
KERNEL32.dll	293		FileTimeToSystemTime
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	745		InterlockedCompareExchange
KERNEL32.dll	906		OutputDebugStringW
KERNEL32.dll	581		GetProcAddress
KERNEL32.dll	782		IsWow64Process
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	349		FormatMessageA
KERNEL32.dll	136		CreateFileA
KERNEL32.dll	840		LocalFree
KERNEL32.dll	738		InitializeCriticalSection
KERNEL32.dll	825		LeaveCriticalSection
KERNEL32.dll	238		EnterCriticalSection
KERNEL32.dll	209		DeleteCriticalSection
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	588		GetProcessId
KERNEL32.dll	399		GetComputerNameW
KERNEL32.dll	624		GetSystemDirectoryW
KERNEL32.dll	679		GetVolumeInformationW
KERNEL32.dll	1242		UnregisterWait
KERNEL32.dll	1177		SetThreadPriority
KERNEL32.dll	901		OpenThread
KERNEL32.dll	1013		RegisterWaitForSingleObject
KERNEL32.dll	1043		ResumeThread
KERNEL32.dll	181		CreateThread
KERNEL32.dll	1223		TlsGetValue
KERNEL32.dll	1224		TlsSetValue
KERNEL32.dll	1221		TlsAlloc
KERNEL32.dll	1222		TlsFree
KERNEL32.dll	1213		SystemTimeToFileTime
KERNEL32.dll	515		GetLocalTime
KERNEL32.dll	467		GetDriveTypeW
KERNEL32.dll	747		InterlockedDecrement
KERNEL32.dll	117		CopyFileW
KERNEL32.dll	514		GetLastError
KERNEL32.dll	532		GetModuleFileNameW
KERNEL32.dll	391		GetCommandLineW
KERNEL32.dll	719		HeapFree
KERNEL32.dll	723		HeapSetInformation
KERNEL32.dll	611		GetStartupInfoW
KERNEL32.dll	292		FileTimeToLocalFileTime
KERNEL32.dll	466		GetDriveTypeA
KERNEL32.dll	307		FindFirstFileExA
KERNEL32.dll	492		GetFileInformationByHandle
KERNEL32.dll	282		ExitThread
KERNEL32.dll	504		GetFullPathNameA
KERNEL32.dll	447		GetCurrentDirectoryW
KERNEL32.dll	871		MultiByteToWideChar
KERNEL32.dll	284		ExpandEnvironmentStringsA
KERNEL32.dll	1271		WaitForMultipleObjects
KERNEL32.dll	828		LoadLibraryA
KERNEL32.dll	909		PeekNamedPipe
KERNEL32.dll	675		GetVersionExA
KERNEL32.dll	1205		SleepEx
KERNEL32.dll	1110		SetEnvironmentVariableA
KERNEL32.dll	586		GetProcessHeap
KERNEL32.dll	1107		SetEndOfFile
KERNEL32.dll	1159		SetStdHandle
KERNEL32.dll	202		DecodePointer
KERNEL32.dll	234		EncodePointer
KERNEL32.dll	617		GetStringTypeW
KERNEL32.dll	748		InterlockedExchange
KERNEL32.dll	751		InterlockedIncrement
KERNEL32.dll	354		FreeLibrary
KERNEL32.dll	780		IsValidLocale
KERNEL32.dll	269		EnumSystemLocalesA
KERNEL32.dll	516		GetLocaleInfoA
KERNEL32.dll	722		HeapReAlloc
KERNEL32.dll	667		GetUserDefaultLCID
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	664		GetTimeZoneInformation
KERNEL32.dll	343		FlushFileBuffers
KERNEL32.dll	428		GetConsoleMode
KERNEL32.dll	410		GetConsoleCP
KERNEL32.dll	1126		SetFilePointer
KERNEL32.dll	960		ReadFile
KERNEL32.dll	778		IsValidCodePage
KERNEL32.dll	567		GetOEMCP
KERNEL32.dll	360		GetACP
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	739		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1135		SetHandleCount
KERNEL32.dll	474		GetEnvironmentStringsW
KERNEL32.dll	353		FreeEnvironmentStringsW
KERNEL32.dll	1139		SetLastError
KERNEL32.dll	717		HeapCreate
KERNEL32.dll	518		GetLocaleInfoW
KERNEL32.dll	1317		WriteFile
KERNEL32.dll	281		ExitProcess
KERNEL32.dll	536		GetModuleHandleW
KERNEL32.dll	724		HeapSize
KERNEL32.dll	772		IsProcessorFeaturePresent
KERNEL32.dll	768		IsDebuggerPresent
KERNEL32.dll	1189		SetUnhandledExceptionFilter
KERNEL32.dll	1235		UnhandledExceptionFilter
KERNEL32.dll	100		CompareStringW
KERNEL32.dll	370		GetCPInfo
KERNEL32.dll	813		LCMapStringW
KERNEL32.dll	945		RaiseException
KERNEL32.dll	1048		RtlUnwind
KERNEL32.dll	612		GetStdHandle
KERNEL32.dll	499		GetFileType
KERNEL32.dll	1316		WriteConsoleW
KERNEL32.dll	454		GetDateFormatA
KERNEL32.dll	661		GetTimeFormatA
KERNEL32.dll	715		HeapAlloc
ADVAPI32.dll	179		CryptCreateHash
ADVAPI32.dll	203		CryptReleaseContext
ADVAPI32.dll	176		CryptAcquireContextA
ADVAPI32.dll	108		ConvertSidToStringSidW
ADVAPI32.dll	399		LookupAccountNameW
ADVAPI32.dll	694		SetSecurityDescriptorDacl
ADVAPI32.dll	375		InitializeSecurityDescriptor
ADVAPI32.dll	638		RegSetValueExW
ADVAPI32.dll	560		RegCloseKey
ADVAPI32.dll	595		RegFlushKey
ADVAPI32.dll	609		RegOpenKeyExW
ADVAPI32.dll	622		RegQueryValueExW
ADVAPI32.dll	572		RegCreateKeyW
ADVAPI32.dll	357		GetUserNameW
ADVAPI32.dll	182		CryptDestroyHash
ADVAPI32.dll	200		CryptHashData
ADVAPI32.dll	196		CryptGetHashParam
SHELL32.dll	195		SHGetFolderPathW
ole32.dll	108		CoUninitialize
ole32.dll	64		CoInitializeSecurity
ole32.dll	16		CoCreateInstance
ole32.dll	104		CoTaskMemFree
ole32.dll	62		CoInitialize
OLEAUT32.dll		6
OLEAUT32.dll		2
OLEAUT32.dll		9
OLEAUT32.dll		8
SHLWAPI.dll	52		PathAppendW
WS2_32.dll		112
WS2_32.dll		3
WS2_32.dll		7
WS2_32.dll		115
WS2_32.dll		116
WS2_32.dll		2
WS2_32.dll		16
WS2_32.dll		21
WS2_32.dll		6
WS2_32.dll		57
WS2_32.dll	137		getaddrinfo
WS2_32.dll	136		freeaddrinfo
WS2_32.dll		10
WS2_32.dll		13
WS2_32.dll		1
WS2_32.dll		17
WS2_32.dll		20
WS2_32.dll		19
WS2_32.dll		15
WS2_32.dll		9
WS2_32.dll		111
WS2_32.dll		4
WS2_32.dll	54		WSAIoctl
WS2_32.dll		5
WS2_32.dll		151
WS2_32.dll		18
WS2_32.dll		23
WLDAP32.dll		35
WLDAP32.dll		32
WLDAP32.dll		200
WLDAP32.dll		50
WLDAP32.dll		79
WLDAP32.dll		143
WLDAP32.dll		33
WLDAP32.dll		26
WLDAP32.dll		60
WLDAP32.dll		27
WLDAP32.dll		301
WLDAP32.dll		211
WLDAP32.dll		46
WLDAP32.dll		30
WLDAP32.dll		22
WLDAP32.dll		41

ord	entry_va	function_name
1	0x39bb0	curl_easy_cleanup
2	0x39bf0	curl_easy_duphandle
3	0x5b5c0	curl_easy_escape
4	0x39bd0	curl_easy_getinfo
5	0x39980	curl_easy_init
6	0x39e30	curl_easy_pause
7	0x39ba0	curl_easy_perform
8	0x39fe0	curl_easy_recv
9	0x39da0	curl_easy_reset
10	0x3a030	curl_easy_send
11	0x399c0	curl_easy_setopt
12	0x64ad0	curl_easy_strerror
13	0x5b790	curl_easy_unescape
14	0x5b580	curl_escape
15	0x3a9b0	curl_formadd
16	0x3ad20	curl_formfree
17	0x3abd0	curl_formget
18	0x3b710	curl_free
19	0x65f60	curl_getdate
20	0x61ed0	curl_getenv
21	0x39950	curl_global_cleanup
22	0x39840	curl_global_init
23	0x398d0	curl_global_init_mem
24	0x49610	curl_maprintf
25	0x497b0	curl_mfprintf
26	0x49780	curl_mprintf
27	0x49550	curl_msnprintf
28	0x49750	curl_msprintf
29	0x3b890	curl_multi_add_handle
30	0x3db30	curl_multi_assign
31	0x3ce90	curl_multi_cleanup
32	0x3bcc0	curl_multi_fdset
33	0x3cf90	curl_multi_info_read
34	0x3b880	curl_multi_init
35	0x3cd30	curl_multi_perform
36	0x3b9b0	curl_multi_remove_handle
37	0x3d560	curl_multi_setopt
38	0x3d670	curl_multi_socket
39	0x3d6a0	curl_multi_socket_action
40	0x3d6e0	curl_multi_socket_all
41	0x64e90	curl_multi_strerror
42	0x3d7b0	curl_multi_timeout
43	0x3be20	curl_multi_wait
44	0x496a0	curl_mvaprintf
45	0x49830	curl_mvfprintf
46	0x49800	curl_mvprintf
47	0x494f0	curl_mvsnprintf
48	0x497d0	curl_mvsprintf
49	0x545a0	curl_share_cleanup
50	0x543f0	curl_share_init
51	0x54410	curl_share_setopt
52	0x64f10	curl_share_strerror
53	0x46910	curl_slist_append
54	0x46990	curl_slist_free_all
55	0x49850	curl_strequal
56	0x49870	curl_strnequal
57	0x5b5a0	curl_unescape

module_name	nethost.exe
flags	0
timestamp	2014-12-12 15:16:28
version	0.0
ordinal_base	1
nFunctions	57
nNames	57
Names(57)	0xd0f9c
Functions(57)	0xd0eb8
NameOrdinals(57)	0xd1080

StringTable 041904b0

FileDescription	Nethost
FileVersion	1.0.0.83
ProductName	Nethost
ProductVersion	1.0.0.83

VS_FIXEDFILEINFO

FileVersion	1.0.0.83
ProductVersion	1.0.0.83
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	933376	EXE	12/12/2014 15:16:37	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

guard.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 041904b0

VS_FIXEDFILEINFO

guard.exe
-