filenameSilverlight.exe
size7007744 (0x6aee00)
md5ec08dd1ba39b7ee42c77236e13e157af
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
93217915
10106
95219020
9421791
9021791

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x40db6e48
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0xd0f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x7800
SizeOfInitializedData0xc00
SizeOfUninitializedData0
AddressOfEntryPoint0x5892
BaseOfCode0x2000
BaseOfData0xa000
ImageBase0x1000000
SectionAlignment0x2000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion5.2
SubsystemVersion4.0
Reserved10
SizeOfImage0x1e000
SizeOfHeaders0x400
CheckSum0x6b2335
Subsystem2
DllCharacteristics0x8400
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS SFX CAB Archive file

Sections

namevavsizeraw sizeflags
.text0x20000x77600x7800R-X CODE
.data0xa0000x110d40x200RW- IDATA
.rsrc0x1c0000x9b00x6a7000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x8d200xa0
RESOURCE0x1c0000x9b0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x21d00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x20000x1c4
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#1002821252
DIALOG#1072241252
STRING#17301252
VERSION#19601252
idlangstring
11033File is corrupt
21033Extraction Complete
31033Extraction Failed
41033Extracting File:
51033Choose Directory For Extracted Files
61033To Directory:
71033Setup was unable to shutdown system. Please shutdown your system manually.
81033Unable to find a volume for file extraction. Please verify that you have proper permissions.
91033Unable to find a volume with enough disk space for file extraction.
module_namehintordfunction_name
KERNEL32.dll331GetDriveTypeA
KERNEL32.dll524HeapFree
KERNEL32.dll234FormatMessageA
KERNEL32.dll583LeaveCriticalSection
KERNEL32.dll124DeleteFileA
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll849TerminateProcess
KERNEL32.dll899WaitForMultipleObjects
KERNEL32.dll74CreateEventW
KERNEL32.dll779SetEvent
KERNEL32.dll841Sleep
KERNEL32.dll776SetEnvironmentVariableA
KERNEL32.dll336GetEnvironmentVariableA
KERNEL32.dll905WideCharToMultiByte
KERNEL32.dll518HeapAlloc
KERNEL32.dll797SetLastError
KERNEL32.dll919WriteFile
KERNEL32.dll612MoveFileA
KERNEL32.dll175ExitProcess
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll229FlushFileBuffers
KERNEL32.dll479GetVersionExA
KERNEL32.dll901WaitForSingleObject
KERNEL32.dll627OpenEventA
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll264GetCommandLineA
KERNEL32.dll77CreateFileA
KERNEL32.dll197FindClose
KERNEL32.dll211FindNextFileA
KERNEL32.dll201FindFirstFileA
KERNEL32.dll61CopyFileA
KERNEL32.dll782SetFileAttributesA
KERNEL32.dll846SystemTimeToFileTime
KERNEL32.dll446GetSystemTime
KERNEL32.dll325GetDiskFreeSpaceA
KERNEL32.dll661QueryDosDeviceA
KERNEL32.dll312GetCurrentDirectoryA
KERNEL32.dll773SetEndOfFile
KERNEL32.dll788SetFileTime
KERNEL32.dll592LocalFileTimeToFileTime
KERNEL32.dll136DosDateTimeToFileTime
KERNEL32.dll338GetExitCodeProcess
KERNEL32.dll96CreateProcessA
KERNEL32.dll347GetFileSize
KERNEL32.dll105CreateThread
KERNEL32.dll73CreateEventA
KERNEL32.dll411GetProcessHeap
KERNEL32.dll538InitializeCriticalSectionAndSpinCount
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll665QueryPerformanceCounter
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll315GetCurrentProcessId
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll829SetUnhandledExceptionFilter
KERNEL32.dll46CloseHandle
KERNEL32.dll131DeviceIoControl
KERNEL32.dll441GetSystemDirectoryA
KERNEL32.dll584LoadLibraryA
KERNEL32.dll408GetProcAddress
KERNEL32.dll239FreeLibrary
KERNEL32.dll778SetErrorMode
KERNEL32.dll469GetTickCount
KERNEL32.dll69CreateDirectoryA
KERNEL32.dll361GetLastError
KERNEL32.dll698RemoveDirectoryA
KERNEL32.dll613MoveFileExA
KERNEL32.dll784SetFilePointer
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll683ReadFile
msvcrt.dll776strchr
msvcrt.dll517_strnicmp
msvcrt.dll513_stricmp
msvcrt.dll788strrchr
msvcrt.dll515_strlwr
msvcrt.dll786strncpy
msvcrt.dll790strstr
msvcrt.dll491_snprintf
msvcrt.dll771sprintf
ADVAPI32.dll29AllocateAndInitializeSid
ADVAPI32.dll281GetTokenInformation
ADVAPI32.dll246GetLengthSid
ADVAPI32.dll308InitiateSystemShutdownA
ADVAPI32.dll160CryptReleaseContext
ADVAPI32.dll150CryptGenRandom
ADVAPI32.dll133CryptAcquireContextA
ADVAPI32.dll559SetSecurityDescriptorDacl
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll305InitializeAcl
ADVAPI32.dll306InitializeSecurityDescriptor
ADVAPI32.dll426OpenProcessToken
USER32.dll657ShowWindow
USER32.dll565SendDlgItemMessageA
USER32.dll570SendMessageA
USER32.dll158DialogBoxParamA
USER32.dll458LoadStringA
USER32.dll198EndDialog
USER32.dll613SetParent
USER32.dll478MessageBoxA
ntdll.dll374NtShutdownSystem
ntdll.dll121NtAdjustPrivilegesToken
ntdll.dll136NtClose
ntdll.dll243NtOpenProcessToken
COMCTL32.dll17
SHELL32.dll121SHBrowseForFolderA
SHELL32.dll188SHGetPathFromIDListA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSelf-Extracting Cabinet
FileVersion5.1.50918.0
InternalNameSFXCAB.EXE
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameSFXCAB.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.5.0031.0

VS_FIXEDFILEINFO

FileVersion5.1.50918.0
ProductVersion5.5.31.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d07002160BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 7007744 bytes (6844 KiB)


--
Type = PE
Physical Size = 7007744
CPU = x86
Characteristics = Executable 32-bit NoRelocs NoLineNums NoLocalSyms RemovableRun NetRun
Created = 2004-06-25 00:14:00
Headers Size = 1024
Checksum = 7021365
Name = SFXCAB.EXE
Image Size = 122880
Section Alignment = 8192
File Alignment = 512
Code Size = 30720
Initialized Data Size = 3072
Uninitialized Data Size = 0
Linker Version = 7.10
OS Version = 5.2
Image Version = 5.2
Subsystem Version = 4.0
Subsystem = Windows GUI
DLL Characteristics = NoSEH TerminalServerAware
Stack Reserve = 262144
Stack Commit = 8192
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 16777216
Comment = FileVersion: 5.1.50918.0
ProductVersion: 5.5.31.0
ProductVersion: 5.5.0031.0
CompanyName: Microsoft Corporation
FileDescription: Self-Extracting Cabinet
InternalName: SFXCAB.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: SFXCAB.EXE
ProductName: Microsoft® Windows® Operating System
----
Path = .rsrc_1
Size = 6973008
Packed Size = 6973008
Virtual Size = 6973008
Offset = 34736
--
Path = .rsrc_1
Type = Cab
Offset = 80
Physical Size = 6917243
Tail Size = 55685
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 5616

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2018-10-23 21:06:14 ....A      6721476               silverlight.7z
2015-04-15 23:29:40 ....A       396968               install.res.dll
2018-10-23 21:05:40 ....A       230080               install.exe
2018-10-23 20:13:26 ....A        53248               silverlight.msi
------------------- ----- ------------ ------------  ------------------------
2018-10-23 21:06:14            7401772      7007744  4 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK