filenamecmdl32.exe
size25600 (0x6400)
md5fc8c41cfa2e3408ee217effa3b854798
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1540351
10145
93403521
95403515
9440351
9640355
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x48025774
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x5200
SizeOfInitializedData0xe00
SizeOfUninitializedData0
AddressOfEntryPoint0x508d
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0x1414b
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x514a0x5200R-X CODE
.data0x70000xac0x200RW- IDATA
.rsrc0x80000xa080xc00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x53cc0xdc
RESOURCE0x80000xa08
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x16f00x40
Bound_IAT0x2580xe4
IAT0x10000x260
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
DIALOG#1012820
STRING#641960
GROUP_ICON#102200
VERSION#19280
idlangstring
10101033Download - %u%% Complete
10111033Phone Book Update
10151033No update required
10161033Full update
10171033Delta update
module_namehintordfunction_name
msvcrt.dll214_controlfp
msvcrt.dll237_except_handler3
msvcrt.dll152__set_app_type
msvcrt.dll133__p__fmode
msvcrt.dll128__p__commode
msvcrt.dll182_adjust_fdiv
msvcrt.dll154__setusermatherr
msvcrt.dll315_initterm
msvcrt.dll109__getmainargs
msvcrt.dll168_acmdln
msvcrt.dll656exit
msvcrt.dll200_cexit
msvcrt.dll78_XcptFilter
msvcrt.dll246_exit
msvcrt.dll197_c_exit
ADVAPI32.dll458RegCloseKey
ADVAPI32.dll484RegOpenKeyExA
ADVAPI32.dll494RegQueryValueExA
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll71CreateDirectoryA
KERNEL32.dll92CreateMutexA
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll859UnhandledExceptionFilter
KERNEL32.dll822SetUnhandledExceptionFilter
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll430GetStartupInfoA
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll49CloseHandle
KERNEL32.dll768SetEndOfFile
KERNEL32.dll777SetFilePointer
KERNEL32.dll79CreateFileA
KERNEL32.dll790SetLastError
KERNEL32.dll945lstrcpyA
KERNEL32.dll360GetLastError
KERNEL32.dll678ReadFile
KERNEL32.dll911WriteFile
KERNEL32.dll457GetTempFileNameA
KERNEL32.dll459GetTempPathA
KERNEL32.dll951lstrlenA
KERNEL32.dll775SetFileAttributesA
KERNEL32.dll942lstrcmpiA
KERNEL32.dll781SetFileTime
KERNEL32.dll588LocalFileTimeToFileTime
KERNEL32.dll141DosDateTimeToFileTime
KERNEL32.dll936lstrcatA
KERNEL32.dll347GetFileSize
KERNEL32.dll948lstrcpynA
KERNEL32.dll693RemoveDirectoryA
KERNEL32.dll204FindClose
KERNEL32.dll217FindNextFileA
KERNEL32.dll129DeleteFileA
KERNEL32.dll939lstrcmpA
KERNEL32.dll208FindFirstFileA
KERNEL32.dll916WritePrivateProfileStringA
KERNEL32.dll63CopyFileA
KERNEL32.dll230FlushFileBuffers
KERNEL32.dll834Sleep
KERNEL32.dll894WaitForSingleObject
KERNEL32.dll772SetEvent
KERNEL32.dll468GetTickCount
KERNEL32.dll108CreateThread
KERNEL32.dll75CreateEventA
KERNEL32.dll404GetPrivateProfileStringA
KERNEL32.dll60ConvertDefaultLocale
KERNEL32.dll478GetVersionExA
KERNEL32.dll443GetSystemInfo
KERNEL32.dll398GetPrivateProfileIntA
KERNEL32.dll762SetCurrentDirectoryA
KERNEL32.dll265GetCommandLineA
KERNEL32.dll240FreeLibrary
KERNEL32.dll408GetProcAddress
KERNEL32.dll581LoadLibraryExA
KERNEL32.dll182ExitProcess
KERNEL32.dll374GetModuleHandleA
KERNEL32.dll400GetPrivateProfileSectionA
KERNEL32.dll691ReleaseMutex
KERNEL32.dll842TerminateProcess
USER32.dll275GetDlgItemTextA
USER32.dll42CharNextA
USER32.dll158DialogBoxParamA
USER32.dll551RegisterWindowMessageA
USER32.dll247GetClassInfoExA
USER32.dll535RegisterClassExA
USER32.dll366GetWindowLongA
USER32.dll194EnableMenuItem
USER32.dll728wsprintfA
USER32.dll511PostMessageA
USER32.dll646SetWindowTextA
USER32.dll566SendDlgItemMessageA
USER32.dll658ShowWindow
USER32.dll434KillTimer
USER32.dll598SetFocus
USER32.dll198EndDialog
USER32.dll640SetWindowLongA
USER32.dll595SetDlgItemTextA
USER32.dll489MoveWindow
USER32.dll349GetSystemMetrics
USER32.dll665SystemParametersInfoA
USER32.dll372GetWindowRect
cmpbk32.dll22PhoneBookUnload
cmpbk32.dll20PhoneBookMergeChanges
cmpbk32.dll18PhoneBookLoad
cmpbk32.dll5PhoneBookFreeFilter
cmpbk32.dll21PhoneBookParseInfoA
cmutil.dll100CmFmtMsgA
cmutil.dll57public: void __cdecl CmLogFile::Log(enum _CMLOG_ITEM, ...)

?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ

cmutil.dll135CmStrrchrA
cmutil.dll112CmLoadSmallIconA
cmutil.dll107CmLoadIconA
cmutil.dll84public: long __thiscall CmLogFile::Stop(void)

?Stop@CmLogFile@@QAEJXZ

cmutil.dll83public: long __thiscall CmLogFile::Start(int)

?Start@CmLogFile@@QAEJH@Z

cmutil.dll69public: long __thiscall CmLogFile::SetParams(int, unsigned long, char const *)

?SetParams@CmLogFile@@QAEJHKPBD@Z

cmutil.dll50public: long __thiscall CmLogFile::Init(struct HINSTANCE__ *, int, char const *)

?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z

cmutil.dll142GetOSVersion
cmutil.dll4public: __thiscall CmLogFile::CmLogFile(void)

??0CmLogFile@@QAE@XZ

cmutil.dll27public: long __thiscall CmLogFile::DeInit(void)

?DeInit@CmLogFile@@QAEJXZ

cmutil.dll94CmBuildFullPathFromRelativeA
cmutil.dll129CmStrchrA
cmutil.dll120CmRealloc
cmutil.dll123CmStrCpyAllocA
cmutil.dll116CmMalloc
cmutil.dll102CmFree
COMCTL32.dll17
Cabinet.dll23
Cabinet.dll21
Cabinet.dll20
Cabinet.dll22
RASAPI32.dll27RasEnumConnectionsA
WININET.dll167InternetSetOptionA
WININET.dll146InternetOpenA
WININET.dll111InternetConnectA
WININET.dll42FtpFindFirstFileA
WININET.dll123InternetFindNextFileA
WININET.dll105InternetCloseHandle
WININET.dll50FtpOpenFileA
WININET.dll154InternetReadFile
WININET.dll87HttpQueryInfoA
WININET.dll89HttpSendRequestA
WININET.dll85HttpOpenRequestA
WININET.dll147InternetOpenUrlA
WININET.dll113InternetCrackUrlA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft Connection Manager Auto-Download
FileVersion7.02.2600.5512 (xpsp.080413-0852)
InternalNameCMDL32
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCMDL32.EXE
ProductNameMicrosoft(R) Connection Manager
ProductVersion7.02.2600.5512

VS_FIXEDFILEINFO

FileVersion7.2.2600.5512
ProductVersion7.2.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
025600EXE04/13/2008 18:56:52#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x258