filename26C88C61E5557B1FB240C489C5FEC47FCF12BA28B58F0EB773A1023332351249.bin
size44039 (0xac07)
md5e25bb57a295e71ae5b6f393deb12e0e4
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
203506284
199411181
205506282
2065062819
207506285
123507274
147210222
10103
1853071611
2115072712
201507271
204507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x52ab2a46
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x7a00
SizeOfInitializedData0x42400
SizeOfUninitializedData0
AddressOfEntryPoint0x7ec9
BaseOfCode0x1000
BaseOfData0x9000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x4e000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 2005

Sections

namevavsizeraw sizeflags
.text0x10000x79470x7a00R-X CODE
.rdata0x90000x14400x1600R-- IDATA
.data0xb0000x3f6d40x200RW- IDATA
.rsrc0x4b0000x1e00x200R-- IDATA
.reloc0x4c0000x13c80x1400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x99e40xdc
RESOURCE0x4b0000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x4c0000xc9c
DEBUG0x92300x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x96100x40
Bound_IAT00
IAT0x90000x1c4
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll1408Thread32Next
KERNEL32.dll991Module32First
KERNEL32.dll1065Process32Next
KERNEL32.dll266CreateToolhelp32Snapshot
KERNEL32.dll993Module32Next
KERNEL32.dll142CloseHandle
KERNEL32.dll257CreateThread
KERNEL32.dll316EncodePointer
KERNEL32.dll279DecodePointer
KERNEL32.dll1375Sleep
KERNEL32.dll1407Thread32First
KERNEL32.dll1032OpenProcess
KERNEL32.dll1063Process32First
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll899IsDebuggerPresent
KERNEL32.dll785GetTickCount64
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll1115ReadProcessMemory
USER32.dll593MoveWindow
USER32.dll541LoadCursorA
USER32.dll263FindWindowA
USER32.dll181DispatchMessageA
USER32.dll796ShowWindow
USER32.dll728SetLayeredWindowAttributes
USER32.dll692SendMessageA
USER32.dll883keybd_event
USER32.dll160DefWindowProcA
USER32.dll617PeekMessageA
USER32.dll112CreateWindowExA
USER32.dll339GetKeyState
USER32.dll279GetAsyncKeyState
USER32.dll458GetWindowRect
USER32.dll645RegisterClassExA
USER32.dll622PostQuitMessage
USER32.dll545LoadIconA
USER32.dll827TranslateMessage
GDI32.dll86CreateSolidBrush
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll428LookupPrivilegeValueA
ADVAPI32.dll31AdjustTokenPrivileges
d3dx9_40.dll64D3DXCreateFontA
d3dx9_40.dll71D3DXCreateLine
d3d9.dll10Direct3DCreate9Ex
MSVCR110.dll376__CxxFrameHandler3
MSVCR110.dll861_libm_sse2_cos_precise
MSVCR110.dll865_libm_sse2_pow_precise
MSVCR110.dll866_libm_sse2_sin_precise
MSVCR110.dll867_libm_sse2_sqrt_precise
MSVCR110.dll1560memcpy
MSVCR110.dll333_CIatan2
MSVCR110.dll349_CxxThrowException
MSVCR110.dll559_controlfp_s
MSVCR110.dll758_invoke_watson
MSVCR110.dll1468exit
MSVCR110.dll1562memmove
MSVCR110.dll1057_purecall
MSVCR110.dll115void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR110.dll113void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR110.dll1592sprintf
MSVCR110.dll1464clock
MSVCR110.dll1608strftime
MSVCR110.dll874_localtime64
MSVCR110.dll1210_time64
MSVCR110.dll876_lock
MSVCR110.dll1238_unlock
MSVCR110.dll539_calloc_crt
MSVCR110.dll412__dllonexit
MSVCR110.dll1042_onexit
MSVCR110.dll112public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR110.dll315void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR110.dll1162_stricmp
MSVCR110.dll367_XcptFilter
MSVCR110.dll404__crtGetShowWindowMode
MSVCR110.dll517_amsg_exit
MSVCR110.dll420__getmainargs
MSVCR110.dll480__set_app_type
MSVCR110.dll617_exit
MSVCR110.dll540_cexit
MSVCR110.dll784_ismbblead
MSVCR110.dll556_configthreadlocale
MSVCR110.dll482__setusermatherr
MSVCR110.dll751_initterm_e
MSVCR110.dll750_initterm
MSVCR110.dll508_acmdln
MSVCR110.dll644_fmode
MSVCR110.dll555_commode
MSVCR110.dll571_crt_debugger_hook
MSVCR110.dll410__crtUnhandledException
MSVCR110.dll409__crtTerminateProcess
MSVCR110.dll608_except_handler4_common
MSVCR110.dll408__crtSetUnhandledExceptionFilter
MSVCR110.dll1564memset
dwmapi.dll6DwmExtendFrameIntoClientArea
MSVCP110.dll702char const * __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPBDH@Z

MSVCP110.dll730void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP110.dll731void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

MSVCP110.dll727void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP110.dll723char const * __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAPBDH@Z

vstdlib.dll19RandomFloat
vstdlib.dll23RandomSeed
offsetsizetypecomment
044032EXE12/13/2013 15:39:50#
15c115HTM#
ac007BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 44039 bytes (44 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK