filenamex4terg5443sdf.exe
size228864 (0x37e00)
md5e184d14a95344e4e3b009cf4219179d3
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
158303191
1473072911
10104
0018
1703031920
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x53980d06
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion10.0
SizeOfCode0x14200
SizeOfInitializedData0x146000
SizeOfUninitializedData0
AddressOfEntryPoint0x84b0
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x15d000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x140d10x14200R-X CODE
.rdata0x160000xd6da0xd800R-- IDATA
.data0x240000x12e8480xc200RW- IDATA
.rsrc0x1530000x9de80x9e00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x22d940x78
RESOURCE0x1530000x9de8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x160000x1b4
Delay_IAT00
CLR_Header00
typenamesizecp
EXESOW#1763920
TVRZ9K170Q#2163920
U24JP#2063920
UDCEWOR294#1863920
V091G3H6#1663920
YTH8601J#1963920
DIALOG#33060
DIALOG#53040
VERSION#17000
module_namehintordfunction_name
GDI32.dll639SetBkMode
GDI32.dll678SetTextColor
GDI32.dll638SetBkColor
USER32.dll809WinHelpW
USER32.dll73CloseClipboard
USER32.dll648SetCursor
USER32.dll710SetWindowPos
USER32.dll503LoadMenuW
USER32.dll359GetProcessDefaultLayout
USER32.dll294GetDlgCtrlID
USER32.dll62CheckDlgButton
USER32.dll380GetSysColorBrush
USER32.dll621ScreenToClient
USER32.dll550OpenClipboard
USER32.dll636SendMessageW
USER32.dll218EndDialog
USER32.dll216EnableWindow
USER32.dll278GetClipboardData
USER32.dll446InvalidateRect
USER32.dll156DefWindowProcW
USER32.dll110CreateWindowExW
USER32.dll172DialogBoxParamW
USER32.dll30CallWindowProcW
USER32.dll379GetSysColor
USER32.dll214EnableMenuItem
USER32.dll175DispatchMessageW
USER32.dll656SetDlgItemTextW
USER32.dll276GetClientRect
USER32.dll681SetProcessDefaultLayout
USER32.dll759TrackPopupMenuEx
USER32.dll406GetWindowLongW
USER32.dll99CreateDialogParamW
USER32.dll708SetWindowLongW
USER32.dll291GetDesktopWindow
USER32.dll521MapWindowPoints
USER32.dll533MessageBoxW
USER32.dll457IsChild
USER32.dll668SetMenu
USER32.dll331GetMenu
USER32.dll412GetWindowRect
USER32.dll378GetSubMenu
USER32.dll658SetFocus
USER32.dll49CharNextW
USER32.dll748SystemParametersInfoW
USER32.dll349GetMessageW
USER32.dll47CharNextA
USER32.dll461IsDialogMessageW
USER32.dll549OffsetRect
USER32.dll64CheckMenuRadioItem
USER32.dll715SetWindowTextW
USER32.dll506LoadStringW
USER32.dll764TranslateMessage
USER32.dll785UpdateWindow
USER32.dll208DrawTextW
USER32.dll458IsClipboardFormatAvailable
USER32.dll166DestroyWindow
USER32.dll491LoadCursorW
USER32.dll295GetDlgItem
USER32.dll493LoadIconW
USER32.dll65CheckRadioButton
USER32.dll485LoadAcceleratorsW
USER32.dll63CheckMenuItem
USER32.dll589RegisterClassExW
USER32.dll762TranslateAcceleratorW
USER32.dll67ChildWindowFromPoint
USER32.dll425HideCaret
USER32.dll164DestroyMenu
USER32.dll419GetWindowTextW
USER32.dll654SetDlgItemInt
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll641RegUnLoadKeyW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll621RegQueryValueExA
KERNEL32.dll709GlobalUnlock
KERNEL32.dll702GlobalLock
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll698GlobalFree
KERNEL32.dll181CreateThread
KERNEL32.dll691GlobalAlloc
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll391GetCommandLineW
KERNEL32.dll82CloseHandle
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll828LoadLibraryA
KERNEL32.dll706GlobalSize
KERNEL32.dll1355lstrcpynW
KERNEL32.dll1343lstrcatW
KERNEL32.dll1352lstrcpyW
KERNEL32.dll1358lstrlenW
KERNEL32.dll1113SetEvent
KERNEL32.dll133CreateEventW
KERNEL32.dll601GetProfileIntW
KERNEL32.dll1202Sleep
KERNEL32.dll1039ResetEvent
KERNEL32.dll581GetProcAddress
KERNEL32.dll692GlobalCompact
KERNEL32.dll1330WriteProfileStringW
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll768IsDebuggerPresent
SHELL32.dll282ShellAboutW

StringTable 040904E4

CompanyNameiPass Inc
FileDescriptionuvbirIw
FileVersion3.8.2.0
InternalNameD6133iR1Z53U.exe
LegalCopyrightCopyright 1970 - 2006
OriginalFilenameD6133iR1Z53U.exe
ProductVersion3.8.2.0
ProductNamemx6y6B8

VS_FIXEDFILEINFO

FileVersion3.8.2.0
ProductVersion3.8.2.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0228864EXE06/11/2014 08:02:14#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK