RTTessV1.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	RTTessV1.exe
size	4248064 (0x40d200)
md5	f87e88685d5d2a38a5b164f62a0264a3

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4bd99f98
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x2bd000
SizeOfInitializedData	0x28000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2e63b0
BaseOfCode	0x1000
BaseOfData	0x2be000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.2
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x436000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual Basic v5.0/v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2bcc10	0x2bd000	RWX IDATA
.data	0x2be000	0x26f58	0	RW- IDATA
.rsrc	0x2e5000	0x6bc	0x200	RW- IDATA
	0x2e6000	0	0x14fc00	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2e6000	0x388
RESOURCE	0x2e5000	0x6bc
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#30001	744	1200
GROUP_ICON	#1	20	1200
VERSION	#1	720	1200

module_name	ord	function_name
kernel32.dll		GetModuleHandleA
kernel32.dll		GetProcAddress
MSVBVM60.DLL		_CIatan
WSOCK32.dll	116
COMCTL32.dll		_TrackMouseEvent
RPCRT4.dll		UuidCreate
USER32.dll		CopyAcceleratorTableA
GDI32.dll		GetViewportExtEx
WINSPOOL.DRV		DocumentPropertiesA
comdlg32.dll		GetFileTitleA
ADVAPI32.dll		ControlService
SHELL32.dll		ShellExecuteA
ole32.dll		OleUninitialize
OLEAUT32.dll	2
SHLWAPI.dll		PathFindExtensionA
OLEACC.dll		LresultFromObject
oledlg.dll	8

VS_FIXEDFILEINFO

dwSignature	0x10000fe
FileVersion	0.2304.256.512
ProductVersion	0.2304.0.0
StrucVersion	0x1000200
FileFlagsMask	0
FileFlags	0x400
FileOS	0x100
FileType	0
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
97712	502	BMP	(48 x 16)	#
97914	190	BMP	(48 x 16)	#
9b96d	1679	GIF	(189 x 53)	#
abeeb	6769	JPG		#
cb7a1	22518	BMP	(2800 x 16)	#
d0f9b	3318	BMP	(400 x 16)	#
d1c95	3318	BMP	(400 x 16)	#
d298f	3318	BMP	(400 x 16)	#
d3689	3318	BMP	(400 x 16)	#
d4383	3318	BMP	(400 x 16)	#
d507d	3318	BMP	(400 x 16)	#
d5d77	3318	BMP	(400 x 16)	#
d6b45	5694	BMP	(2800 x 16)	#
d8187	894	BMP	(400 x 16)	#
d8509	894	BMP	(400 x 16)	#
d888b	894	BMP	(400 x 16)	#
d8c0d	894	BMP	(400 x 16)	#
d8f8f	894	BMP	(400 x 16)	#
d9311	894	BMP	(400 x 16)	#
d9693	894	BMP	(400 x 16)	#
d9a11	3356655	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VS_VERSIONINFO child type "\x00r\x00F\x00i"