1.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	1.exe
size	43008 (0xa800)
md5	e29ffbc57adcdf9759d4e69a74dbc450

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5384c1df
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x6600
SizeOfInitializedData	0x4b000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x34d0
BaseOfCode	0x1000
BaseOfData	0x8000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	1.2
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x55000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

InstallShield 2000

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x640e	0x6600	R-X CODE
.rdata	0x8000	0x972	0xa00	R-- IDATA
.data	0x9000	0x495c0	0x2400	RW- IDATA
.rsrc	0x53000	0x268	0x400	R-- IDATA
.reloc	0x54000	0xa7c	0xc00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x82ac	0x78
RESOURCE	0x53000	0x268
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x54000	0x700
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x8000	0x144
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
RCDATA	#1	520	0

module_name	hint	function_name
msvcrt.dll	862	_stricmp
msvcrt.dll	1302	strcpy
msvcrt.dll	1256	memchr
msvcrt.dll	1279	realloc
msvcrt.dll	1190	free
msvcrt.dll	344	_except_handler3
msvcrt.dll	1297	strcat
msvcrt.dll	1359	wcscat
msvcrt.dll	1368	wcslen
msvcrt.dll	825	_snwprintf
msvcrt.dll	1364	wcscpy
msvcrt.dll	1262	memset
msvcrt.dll	1308	strlen
msvcrt.dll	1258	memcpy
KERNEL32.dll	581	LoadLibraryExA
KERNEL32.dll	582	LoadLibraryExW
KERNEL32.dll	102	CreateProcessW
KERNEL32.dll	799	SetPriorityClass
KERNEL32.dll	316	GetCurrentProcessId
KERNEL32.dll	586	LocalAlloc
KERNEL32.dll	590	LocalFree
KERNEL32.dll	523	HeapFree
KERNEL32.dll	517	HeapAlloc
KERNEL32.dll	500	GlobalFree
KERNEL32.dll	493	GlobalAlloc
KERNEL32.dll	49	CloseHandle
KERNEL32.dll	894	WaitForSingleObject
KERNEL32.dll	629	OpenMutexA
KERNEL32.dll	360	GetLastError
KERNEL32.dll	92	CreateMutexA
KERNEL32.dll	580	LoadLibraryA
KERNEL32.dll	374	GetModuleHandleA
KERNEL32.dll	66	CopyFileW
KERNEL32.dll	442	GetSystemDirectoryW
KERNEL32.dll	408	GetProcAddress
KERNEL32.dll	478	GetVersionExA
KERNEL32.dll	565	IsWow64Process
KERNEL32.dll	315	GetCurrentProcess
KERNEL32.dll	911	WriteFile
KERNEL32.dll	82	CreateFileW
KERNEL32.dll	318	GetCurrentThreadId
KERNEL32.dll	460	GetTempPathW
KERNEL32.dll	182	ExitProcess
KERNEL32.dll	691	ReleaseMutex
KERNEL32.dll	75	CreateEventA
KERNEL32.dll	443	GetSystemInfo
KERNEL32.dll	519	HeapCreate
KERNEL32.dll	881	VirtualFree
KERNEL32.dll	834	Sleep
KERNEL32.dll	878	VirtualAlloc
KERNEL32.dll	635	OpenThread
KERNEL32.dll	370	GetLongPathNameW
USER32.dll	719	WaitForInputIdle
USER32.dll	268	GetDC
GDI32.dll	17	BeginPath
GDI32.dll	488	PolyDraw
GDI32.dll	153	EndPath
GDI32.dll	234	FlattenPath
GDI32.dll	140	DeleteDC
GDI32.dll	143	DeleteObject
GDI32.dll	45	CreateCompatibleDC
GDI32.dll	44	CreateCompatibleBitmap
GDI32.dll	77	CreateRoundRectRgn
ntdll.dll	1193	_allshl
ntdll.dll	620	RtlImageNtHeader
ntdll.dll	255	NtQuerySystemInformation
ntdll.dll	736	RtlQueryEnvironmentVariable_U
ntdll.dll	630	RtlInitUnicodeString
ntdll.dll	103	NtClose
ntdll.dll	822	RtlTimeToTimeFields
ntdll.dll	232	NtQueryInformationFile
ntdll.dll	196	NtOpenFile
ntdll.dll	95	NtAllocateVirtualMemory
ntdll.dll	239	NtQueryIntervalProfile
ntdll.dll	581	RtlFreeUnicodeString
ntdll.dll	401	RtlAnsiStringToUnicodeString

show previews

offset	size	type	comment
0	43008	EXE	05/27/2014 16:48:31	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK