filenameexecutable.2564.exe
size776192 (0xbd800)
md5ef007800d46ada108cfcc9abf1ebe940
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
149307299
10404
1473072933
1313072927
13230729130
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7979d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x52e00
SizeOfInitializedData0x6a600
SizeOfUninitializedData0
AddressOfEntryPoint0x12d6c
BaseOfCode0x1000
BaseOfData0x52000
ImageBase0xdf0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xc0000
SizeOfHeaders0x400
CheckSum0xcbd30
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x52ca10x52e00R-X CODE
.data0x540000x40c00x4200RW- IDATA
.rsrc0x590000x627980x62800R-- IDATA
.reloc0xbc0000x3b3c0x3c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x51afc0x154
RESOURCE0x590000x62798
EXCEPTION00
SECURITY00
BASERELOC0xbc0000x3b3c
DEBUG0x53c440x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x304300x40
Bound_IAT0x2700x154
IAT0x10000x630
Delay_IAT0x51a780x40
CLR_Header00
typenamesizecp
IMAGE#15746570
IMAGE#16540690
IMAGE#17042150
IMAGE#17546560
IMAGE#18049180
IMAGE#20429950
IMAGE#20830400
IMAGE#21232560
IMAGE#21633800
IMAGE#21737490
IMAGE#21837740
IMAGE#300044270
IMAGE#301541260
IMAGE#304547060
IMAGE#305149550
IMAGE#306041890
IMAGE#310230970
IMAGE#310330230
IMAGE#310429650
IMAGE#310529210
IMAGE#310634960
IMAGE#310736530
IMAGE#310838270
IMAGE#320154540
IMAGE#320243720
IMAGE#320331050
IMAGE#320445610
IMAGE#320531210
IMAGE#320648770
IMAGE#320733960
IMAGE#320852010
IMAGE#320937920
IMAGE#321039690
IMAGE#321140030
IMAGE#321448560
IMAGE#321555920
IMAGE#321645290
IMAGE#321755120
IMAGE#321845950
IMAGE#322032320
IMAGE#322130560
IMAGE#322230120
IMAGE#322338710
IMAGE#322441170
IMAGE#322542460
IMAGE#322829570
IMAGE#330168550
IMAGE#330245230
IMAGE#330331280
IMAGE#330447180
IMAGE#330532220
IMAGE#330651590
IMAGE#330735780
IMAGE#330855600
IMAGE#330938300
IMAGE#331041640
IMAGE#331142040
IMAGE#331451780
IMAGE#331562090
IMAGE#331649320
IMAGE#331765950
IMAGE#331849810
IMAGE#332033490
IMAGE#332131680
IMAGE#332230660
IMAGE#332342430
IMAGE#332445860
IMAGE#332547660
IMAGE#332829930
MUI#12880
WEVT_TEMPLATE#147500
BITMAP#51209220420
ICON#126640
ICON#216400
ICON#37440
ICON#44880
ICON#52960
ICON#656720
ICON#737520
ICON#822160
ICON#917360
ICON#1013840
ICON#11275690
ICON#12169360
ICON#1396400
ICON#1442640
ICON#1524400
ICON#1611280
GROUP_ICON#2342300
VERSION#19000
MANIFEST#111670
module_namehintordfunction_name
SHELL32.dll225SHGetSpecialFolderPathW
SHELL32.dll195SHGetFolderPathW
SHELL32.dll282ShellAboutW
SHELL32.dll165
SHELL32.dll289ShellExecuteExW
SHLWAPI.dll225
gdiplus.dll188GdipDrawLineI
gdiplus.dll155GdipDrawArcI
gdiplus.dll229GdipFillRectangleI
gdiplus.dll50GdipCloneBrush
gdiplus.dll54GdipCloneImage
gdiplus.dll77GdipCreateBitmapFromHBITMAP
gdiplus.dll91GdipCreateFromHDC
gdiplus.dll184GdipDrawImageRectI
gdiplus.dll536GdipSetInterpolationMode
gdiplus.dll548GdipSetPageUnit
gdiplus.dll130GdipCreateSolidFill
gdiplus.dll80GdipCreateBitmapFromScan0
gdiplus.dll152GdipDisposeImage
gdiplus.dll144GdipDeleteGraphics
gdiplus.dll148GdipDeletePen
gdiplus.dll122GdipCreatePen1
gdiplus.dll138GdipDeleteBrush
gdiplus.dll33GdipAlloc
gdiplus.dll237GdipFree
gdiplus.dll629GdiplusStartup
gdiplus.dll628GdiplusShutdown
gdiplus.dll289GdipGetImageGraphicsContext
gdiplus.dll585GdipSetSmoothingMode
gdiplus.dll49GdipCloneBitmapAreaI
gdiplus.dll95GdipCreateHBITMAPFromBitmap
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll598RegGetValueW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll507OpenServiceW
ADVAPI32.dll548QueryServiceConfigW
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll272EventWrite
ADVAPI32.dll271EventUnregister
ADVAPI32.dll270EventRegister
OLEAUT32.dll2
OLEAUT32.dll7
OLEAUT32.dll8
OLEAUT32.dll150
OLEAUT32.dll6
OLEAUT32.dll9
UxTheme.dll63IsThemeActive
ole32.dll62CoInitialize
ole32.dll108CoUninitialize
ole32.dll16CoCreateInstance
COMCTL32.dll84ImageList_Destroy
COMCTL32.dll77ImageList_Add
COMCTL32.dll83ImageList_Create
COMCTL32.dll413
COMCTL32.dll9CreatePropertySheetPageW
COMCTL32.dll133PropertySheetW
COMCTL32.dll380
COMCTL32.dll410
COMCTL32.dll392
ntdll.dll1373WinSqmAddToStreamEx
ntdll.dll1388WinSqmIncrementDWORD
ntdll.dll1372WinSqmAddToStream
ntdll.dll409NtQueryLicenseValue
ntdll.dll924RtlInitUnicodeString
KERNEL32.dll1353lstrlenA
KERNEL32.dll1293WideCharToMultiByte
KERNEL32.dll608GetStartupInfoA
KERNEL32.dll901OutputDebugStringA
KERNEL32.dll1184SetUnhandledExceptionFilter
KERNEL32.dll530GetModuleHandleA
KERNEL32.dll931QueryPerformanceCounter
KERNEL32.dll657GetTickCount
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll673GetVersionExA
KERNEL32.dll208DeleteCriticalSection
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll824LeaveCriticalSection
KERNEL32.dll237EnterCriticalSection
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll1201SizeofResource
KERNEL32.dll851LockResource
KERNEL32.dll833LoadResource
KERNEL32.dll334FindResourceW
KERNEL32.dll333FindResourceExW
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll630GetSystemTime
KERNEL32.dll1112SetEvent
KERNEL32.dll82CloseHandle
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll181CreateThread
KERNEL32.dll133CreateEventW
KERNEL32.dll1038ResetEvent
KERNEL32.dll1346lstrcmpW
KERNEL32.dll691GlobalAlloc
KERNEL32.dll709GlobalUnlock
KERNEL32.dll702GlobalLock
KERNEL32.dll706GlobalSize
KERNEL32.dll869MulDiv
KERNEL32.dll695GlobalFindAtomW
KERNEL32.dll512GetLastError
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll870MultiByteToWideChar
KERNEL32.dll513GetLocalTime
KERNEL32.dll516GetLocaleInfoW
KERNEL32.dll456GetDateFormatW
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1323WritePrivateProfileStringW
KERNEL32.dll576GetPrivateProfileStringW
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll515GetLocaleInfoEx
KERNEL32.dll579GetProcAddress
KERNEL32.dll831LoadLibraryW
KERNEL32.dll354FreeLibrary
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll719HeapFree
KERNEL32.dll715HeapAlloc
KERNEL32.dll584GetProcessHeap
KERNEL32.dll675GetVersionExW
KERNEL32.dll748InterlockedExchange
KERNEL32.dll355FreeLibraryAndExitThread
KERNEL32.dll488GetFileAttributesW
KERNEL32.dll1303Wow64RevertWow64FsRedirection
KERNEL32.dll1299Wow64DisableWow64FsRedirection
KERNEL32.dll782IsWow64Process
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll840LocalFree
KERNEL32.dll843LocalReAlloc
KERNEL32.dll836LocalAlloc
KERNEL32.dll604GetProfileStringW
KERNEL32.dll1358lstrlenW
KERNEL32.dll100CompareStringW
KERNEL32.dll20ApplicationRecoveryInProgress
KERNEL32.dll1202Sleep
KERNEL32.dll19ApplicationRecoveryFinished
KERNEL32.dll1006RegisterApplicationRecoveryCallback
KERNEL32.dll1007RegisterApplicationRestart
KERNEL32.dll96CompareFileTime
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll642GetTempFileNameW
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll214DeleteFileW
KERNEL32.dll143CreateFileW
KERNEL32.dll631GetSystemTimeAsFileTime
KERNEL32.dll1212TerminateProcess
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll717HeapDestroy
KERNEL32.dll721HeapReAlloc
KERNEL32.dll723HeapSize
KERNEL32.dll941RaiseException
USER32.dll379GetSysColor
USER32.dll644SetClassLongW
USER32.dll272GetClassLongW
USER32.dll201DrawMenuBar
USER32.dll674SetMenuItemInfoW
USER32.dll10AppendMenuW
USER32.dll615RemoveMenu
USER32.dll378GetSubMenu
USER32.dll406GetWindowLongW
USER32.dll441InsertMenuItemW
USER32.dll708SetWindowLongW
USER32.dll476IsWindowEnabled
USER32.dll566PostMessageW
USER32.dll47CharNextA
USER32.dll646SetClipboardData
USER32.dll213EmptyClipboard
USER32.dll73CloseClipboard
USER32.dll278GetClipboardData
USER32.dll550OpenClipboard
USER32.dll342GetMenuState
USER32.dll458IsClipboardFormatAvailable
USER32.dll156DefWindowProcW
USER32.dll446InvalidateRect
USER32.dll567PostQuitMessage
USER32.dll300GetFocus
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll346GetMessageExtraInfo
USER32.dll762TranslateAcceleratorW
USER32.dll349GetMessageW
USER32.dll659SetForegroundWindow
USER32.dll709SetWindowPlacement
USER32.dll589RegisterClassExW
USER32.dll208DrawTextW
USER32.dll613ReleaseDC
USER32.dll289GetDC
USER32.dll382GetSystemMetrics
USER32.dll223EnumChildWindows
USER32.dll685SetPropW
USER32.dll331GetMenu
USER32.dll65CheckRadioButton
USER32.dll785UpdateWindow
USER32.dll627SendDlgItemMessageW
USER32.dll462IsDlgButtonChecked
USER32.dll539MoveWindow
USER32.dll296GetDlgItemInt
USER32.dll654SetDlgItemInt
USER32.dll63CheckMenuItem
USER32.dll354GetNextDlgTabItem
USER32.dll549OffsetRect
USER32.dll351GetMonitorInfoW
USER32.dll538MonitorFromWindow
USER32.dll85CopyRect
USER32.dll445IntersectRect
USER32.dll230EnumDisplayMonitors
USER32.dll243EqualRect
USER32.dll537MonitorFromRect
USER32.dll275GetClassWord
USER32.dll225EnumDesktopWindows
USER32.dll359GetProcessDefaultLayout
USER32.dll99CreateDialogParamW
USER32.dll758TrackPopupMenu
USER32.dll107CreatePopupMenu
USER32.dll260GetAncestor
USER32.dll250FindWindowW
USER32.dll218EndDialog
USER32.dll214EnableMenuItem
USER32.dll166DestroyWindow
USER32.dll521MapWindowPoints
USER32.dll274GetClassNameW
USER32.dll295GetDlgItem
USER32.dll412GetWindowRect
USER32.dll710SetWindowPos
USER32.dll636SendMessageW
USER32.dll491LoadCursorW
USER32.dll648SetCursor
USER32.dll317GetKeyState
USER32.dll461IsDialogMessageW
USER32.dll485LoadAcceleratorsW
USER32.dll418GetWindowTextLengthW
USER32.dll419GetWindowTextW
USER32.dll216EnableWindow
USER32.dll658SetFocus
USER32.dll506LoadStringW
USER32.dll715SetWindowTextW
USER32.dll356GetParent
USER32.dll276GetClientRect
USER32.dll735ShowWindow
USER32.dll411GetWindowPlacement
USER32.dll495LoadImageW
USER32.dll773UnregisterClassA
USER32.dll246FillRect
USER32.dll64CheckMenuRadioItem
USER32.dll110CreateWindowExW
USER32.dll525MessageBeep
USER32.dll748SystemParametersInfoW
USER32.dll172DialogBoxParamW
RPCRT4.dll507UuidCreate
RPCRT4.dll516UuidToStringW
RPCRT4.dll498RpcStringFreeW
WINMM.dll148timeGetTime
VERSION.dll2GetFileVersionInfoExW
VERSION.dll4GetFileVersionInfoSizeExW
VERSION.dll14VerQueryValueW
GDI32.dll301EqualRgn
GDI32.dll53CreateDIBSection
GDI32.dll230DeleteObject
GDI32.dll227DeleteDC
GDI32.dll545GetTextExtentPointW
GDI32.dll64CreateFontIndirectW
GDI32.dll48CreateCompatibleDC
GDI32.dll459GetDeviceCaps
GDI32.dll524GetRgnBox
GDI32.dll84CreateSolidBrush
GDI32.dll550GetTextMetricsW
GDI32.dll542GetTextExtentPoint32W
GDI32.dll509GetObjectW
GDI32.dll566LineTo
GDI32.dll570MoveToEx
GDI32.dll306ExtCreatePen
GDI32.dll47CreateCompatibleBitmap
GDI32.dll79CreateRectRgn
GDI32.dll80CreateRectRgnIndirect
GDI32.dll672SetRectRgn
GDI32.dll34CombineRgn
GDI32.dll631SelectObject
GDI32.dll74CreatePatternBrush
GDI32.dll678SetTextColor
GDI32.dll639SetBkMode
GDI32.dll525GetStockObject
GDI32.dll638SetBkColor
msvcrt.dll1371wcsncmp
msvcrt.dll1017_wcsnicmp
msvcrt.dll1229iswdigit
msvcrt.dll1013_wcslwr_s
msvcrt.dll1225iswalpha
msvcrt.dll5public: __thiscall bad_cast::bad_cast(class bad_cast const &)

??0bad_cast@@QAE@ABV0@@Z

msvcrt.dll14public: virtual __thiscall bad_cast::~bad_cast(void)

??1bad_cast@@UAE@XZ

msvcrt.dll1241localeconv
msvcrt.dll1256memchr
msvcrt.dll1304strcspn
msvcrt.dll1292sprintf_s
msvcrt.dll884_strtoi64
msvcrt.dll887_strtoui64
msvcrt.dll1002_wcsdup
msvcrt.dll468_i64tow_s
msvcrt.dll1130_wtoi64
msvcrt.dll1376wcsrchr
msvcrt.dll1387wcstoul
msvcrt.dll1214isalpha
msvcrt.dll1332time
msvcrt.dll1165difftime
msvcrt.dll1260memmove
msvcrt.dll274_callnewh
msvcrt.dll206__pctype_func
msvcrt.dll125___lc_codepage_func
msvcrt.dll127___lc_handle_func
msvcrt.dll564_itow_s
msvcrt.dll128___mb_cur_max_func
msvcrt.dll1286setlocale
msvcrt.dll137__crtGetStringTypeW
msvcrt.dll139__crtLCMapStringW
msvcrt.dll176__mb_cur_max
msvcrt.dll1337tolower
msvcrt.dll1222isspace
msvcrt.dll1142abort
msvcrt.dll1213isalnum
msvcrt.dll145__getmainargs
msvcrt.dll276_cexit
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll500_ismbblead
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll747_onexit
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll219__uncaught_exception
msvcrt.dll345_except_handler4_common
msvcrt.dll295_controlfp
msvcrt.dll1129_wtoi
msvcrt.dll561_itoa
msvcrt.dll1157calloc
msvcrt.dll1361wcschr
msvcrt.dll1007_wcsicmp
msvcrt.dll974_vsnwprintf
msvcrt.dll1258memcpy
msvcrt.dll1360wcscat_s
msvcrt.dll1384wcstol
msvcrt.dll1365wcscpy_s
msvcrt.dll1167exit
msvcrt.dll1254mbstowcs_s
msvcrt.dll1338toupper
msvcrt.dll1237isxdigit
msvcrt.dll1216isdigit
msvcrt.dll405_ftol2_sse
msvcrt.dll1262memset
msvcrt.dll404_ftol2
msvcrt.dll1246malloc
msvcrt.dll764_purecall
msvcrt.dll1190free
msvcrt.dll12public: __thiscall exception::exception(void)

??0exception@@QAE@XZ

msvcrt.dll99_CxxThrowException
msvcrt.dll11public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dll16public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dll57public: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dll9public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

msvcrt.dll1261memmove_s
msvcrt.dll1259memcpy_s
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll342_errno
msvcrt.dll1023_wcsrev

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Calculator
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNameCALC
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCALC.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0776192EXE11/20/2010 09:40:45#
15c115HTM#
736c84657PNG(750 x 400)#
779184069PNG(190 x 50)#
7abc82995PNG(190 x 50)#
7b7803105PNG(238 x 63)#
7c3a83128PNG(285 x 75)#
7cfe04215PNG(385 x 50)#
804a03040PNG(385 x 50)#
829504656PNG(190 x 151)#
862b83256PNG(190 x 151)#
88ab84918PNG(385 x 151)#
8c8003380PNG(385 x 151)#
950504427PNG(136 x 27)#
988d84955PNG(292 x 27)#
9ca584189PNG(136 x 27)#
a00284706PNG(136 x 59)#
a41e04126PNG(136 x 27)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x270