filenameWA13.exe
size745745 (0xb6111)
md5df02f078a0d7c8b663a295ae2334c724
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0x11
TimeDateStamp0x518688a5
PointerToSymbolTable0x9e800
NumberOfSymbols0xef4
SizeOfOptionalHeader0xf0
Characteristics0x27
Magic0x20b
LinkerVersion2.22
SizeOfCode0x12800
SizeOfInitializedData0x1d000
SizeOfUninitializedData0x1600
AddressOfEntryPoint0x14c0
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0xa7000
SizeOfHeaders0x600
CheckSum0xc0f5e
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1266c0x12800R-X CODE IDATA
.data0x140000x5f400x6000RW- IDATA
.rdata0x1a0000x19b00x1a00R-- IDATA
.pdata0x1c0000xcfc0xe00R-- IDATA
.xdata0x1d0000xb600xc00R-- IDATA
.bss0x1e0000x14600RW- UDATA
.idata0x200000xf400x1000RW- IDATA
.CRT0x210000x680x200RW- IDATA
.tls0x220000x480x200RW- IDATA
/40x230000xf300x1000R-- IDATA DISCARDABLE
/190x240000x343be0x34400R-- IDATA DISCARDABLE
/310x590000x75410x7600R-- IDATA DISCARDABLE
/450x610000x89ff0x8a00R-- IDATA DISCARDABLE
/570x6a0000x3e080x4000R-- IDATA DISCARDABLE
/700x6e0000xaf40xc00R-- IDATA DISCARDABLE
/810x6f0000x2fcb00x2fe00R-- IDATA DISCARDABLE
/920x9f0000x72d00x7400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x200000xf40
RESOURCE00
EXCEPTION0x1c0000xcfc
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x220000x28
LOAD_CONFIG00
Bound_IAT00
IAT0x203d80x360
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4220410x4220440x41e0ac0x42104000
module_namehintordfunction_name
GDI32.dll57CreateFontA
GDI32.dll421GetStockObject
GDI32.dll526SelectObject
KERNEL32.dll3AddAtomA
KERNEL32.dll85CloseHandle
KERNEL32.dll159CreateMutexA
KERNEL32.dll176CreateSemaphoreA
KERNEL32.dll215DeleteCriticalSection
KERNEL32.dll247EnterCriticalSection
KERNEL32.dll311FindAtomA
KERNEL32.dll376GetAtomNameA
KERNEL32.dll460GetCurrentProcess
KERNEL32.dll461GetCurrentProcessId
KERNEL32.dll465GetCurrentThreadId
KERNEL32.dll527GetLastError
KERNEL32.dll547GetModuleHandleA
KERNEL32.dll597GetProcAddress
KERNEL32.dll626GetStartupInfoA
KERNEL32.dll649GetSystemTimeAsFileTime
KERNEL32.dll675GetTickCount
KERNEL32.dll759InitializeCriticalSection
KERNEL32.dll782IsDBCSLeadByteEx
KERNEL32.dll841LeaveCriticalSection
KERNEL32.dll847LoadLibraryW
KERNEL32.dll887MultiByteToWideChar
KERNEL32.dll952QueryPerformanceCounter
KERNEL32.dll996ReleaseMutex
KERNEL32.dll1000ReleaseSemaphore
KERNEL32.dll1022RtlAddFunctionTable
KERNEL32.dll1023RtlCaptureContext
KERNEL32.dll1030RtlLookupFunctionEntry
KERNEL32.dll1037RtlVirtualUnwind
KERNEL32.dll1129SetLastError
KERNEL32.dll1180SetUnhandledExceptionFilter
KERNEL32.dll1193Sleep
KERNEL32.dll1207TerminateProcess
KERNEL32.dll1212TlsAlloc
KERNEL32.dll1213TlsFree
KERNEL32.dll1214TlsGetValue
KERNEL32.dll1215TlsSetValue
KERNEL32.dll1227UnhandledExceptionFilter
KERNEL32.dll1257VirtualProtect
KERNEL32.dll1259VirtualQuery
KERNEL32.dll1267WaitForSingleObject
KERNEL32.dll1291WideCharToMultiByte
msvcrt.dll105_write
msvcrt.dll55__C_specific_handler
msvcrt.dll78__dllonexit
msvcrt.dll81__getmainargs
msvcrt.dll82__initenv
msvcrt.dll83__iob_func
msvcrt.dll90__lconv_init
msvcrt.dll91__mb_cur_max
msvcrt.dll96__set_app_type
msvcrt.dll98__setusermatherr
msvcrt.dll113_acmdln
msvcrt.dll120_amsg_exit
msvcrt.dll138_cexit
msvcrt.dll188_errno
msvcrt.dll221_fmode
msvcrt.dll286_initterm
msvcrt.dll387_lock
msvcrt.dll552_onexit
msvcrt.dll719_unlock
msvcrt.dll910abort
msvcrt.dll919atoi
msvcrt.dll923calloc
msvcrt.dll934exit
msvcrt.dll953fputc
msvcrt.dll954fputs
msvcrt.dll958free
msvcrt.dll969fwrite
msvcrt.dll974getenv
msvcrt.dll1009localeconv
msvcrt.dll1016malloc
msvcrt.dll1023memcmp
msvcrt.dll1024memcpy
msvcrt.dll1027memset
msvcrt.dll1043realloc
msvcrt.dll1051setlocale
msvcrt.dll1053signal
msvcrt.dll1056sprintf
msvcrt.dll1065strchr
msvcrt.dll1066strcmp
msvcrt.dll1071strerror
msvcrt.dll1074strlen
msvcrt.dll1077strncmp
msvcrt.dll1132wcslen
USER32.dll98CreateWindowExA
USER32.dll144DefWindowProcA
USER32.dll155DestroyWindow
USER32.dll163DispatchMessageA
USER32.dll190DrawTextA
USER32.dll259GetClientRect
USER32.dll272GetDC
USER32.dll321GetMessageA
USER32.dll452LoadCursorA
USER32.dll456LoadIconA
USER32.dll489MessageBoxA
USER32.dll526PostQuitMessage
USER32.dll545RegisterClassExA
USER32.dll675ShowWindow
USER32.dll699TranslateMessage
offsetsizetypecomment
0745745EXE05/05/2013 16:28:21#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x1e0ac