filename4be99fdcc05ad6d74160505b5fd1f62def038569fd1bb4ec09f6c2caba1bd074
size241664 (0x3b000)
md5e823221609b37e99fbbce5b493a02f68
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1272912
10816894
14729921
9340359
10117
11816811
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5148fb52
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0xa000
SizeOfInitializedData0x72000
SizeOfUninitializedData0
AddressOfEntryPoint0x3ddd
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x7d000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x97c50xa000R-X CODE
.rdata0xb0000x11720x2000R-- IDATA
.data0xd0000x429a00x1000RW- IDATA
.rsrc0x500000x2cb500x2d000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xb7b80x64
RESOURCE0x500000x2cb50
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xb0000x1b4
Delay_IAT00
CLR_Header00
typenamesizecp
HTML_DATA#10174170
HTML_DATA#10467810
HTML_DATA#105798310
HTML_DATA#106407680
HTML_DATA#109480030
module_namehintordfunction_name
KERNEL32.dll131DeleteFileA
KERNEL32.dll622MoveFileA
KERNEL32.dll795SetFilePointer
KERNEL32.dll932WriteFile
KERNEL32.dll693ReadFile
KERNEL32.dll796SetFilePointerEx
KERNEL32.dll793SetFileAttributesA
KERNEL32.dll479GetTickCount
KERNEL32.dll210FindFirstFileA
KERNEL32.dll67CopyFileA
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll613LockResource
KERNEL32.dll853SizeofResource
KERNEL32.dll416GetProcAddress
KERNEL32.dll467GetTempFileNameA
KERNEL32.dll469GetTempPathA
KERNEL32.dll220FindNextFileA
KERNEL32.dll206FindClose
KERNEL32.dll376GetLogicalDrives
KERNEL32.dll346GetExitCodeProcess
KERNEL32.dll863TerminateThread
KERNEL32.dll854Sleep
KERNEL32.dll83CreateFileA
KERNEL32.dll111CreateThread
KERNEL32.dll910WaitForMultipleObjects
KERNEL32.dll96CreateMutexA
KERNEL32.dll369GetLastError
KERNEL32.dll52CloseHandle
KERNEL32.dll102CreateProcessA
KERNEL32.dll499GetWindowsDirectoryA
KERNEL32.dll59CompareStringW
KERNEL32.dll58CompareStringA
KERNEL32.dll784SetEndOfFile
KERNEL32.dll482GetTimeZoneInformation
KERNEL32.dll456GetSystemTime
KERNEL32.dll371GetLocalTime
KERNEL32.dll727RtlUnwind
KERNEL32.dll185ExitProcess
KERNEL32.dll862TerminateProcess
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll272GetCommandLineA
KERNEL32.dll488GetVersion
KERNEL32.dll534HeapFree
KERNEL32.dll528HeapAlloc
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll260GetCPInfo
KERNEL32.dll253GetACP
KERNEL32.dll403GetOEMCP
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll580LCMapStringA
KERNEL32.dll581LCMapStringW
KERNEL32.dll326GetCurrentThreadId
KERNEL32.dll870TlsSetValue
KERNEL32.dll867TlsAlloc
KERNEL32.dll808SetLastError
KERNEL32.dll869TlsGetValue
KERNEL32.dll878UnhandledExceptionFilter
KERNEL32.dll246FreeEnvironmentStringsA
KERNEL32.dll247FreeEnvironmentStringsW
KERNEL32.dll341GetEnvironmentStrings
KERNEL32.dll343GetEnvironmentStringsW
KERNEL32.dll804SetHandleCount
KERNEL32.dll441GetStdHandle
KERNEL32.dll358GetFileType
KERNEL32.dll532HeapDestroy
KERNEL32.dll530HeapCreate
KERNEL32.dll899VirtualFree
KERNEL32.dll897VirtualAlloc
KERNEL32.dll538HeapReAlloc
KERNEL32.dll566IsBadWritePtr
KERNEL32.dll552InterlockedDecrement
KERNEL32.dll556InterlockedIncrement
KERNEL32.dll442GetStringTypeA
KERNEL32.dll445GetStringTypeW
KERNEL32.dll842SetUnhandledExceptionFilter
KERNEL32.dll563IsBadReadPtr
KERNEL32.dll560IsBadCodePtr
KERNEL32.dll823SetStdHandle
KERNEL32.dll238FlushFileBuffers
KERNEL32.dll594LoadLibraryA
KERNEL32.dll787SetEnvironmentVariableA
ADVAPI32.dll100CreateServiceA
ADVAPI32.dll52ChangeServiceConfig2A
ADVAPI32.dll524RegisterServiceCtrlHandlerA
ADVAPI32.dll580SetServiceStatus
ADVAPI32.dll585StartServiceA
ADVAPI32.dll491RegOpenKeyA
ADVAPI32.dll516RegSetValueExA
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll429OpenSCManagerA
ADVAPI32.dll431OpenServiceA
ADVAPI32.dll62CloseServiceHandle
ADVAPI32.dll66ControlService
ADVAPI32.dll586StartServiceCtrlDispatcherA
SHELL32.dll196SHGetSpecialFolderPathA
SHLWAPI.dll47PathFindExtensionA
SHLWAPI.dll35PathCombineA
SHLWAPI.dll29PathAppendA
SHLWAPI.dll272StrStrIA
offsetsizetypecomment
0241664EXE03/19/2013 23:57:06#
15c115HTM#
fe306781JPG#
2efc848003GIF(800 x 600)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK