| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 1992-Jun-19 22:22:17 |
| Detected languages |
English - United Kingdom
English - United States Estonian - Estonia German - Germany Russian - Russia Slovenian - Slovenia Ukrainian - Ukraine |
| CompanyName | WhereIsIt Soft |
| FileDescription | Where Is It? |
| FileVersion | 2014.0.0.220 |
| InternalName | WhereIsIt.exe |
| LegalCopyright | Robert Galle (c) February 2014 |
| LegalTrademarks | |
| OriginalFilename | WhereIsIt.exe |
| ProductName | Where Is It? |
| ProductVersion | 2013.1014 |
| Comments |
| Suspicious | PEiD Signature: | ASPack v2.12 |
| Suspicious | The PE is packed with Aspack or Armadillo |
Unusual section name found:
Section is both writable and executable. Unusual section name found: Section is both writable and executable. Unusual section name found: Section is both writable and executable. Unusual section name found: Section is both writable and executable. Unusual section name found: Section is both writable and executable. Unusual section name found: Section is both writable and executable. Unusual section name found: Section is both writable and executable. Unusual section name found: Section is both writable and executable. Section .rsrc is both writable and executable. Section .data is both writable and executable. Unusual section name found: .adata Section .adata is both writable and executable. |
| Info | The PE contains common functions which appear in legitimate applications. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE header may have been manually modified. |
Resource AVICATALOGHICOLOR is possibly compressed or encrypted.
Resource AVIFILECOPY is possibly compressed or encrypted. Resource AVIFILEDEL is possibly compressed or encrypted. Resource AVIFILEDELR is possibly compressed or encrypted. Resource AVIFILEMOVE is possibly compressed or encrypted. Resource AVIFINDCATHICOL is possibly compressed or encrypted. Resource 1 is possibly compressed or encrypted. Resource 2 is possibly compressed or encrypted. Resource 3 is possibly compressed or encrypted. Resource 4 is possibly compressed or encrypted. Resource 5 is possibly compressed or encrypted. Resource 6 is possibly compressed or encrypted. Resource 7 is possibly compressed or encrypted. Resource 8 is possibly compressed or encrypted. Resource 9 is possibly compressed or encrypted. Resource 10 is possibly compressed or encrypted. Resource 11 is possibly compressed or encrypted. Resource 12 is possibly compressed or encrypted. Resource 13 is possibly compressed or encrypted. Resource 14 is possibly compressed or encrypted. Resource 15 is possibly compressed or encrypted. Resource 16 is possibly compressed or encrypted. Resource 17 is possibly compressed or encrypted. Resource 18 is possibly compressed or encrypted. Resource 19 is possibly compressed or encrypted. Resource 20 is possibly compressed or encrypted. Resource 21 is possibly compressed or encrypted. Resource 22 is possibly compressed or encrypted. Resource 23 is possibly compressed or encrypted. Resource 24 is possibly compressed or encrypted. Resource 25 is possibly compressed or encrypted. Resource 26 is possibly compressed or encrypted. Resource 27 is possibly compressed or encrypted. Resource 28 is possibly compressed or encrypted. Resource 29 is possibly compressed or encrypted. Resource 30 is possibly compressed or encrypted. Resource BBABORT is possibly compressed or encrypted. Resource BBALL is possibly compressed or encrypted. Resource BBCANCEL is possibly compressed or encrypted. Resource BBCLOSE is possibly compressed or encrypted. Resource BBHELP is possibly compressed or encrypted. Resource BBIGNORE is possibly compressed or encrypted. Resource BBNO is possibly compressed or encrypted. Resource BBOK is possibly compressed or encrypted. Resource BBRETRY is possibly compressed or encrypted. Resource BBYES is possibly compressed or encrypted. Resource CLOSEDFOLDER is possibly compressed or encrypted. Resource CURRENTFOLDER is possibly compressed or encrypted. Resource CX_FULLSCROLLBITMAP is possibly compressed or encrypted. Resource CX_HORSCROLLBITMAP is possibly compressed or encrypted. Resource CX_VERSCROLLBITMAP is possibly compressed or encrypted. Resource DFS_DITHGRADMASK1 is possibly compressed or encrypted. Resource DXBARCLOSE is possibly compressed or encrypted. Resource DXBARCOLORCOMBO is possibly compressed or encrypted. Resource DXBARDATECOMBO is possibly compressed or encrypted. Resource DXBARFONTNAMECOMBO is possibly compressed or encrypted. Resource DXBARIMAGECOMBO is possibly compressed or encrypted. Resource DXBARMINIMIZE is possibly compressed or encrypted. Resource DXBARNONTRUETYPEFONT is possibly compressed or encrypted. Resource DXBARRESTORE is possibly compressed or encrypted. Resource DXBARTREEVIEWCOMBO is possibly compressed or encrypted. Resource DXBARTRUETYPEFONT is possibly compressed or encrypted. Resource DXEXPANDBUTTON_MINUS is possibly compressed or encrypted. Resource DXEXPANDBUTTON_PLUS is possibly compressed or encrypted. Resource DXSTATUSBAR_RED is possibly compressed or encrypted. Resource DXSTATUSBAR_YELLOW is possibly compressed or encrypted. Resource DXSUBMENUEXPAND is possibly compressed or encrypted. Resource OPENFOLDER is possibly compressed or encrypted. Resource QR1COLUMNBITMAP is possibly compressed or encrypted. Resource QR2COLUMNSBITMAP is possibly compressed or encrypted. Resource QR3COLUMNSBITMAP is possibly compressed or encrypted. Resource QR4COLUMNSBITMAP is possibly compressed or encrypted. Resource QRALCENTERBITMAP is possibly compressed or encrypted. Resource QRALLEFTBITMAP is possibly compressed or encrypted. Resource QRALRIGHTBITMAP is possibly compressed or encrypted. Resource QRAUTOSIZEBITMAP is possibly compressed or encrypted. Resource QRBKCOLORBITMAP is possibly compressed or encrypted. Resource QRBOLDBITMAP is possibly compressed or encrypted. Resource QRCANCELBITMAP is possibly compressed or encrypted. Resource QRCIRCLEBITMAP is possibly compressed or encrypted. Resource QRCOLUMNHEADERBITMAP is possibly compressed or encrypted. Resource QRCOPYBITMAP is possibly compressed or encrypted. Resource QRCUTBITMAP is possibly compressed or encrypted. Resource QRDETAILBITMAP is possibly compressed or encrypted. Resource QRFIRSTPAGEBITMAP is possibly compressed or encrypted. Resource QRFONTCOLORBITMAP is possibly compressed or encrypted. Resource QRFRAMEBTMBITMAP is possibly compressed or encrypted. Resource QRFRAMELEFTBITMAP is possibly compressed or encrypted. Resource QRFRAMERIGHTBITMAP is possibly compressed or encrypted. Resource QRFRAMETOPBITMAP is possibly compressed or encrypted. Resource QRFUNCTIONBITMAP is possibly compressed or encrypted. Resource QRHASCHILDBITMAP is possibly compressed or encrypted. Resource QRHORZLINEBITMAP is possibly compressed or encrypted. Resource QRINSFIELDBITMAP is possibly compressed or encrypted. Resource QRINSMEMOBITMAP is possibly compressed or encrypted. Resource QRINSPICTBITMAP is possibly compressed or encrypted. Resource QRINSSHAPEBITMAP is possibly compressed or encrypted. Resource QRITALICBITMAP is possibly compressed or encrypted. Resource QRLASTPAGEBITMAP is possibly compressed or encrypted. Resource QRLEFTRIGHTBITMAP is possibly compressed or encrypted. Resource QRNEWBITMAP is possibly compressed or encrypted. Resource QRNEXTPAGEBITMAP is possibly compressed or encrypted. Resource QROKBITMAP is possibly compressed or encrypted. Resource QROPENBITMAP is possibly compressed or encrypted. Resource QRPAGEFOOTERBITMAP is possibly compressed or encrypted. Resource QRPAGEHEADERBITMAP is possibly compressed or encrypted. Resource QRPASTEBITMAP is possibly compressed or encrypted. Resource QRPREVBITMAP is possibly compressed or encrypted. Resource QRPREVPAGEBITMAP is possibly compressed or encrypted. Resource QRPRINTBITMAP is possibly compressed or encrypted. Resource QRPRINTSETUPBITMAP is possibly compressed or encrypted. Resource QRRECTANGLEBITMAP is possibly compressed or encrypted. Resource QRSAVEBITMAP is possibly compressed or encrypted. Resource QRTOPBOTTOMBITMAP is possibly compressed or encrypted. Resource QRULINEBITMAP is possibly compressed or encrypted. Resource QRVERTLINEBITMAP is possibly compressed or encrypted. Resource QRZOOMTO100BITMAP is possibly compressed or encrypted. Resource QRZOOMTOFITBITMAP is possibly compressed or encrypted. Resource QRZOOMTOWIDTHBITMAP is possibly compressed or encrypted. Resource RAM is possibly compressed or encrypted. Resource SBLEFTDN is possibly compressed or encrypted. Resource SBRIGHT is possibly compressed or encrypted. Resource SBRIGHTDIS is possibly compressed or encrypted. Resource TANTLABEL is possibly compressed or encrypted. Resource TDFSCOLORBUTTON is possibly compressed or encrypted. Resource TDIRTREEVIEW is possibly compressed or encrypted. Resource TSPINEDIT64 is possibly compressed or encrypted. Resource TSPLITTEREX is possibly compressed or encrypted. Resource TTRAYICON is possibly compressed or encrypted. Resource UNKNOWNFILE is possibly compressed or encrypted. Resource FORMBLACK is possibly compressed or encrypted. Resource FORMBLUE is possibly compressed or encrypted. Resource FORMSILVER is possibly compressed or encrypted. Resource IMGLISTCOMPAREHICOL is possibly compressed or encrypted. Resource IMGLISTRIBBONSMALL is possibly compressed or encrypted. Resource LOGOPICT is possibly compressed or encrypted. Resource PACKAGEINFO is possibly compressed or encrypted. Resource REPORTWIZARD is possibly compressed or encrypted. Resource RIBBONBLACK is possibly compressed or encrypted. Resource RIBBONCOMMON is possibly compressed or encrypted. Resource RIBBONSILVER is possibly compressed or encrypted. Resource SETUPWIZARD is possibly compressed or encrypted. Resource TABOUTDLG is possibly compressed or encrypted. Resource TADDDISKFORM is possibly compressed or encrypted. Resource TBROWSEFOLDERFORM is possibly compressed or encrypted. Resource TBROWSENETFORM is possibly compressed or encrypted. Resource TCAROUSELPOPUPFORM is possibly compressed or encrypted. Resource TCATALOGGROUPSFORM is possibly compressed or encrypted. Resource TCATALOGSELECTFORM is possibly compressed or encrypted. Resource TCATMANAGERFORM is possibly compressed or encrypted. Resource TCDDBPOSTFORM is possibly compressed or encrypted. Resource TCHANGEICONFORM is possibly compressed or encrypted. Resource TCHECKFILESFORM is possibly compressed or encrypted. Resource TCLOSEAPPFORM is possibly compressed or encrypted. Resource TCOLUMNSFORM is possibly compressed or encrypted. Resource TCOMPAREFORM is possibly compressed or encrypted. Resource TCOPYMISSINGFORM is possibly compressed or encrypted. Resource TDATASIZEFORM is possibly compressed or encrypted. Resource TDESCASSISTFORM is possibly compressed or encrypted. Resource TDESCVIEWFORM is possibly compressed or encrypted. Resource TDFSCOLORBUTTONPALETTE is possibly compressed or encrypted. Resource TDISKEDITDESCFORM is possibly compressed or encrypted. Resource TDISKSELECTFORM is possibly compressed or encrypted. Resource TDXBARCUSTOMCUSTOMIZATIONFORM is possibly compressed or encrypted. Resource TDXBARCUSTOMIZATIONFORM is possibly compressed or encrypted. Resource TDXBARITEMADDEDITOR is possibly compressed or encrypted. Resource TDXBARNAMEED is possibly compressed or encrypted. Resource TDXBARSUBMENUEDITOR is possibly compressed or encrypted. Resource TEXPORTDESCFORM is possibly compressed or encrypted. Resource TFILEOPSFORM is possibly compressed or encrypted. Resource TFRMADDGROUPITEMS is possibly compressed or encrypted. Resource TIMAGECOLORSFORM is possibly compressed or encrypted. Resource TIMPORTDESCFORM is possibly compressed or encrypted. Resource TLANGEDITFORM is possibly compressed or encrypted. The resource timestamps differ from the PE header:
|
| Safe | VirusTotal score: 0/72 (Scanned on 2025-05-31 04:30:15) | All the AVs think this file is safe. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x50 |
| e_cp | 0x2 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0xf |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0x1a |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x100 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 11 |
| TimeDateStamp | 1992-Jun-19 22:22:17 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
| Magic | PE32 |
|---|---|
| LinkerVersion | 2.0 |
| SizeOfCode | 0x489200 |
| SizeOfInitializedData | 0x2fec00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00001000 (Section: ) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x48b000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 1.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x965000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| kernel32.dll |
GetProcAddress
GetModuleHandleA LoadLibraryA |
|---|---|
| user32.dll |
GetKeyboardType
|
| advapi32.dll |
RegQueryValueExA
|
| oleaut32.dll |
SafeArrayPutElement
|
| user32.dll (#2) |
GetKeyboardType
|
| gdi32.dll |
UpdateColors
|
| version.dll |
VerQueryValueA
|
| mpr.dll |
WNetUseConnectionA
|
| advapi32.dll (#2) |
RegQueryValueExA
|
| oleaut32.dll (#2) |
SafeArrayPutElement
|
| ole32.dll |
CreateStreamOnHGlobal
|
| shell32.dll |
Shell_NotifyIconA
|
| comctl32.dll |
ImageList_GetImageInfo
|
| shell32.dll (#2) |
Shell_NotifyIconA
|
| comdlg32.dll |
PrintDlgA
|
| winspool.drv |
OpenPrinterA
|
| winmm.dll |
timeGetTime
|
| oledlg.dll |
OleUIObjectPropertiesA
|
| ole32.dll (#2) |
CreateStreamOnHGlobal
|
| wsock32.dll |
WSACleanup
|
| shell32.dll (#3) |
Shell_NotifyIconA
|
| oleaut32.dll (#3) |
SafeArrayPutElement
|
| kernel32.dll (#2) |
GetProcAddress
GetModuleHandleA LoadLibraryA |
| 肀 샀À肀 ÿ ÿÿ ÿÿ ÿ肈矷睷睷眏碇衸眏睷睷蟰ࡿ轷衷睷罷眈ྈ蟰硷ྀ睷碇肈眀瞏睷耀矷ࡿ轷裸砀矷罷砈眏蟰ク裿辀睷碇タ眈マྈ睷ࡿ衷砇肈矷蟰ク肈輇g胸眏眈マ裸(ÿ碇裿タࣿླྀ轷ྈ䓷蟰聸ク俴眈袈マエ |
| Ā샌罿裷ᄑ恦袈ᆈᄑ䑄ᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑᄑῼ翀܈磿̀ᄑĀᄑༀ裀㼀膈/ᄑᄑŠᄑᄑᄑᅀᄑᄑᄑ( @ Ҁ 閖¼隗½낱Î뢺Ô낲· ⽪/㍩3❊'㍔3㍑3⌲#㑅4㉀2㽐?㐻4瑿t窀 |
| ĀÿĀÿĀÿĀÿ̀ÿタÿÿÿ( @ ႀ ㍐S㉩RN㵎]䵊m奙x 彟ェ幟ェ幟ォ幟ォ幟ェ幟ェ 㑄TㅓQ♉F瑿エ銎メ骞モ 幟ェ屝ァ䴼ッ䐬ス䈡ホ䌟ム䜯ス䩁ィ彠ェ彠ォ恡⦆恡⦆恠⦆繾セ ㌺S〾PℰA窀コ醐マ鞗ヨ幞ェ幞ェ彟ォ彟ォ㬹|㜢ケ䨝ᆪ娜ᅡ爤輯鰴頱瘤䄟ヘ㸱ェ楪ョ彟ォ샀恠⦆恠⦆恠⦆ ㈲R㈱R†@蒄ト¢겫ᄡ㸗ユ䠦ユ㼣マ吧ᄃ缪 ̄茫↑漤ᅲ伙 |
| 紀준鈇.넯Z꜑>꘍;꘍;꘍<꘍<꘍<ꨑC뜟^힗ᆬ○粒ﯻᅤ쬴、갓F鸅,鴄*鰃(鬂%騁#餀需销錀鈀退萏氷水洰洬渌昀쌀 Ā 紀㼀耀︁ꬠL됳_꜎>ꠏ?ꠏ?ꠏ@ꠏ@ꨑC눚T풔ᅠ↓○粒ﯻ﷽�ᅥ쬴、갓H鼆-鸅+鴄)鰃&騁$餀!需销錀鄀輀礢氵洲渭瀡最︀挀㘀 耀ꌀ逇.똶d댭\ꤐBꨑCꨑCꨑDꨑD괕K톒ロ←↓○﷽�ᅥ쬴・괔Iꀇ.鸅,鴄)鰃'騁$餀!需销 |