nugget138JS.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	nugget138JS.exe
size	32615 (0x7f67)
md5	f9813714958449dafa2dd30c452aaadb

type	MS-DOS executable PE32 executable (console) Intel 80386, for MS Windows, MZ for MS-DOS
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x40
blocks_in_file	1
num_relocs	0
header_paragraphs	2
min_extra_paragraphs	4
max_extra_paragraphs	0xffff
ss	2
sp	0x40
checksum	0
ip	0xe
cs	0
reloc_table_offset	0x1c
overlay_number	0
reserved0	0x336e695700000000
oem_id	0x2032
oem_info	0x6e6f
reserved2	0xd21796c
reserved3	0xb40e240a
reserved4	0xba09
reserved5	0xb821cd1f
reserved6	0x21cd4c01
lfanew	0x40

DOS stub

00000000: 57 69 6e 33 32 20 6f 6e  6c 79 21 0d 0a 24 0e b4  |Win32 only!..$..|
00000010: 09 ba 00 00 1f cd 21 b8  01 4c cd 21 40 00 00 00  |......!..L.!@...|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x54154866
PointerToSymbolTable	0x7665525b
NumberOfSymbols	0x5d455074
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	2.50
SizeOfCode	0x6c00
SizeOfInitializedData	0x1400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x9000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xb0e8
SizeOfHeaders	0x200
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

FASM v1.5x

Sections

name	va	vsize	raw size	flags
.code	0x1000	0x2000	0x107f	R-X CODE
.text	0x3000	0x6000	0x599d	R-X CODE
.rdata	0x9000	0x1000	0x1b4	R-- IDATA
.data	0xa000	0x10e8	0xf67	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa73c	0x8c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xa90c	0x144
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
MSVCRT.dll	665	memset
MSVCRT.dll	745	wcsncpy
MSVCRT.dll	737	wcscmp
MSVCRT.dll	664	memmove
MSVCRT.dll	742	wcslen
MSVCRT.dll	739	wcscpy
MSVCRT.dll	749	wcsstr
MSVCRT.dll	494	_wcsnicmp
MSVCRT.dll	744	wcsncmp
MSVCRT.dll	489	_wcsdup
MSVCRT.dll	606	free
MSVCRT.dll	490	_wcsicmp
MSVCRT.dll	685	setlocale
MSVCRT.dll	716	swscanf
MSVCRT.dll	723	tolower
MSVCRT.dll	663	memcpy
MSVCRT.dll	735	wcscat
MSVCRT.dll	702	strlen
MSVCRT.dll	657	malloc
KERNEL32.dll	506	GetModuleHandleW
KERNEL32.dll	676	HeapCreate
KERNEL32.dll	677	HeapDestroy
KERNEL32.dll	261	ExitProcess
KERNEL32.dll	674	HeapAlloc
KERNEL32.dll	678	HeapFree
KERNEL32.dll	974	SetCurrentDirectoryA
KERNEL32.dll	218	EnterCriticalSection
KERNEL32.dll	1134	WaitForSingleObject
KERNEL32.dll	756	LeaveCriticalSection
KERNEL32.dll	697	InitializeCriticalSection
KERNEL32.dll	68	CloseHandle
KERNEL32.dll	164	CreateThread
KERNEL32.dll	1067	Sleep
KERNEL32.dll	858	QueryPerformanceFrequency
KERNEL32.dll	618	GetTickCount
KERNEL32.dll	857	QueryPerformanceCounter
KERNEL32.dll	369	GetCommandLineW
KERNEL32.dll	502	GetModuleFileNameW
KERNEL32.dll	681	HeapReAlloc
KERNEL32.dll	607	GetTempPathW
KERNEL32.dll	761	LoadLibraryW
KERNEL32.dll	546	GetProcAddress
KERNEL32.dll	333	FreeLibrary
KERNEL32.dll	994	SetFileAttributesW
KERNEL32.dll	196	DeleteFileW
KERNEL32.dll	425	GetCurrentDirectoryW
KERNEL32.dll	444	GetDriveTypeW
KERNEL32.dll	293	FindFirstFileW
KERNEL32.dll	282	FindClose
KERNEL32.dll	463	GetFileAttributesW
KERNEL32.dll	795	MoveFileW
KERNEL32.dll	1175	WriteFile
KERNEL32.dll	128	CreateFileW
KERNEL32.dll	999	SetFilePointer
KERNEL32.dll	878	ReadFile
KERNEL32.dll	799	MultiByteToWideChar
KERNEL32.dll	15	AllocConsole
KERNEL32.dll	574	GetStdHandle
KERNEL32.dll	412	GetConsoleScreenBufferInfo
KERNEL32.dll	943	SetConsoleCtrlHandler
KERNEL32.dll	970	SetConsoleTitleW
KERNEL32.dll	322	FlushFileBuffers
KERNEL32.dll	968	SetConsoleTextAttribute
KERNEL32.dll	959	SetConsoleMode
KERNEL32.dll	876	ReadConsoleW
KERNEL32.dll	487	GetLastError
KERNEL32.dll	1174	WriteConsoleW
KERNEL32.dll	191	DeleteCriticalSection
KERNEL32.dll	758	LoadLibraryA
KERNEL32.dll	1156	WideCharToMultiByte
URLMON.DLL		URLDownloadToFileW
URLMON.DLL		UrlMkSetSessionOption
WININET.DLL		DeleteUrlCacheEntryW
USER32.DLL		CharLowerW
WINMM.DLL		timeBeginPeriod

show previews

offset	size	type	comment
0	32615	EXE	09/14/2014 07:48:54	#
15c1	15	HTM		#

Scanning the drive for archives:
1 file, 32615 bytes (32 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK