filename9c8af6274299218dfc4bf0cf6c72149bf740e91a1f1868f13f1c31593bdc28db
size61952 (0xf200)
md5e3cd24026adf4d3caf9d0d330dbedf6a
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Downloader.85933-1 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
007
1272912
480472
1980347
1094
138307293
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x49de0dd0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x5600
SizeOfInitializedData0x9400
SizeOfUninitializedData0
AddressOfEntryPoint0x4a20
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x11000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Nullsoft install system v2.x

Sections

namevavsizeraw sizeflags
.text0x10000x559e0x5600RWX CODE
.rsrc0x70000x8e880x9000R-- IDATA
.reloc0x100000x33c0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x5fc40x64
RESOURCE0x70000x8e88
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
DATA#11377080
DATA#11554430
SYS#108168960
SYS#11261440
module_namehintordfunction_name
KERNEL32.DLLDeviceIoControl
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLFindNextFileA
KERNEL32.DLLGetCurrentDirectoryA
KERNEL32.DLLOutputDebugStringA
KERNEL32.DLLWinExec
KERNEL32.DLLCloseHandle
KERNEL32.DLLGetTempPathA
KERNEL32.DLLDeleteFileA
KERNEL32.DLLCreateThread
KERNEL32.DLLExitProcess
KERNEL32.DLLGetFullPathNameA
KERNEL32.DLLFindResourceA
KERNEL32.DLLFreeResource
KERNEL32.DLLLoadResource
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLProcess32First
KERNEL32.DLLFindClose
KERNEL32.DLLSizeofResource
KERNEL32.DLLGetSystemDirectoryA
KERNEL32.DLLGetEnvironmentVariableA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLProcess32Next
KERNEL32.DLLLockResource
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLCreateToolhelp32Snapshot
KERNEL32.DLLSetFileAttributesA
KERNEL32.DLLGetLastError
KERNEL32.DLLFindFirstFileA
KERNEL32.DLLSetCurrentDirectoryA
KERNEL32.DLLReadFile
KERNEL32.DLLGetExitCodeProcess
KERNEL32.DLLCreateEventA
KERNEL32.DLLSleep
KERNEL32.DLLVirtualFreeEx
KERNEL32.DLLOpenProcess
KERNEL32.DLLGetDriveTypeA
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLlstrlenA
KERNEL32.DLLSetFilePointer
KERNEL32.DLLWriteFile
KERNEL32.DLLCreateFileA
ADVAPI32.dllOpenServiceA
ADVAPI32.dllOpenProcessToken
ADVAPI32.dllDeleteService
ADVAPI32.dllCreateServiceA
ADVAPI32.dllStartServiceA
ADVAPI32.dllLookupPrivilegeValueA
ADVAPI32.dllOpenSCManagerA
ADVAPI32.dllAdjustTokenPrivileges
ADVAPI32.dllCloseServiceHandle
MSVCRT.dllmemset
MSVCRT.dllfree
MSVCRT.dllmalloc
MSVCRT.dllstrstr
MSVCRT.dll_stricmp
MSVCRT.dllmemcpy
USER32.dllLoadCursorA
USER32.dllSystemParametersInfoA
USER32.dllMessageBoxA
USER32.dllCopyIcon
USER32.dllSetSystemCursor
USER32.dllwsprintfA
offsetsizetypecomment
060928EXE04/09/2009 15:01:36#
15c115HTM#
ee001024BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 61952 bytes (61 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK