filenameSimpleApp.exe
size35379 (0x8a33)
md5abb111a51d2ad7cd75699e9469192e33
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x4d20d9ad
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.56
SizeOfCode0x4a00
SizeOfInitializedData0x3000
SizeOfUninitializedData0x8e00
AddressOfEntryPoint0x1290
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0x126e4
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MingWin32

Sections

namevavsizeraw sizeflags
.text0x10000x48300x4a00R-X CODE
.data0x60000xc00x200RW- IDATA
.rdata0x70000x4600x600R-- IDATA
.bss0x80000x8cb00RW- UDATA
.idata0x110000xadc0xc00RW- IDATA
.rsrc0x120000x1a400x1c00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x110000xadc
RESOURCE0x120000x1a40
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAP#145000
ICON#17440
RCDATA#260
RCDATA#450
RCDATA#550
RCDATA#630
RCDATA#750
RCDATA#820
RCDATA#950
RCDATA#10100
RCDATA#1750
RCDATA#1820
RCDATA#2030
RCDATA#21250
RCDATA#101500
RCDATA#1021150
RCDATA#103530
RCDATA#1041040
GROUP_ICON#1200
module_namehintordfunction_name
ADVAPI32.DLL386RegCloseKey
ADVAPI32.DLL399RegEnumKeyExA
ADVAPI32.DLL411RegOpenKeyExA
ADVAPI32.DLL421RegQueryValueExA
KERNEL32.dll38CloseHandle
KERNEL32.dll53CopyFileA
KERNEL32.dll79CreateMutexA
KERNEL32.dll84CreateProcessA
KERNEL32.dll155ExitProcess
KERNEL32.dll197FindResourceExA
KERNEL32.dll208FormatMessageA
KERNEL32.dll236GetCommandLineA
KERNEL32.dll279GetCurrentDirectoryA
KERNEL32.dll281GetCurrentProcess
KERNEL32.dll301GetEnvironmentVariableA
KERNEL32.dll304GetExitCodeProcess
KERNEL32.dll323GetLastError
KERNEL32.dll333GetModuleFileNameA
KERNEL32.dll335GetModuleHandleA
KERNEL32.dll362GetProcAddress
KERNEL32.dll384GetStartupInfoA
KERNEL32.dll458GlobalMemoryStatus
KERNEL32.dll527LoadResource
KERNEL32.dll532LocalFree
KERNEL32.dll541LockResource
KERNEL32.dll692SetEnvironmentVariableA
KERNEL32.dll710SetLastError
KERNEL32.dll736SetUnhandledExceptionFilter
KERNEL32.dll806WaitForSingleObject
msvcrt.dll39__getmainargs
msvcrt.dll60__p__environ
msvcrt.dll62__p__fmode
msvcrt.dll80__set_app_type
msvcrt.dll121_cexit
msvcrt.dll123_chdir
msvcrt.dll130_close
msvcrt.dll175_findclose
msvcrt.dll176_findfirst
msvcrt.dll179_findnext
msvcrt.dll233_iob
msvcrt.dll266_itoa
msvcrt.dll345_mkdir
msvcrt.dll350_onexit
msvcrt.dll351_open
msvcrt.dll369_read
msvcrt.dll388_setmode
msvcrt.dll403_stat
msvcrt.dll440_unlink
msvcrt.dll540atexit
msvcrt.dll542atoi
msvcrt.dll557fclose
msvcrt.dll568fopen
msvcrt.dll569fprintf
msvcrt.dll583fwrite
msvcrt.dll634memset
msvcrt.dll639printf
msvcrt.dll656signal
msvcrt.dll663strcat
msvcrt.dll664strchr
msvcrt.dll665strcmp
msvcrt.dll667strcpy
msvcrt.dll671strlen
msvcrt.dll672strncat
msvcrt.dll674strncpy
msvcrt.dll675strpbrk
msvcrt.dll676strrchr
msvcrt.dll678strstr
msvcrt.dll680strtok
SHELL32.DLL142ShellExecuteA
USER32.dll89CreateWindowExA
USER32.dll148DispatchMessageA
USER32.dll204EnumWindows
USER32.dll210FindWindowExA
USER32.dll292GetMessageA
USER32.dll325GetSystemMetrics
USER32.dll340GetWindowLongA
USER32.dll346GetWindowRect
USER32.dll348GetWindowTextA
USER32.dll352GetWindowThreadProcessId
USER32.dll396KillTimer
USER32.dll407LoadImageA
USER32.dll430MessageBoxA
USER32.dll464PostQuitMessage
USER32.dll500SendMessageA
USER32.dll526SetForegroundWindow
USER32.dll555SetTimer
USER32.dll564SetWindowPos
USER32.dll577ShowWindow
USER32.dll600TranslateMessage
USER32.dll612UpdateWindow
offsetsizetypecomment
032256EXE01/02/2011 20:01:49#
15c115HTM#
7e003123JAR#
Scanning the drive for archives:
1 file, 35379 bytes (35 KiB)


--
Type = zip
Offset = 32256
Physical Size = 3123

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2011-01-02 21:01:50 D....            0            0  META-INF
2011-01-02 21:01:48 .....          169          143  META-INF/MANIFEST.MF
2011-01-02 21:01:50 D....            0            0  net
2011-01-02 21:01:50 D....            0            0  net/sf
2011-01-02 21:01:50 D....            0            0  net/sf/launch4j
2011-01-02 21:01:50 D....            0            0  net/sf/launch4j/example
2011-01-02 21:01:50 .....          696          391  net/sf/launch4j/example/SimpleApp$1.class
2011-01-02 21:01:50 .....         2960         1631  net/sf/launch4j/example/SimpleApp.class
------------------- ----- ------------ ------------  ------------------------
2011-01-02 21:01:50               3825         2165  3 files, 5 folders
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK