parentworksxc_220.exe
filenameworksxc_220.unpacked.exe
size477259 (0x7484b)
md5e26205c83d77d1c5e938e16dfb5fec0b
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x489b1e0e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.0
SizeOfCode0x3800
SizeOfInitializedData0x18e00
SizeOfUninitializedData0
AddressOfEntryPoint0x3274
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1f000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Nullsoft PiMP Stub

Sections

namevavsizeraw sizeflags
.text0x10000x365a0x3800R-X CODE
.rdata0x50000xd830xe00R-- IDATA
.data0x60000x16a7c0x600RW- IDATA
.idata0x1d0000x68c0x800RW- IDATA
.rsrc0x1e0000xa900xc00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1d0000x8c
RESOURCE0x1e0000xa90
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
DIALOG#1024940
DIALOG#1271720
STRING#15280
STRING#23420
GROUP_ICON#103200
idlangstring
11033No package found
21033Couldn't execute command
31033Unexpected end of package
41033Unknown header
51033Unsupported zip method
61033Can't write file
71033Out of memeory
81033Corrupted package
91033RL SOFTWARE SELF EXTRACTOR (www.rl-software.com)
101033&Install
111033&Exit
121033Loading..
131033Uncompressing
141033Starting
151033B&rowse
161033Create
171033Select the destination folder
181033Destination path
191033You have entered an unvalid path. Please browse again.
201033Configuration file
211033Uninstalling "%s"
221033Finished.
module_namehintordfunction_name
KERNEL32.DLLGetTempFileNameA
KERNEL32.DLLGetTickCount
KERNEL32.DLLGetTempPathA
KERNEL32.DLLGetCurrentDirectoryA
KERNEL32.DLLSetCurrentDirectoryA
KERNEL32.DLLRemoveDirectoryA
KERNEL32.DLLDeleteFileA
KERNEL32.DLLGetLastError
KERNEL32.DLLCreateDirectoryA
KERNEL32.DLLDosDateTimeToFileTime
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLLocalFileTimeToFileTime
KERNEL32.DLLCreateFileA
KERNEL32.DLLCloseHandle
KERNEL32.DLLReadFile
KERNEL32.DLLWriteFile
KERNEL32.DLLGlobalAlloc
KERNEL32.DLLGlobalFree
KERNEL32.DLLlstrcmpiA
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLFreeLibrary
KERNEL32.DLLExitProcess
KERNEL32.DLLSetFileTime
KERNEL32.DLLGetFileSize
GDI32.dllDeleteObject
ole32.dllCoUninitialize
ole32.dllCoInitialize
SHELL32.dllSHChangeNotify
SHELL32.dllShellExecuteA
SHELL32.dllShellExecuteExA
USER32.dllSetWindowLongA
USER32.dllGetWindowLongA
USER32.dllSetClassLongA
USER32.dllGetClassLongA
USER32.dllEnableWindow
USER32.dllSetFocus
USER32.dllDestroyWindow
USER32.dllMessageBoxA
USER32.dllRedrawWindow
USER32.dllwsprintfA
USER32.dllPeekMessageA
USER32.dllLoadStringA
USER32.dllShowWindow
USER32.dllMsgWaitForMultipleObjects
USER32.dllGetForegroundWindow
USER32.dllwvsprintfA
USER32.dllLoadIconA
USER32.dllCreateDialogParamA
USER32.dllPostQuitMessage
USER32.dllSetDlgItemTextA
USER32.dllCharUpperA
USER32.dllSendMessageA
USER32.dllSendDlgItemMessageA
USER32.dllGetMessageA
USER32.dllIsDialogMessageA
USER32.dllGetDlgItem
offsetsizetypecomment
025600EXE08/07/2008 16:08:46#
15c115HTM#
6404451655ZIP#
Scanning the drive for archives:
1 file, 477259 bytes (467 KiB)


--
Type = zip
Offset = 25604
Physical Size = 451655

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2004-11-27 13:40:15 ....A           92           88  __config.sfx
2008-08-28 07:46:51 ....A       205312       199212  setup.exe
2008-08-08 09:05:23 ....A          526          330  __config.rtf
2005-12-07 09:13:09 ....A         6656         4934  Uninstall.exe
2008-08-28 10:44:32 ....A        50688        18595  wksxcnv.xla
2008-08-20 09:40:35 ....A         8840         3525  wksxinfo.rtf
2001-04-03 09:40:22 ....A        19456         6419  RemoveWksBars.xla
2001-06-21 20:52:46 ....A           50           50  RL-Software Website.url
2008-08-18 07:56:26 ....A       135680       123851  WKSXCNV.dll
2008-08-28 11:17:51 ....A        63851        56490  info.chm
2008-08-28 11:16:23 ....A        44164        36629  rlorder.chm
------------------- ----- ------------ ------------  ------------------------
2008-08-28 11:17:51             535315       450123  11 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK