filenamecmd.exe
size399360 (0x61800)
md50466f12e4258b4f0e154127f3dd580f5
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1540356
10217
9340357
9640312
9440351
95403552
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x48025baf
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x1f800
SizeOfInitializedData0x41c00
SizeOfUninitializedData0
AddressOfEntryPoint0x5046
BaseOfCode0x1000
BaseOfData0x1f000
ImageBase0x4ad00000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x64000
SizeOfHeaders0x400
CheckSum0x63a68
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x100000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.1 EXE / v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x1f6200x1f800R-X CODE
.data0x210000x1ca240x1ca00RW- IDATA
.rsrc0x3e0000x260000x25200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1f6400x50
RESOURCE0x3e0000x25140
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x205c40x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x193400x40
Bound_IAT0x2480x58
IAT0x10000x300
Delay_IAT0x1f3080x80
CLR_Header00
typenamesizecp
ICON#137521252
ICON#222161252
ICON#317361252
ICON#413841252
ICON#596401252
ICON#642641252
ICON#724401252
ICON#811281252
MESSAGETABLE#11236321252
GROUP_ICONIDI_APPICON1181252
VERSION#18961252
module_namehintordfunction_name
KERNEL32.dll229FlushConsoleInputBuffer
KERNEL32.dll580LoadLibraryA
KERNEL32.dll541InterlockedExchange
KERNEL32.dll240FreeLibrary
KERNEL32.dll586LocalAlloc
KERNEL32.dll476GetVDMCurrentDirectories
KERNEL32.dll51CmdBatNotification
KERNEL32.dll374GetModuleHandleA
KERNEL32.dll822SetUnhandledExceptionFilter
KERNEL32.dll859UnhandledExceptionFilter
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll468GetTickCount
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll463GetThreadLocale
KERNEL32.dll327GetDiskFreeSpaceExW
KERNEL32.dll54CompareFileTime
KERNEL32.dll694RemoveDirectoryW
KERNEL32.dll314GetCurrentDirectoryW
KERNEL32.dll763SetCurrentDirectoryW
KERNEL32.dll842TerminateProcess
KERNEL32.dll894WaitForSingleObject
KERNEL32.dll338GetExitCodeProcess
KERNEL32.dll66CopyFileW
KERNEL32.dll776SetFileAttributesW
KERNEL32.dll130DeleteFileW
KERNEL32.dll781SetFileTime
KERNEL32.dll74CreateDirectoryW
KERNEL32.dll196FillConsoleOutputAttribute
KERNEL32.dll757SetConsoleTextAttribute
KERNEL32.dll714ScrollConsoleScreenBufferW
KERNEL32.dll236FormatMessageW
KERNEL32.dll145DuplicateHandle
KERNEL32.dll230FlushFileBuffers
KERNEL32.dll527HeapReAlloc
KERNEL32.dll529HeapSize
KERNEL32.dll344GetFileAttributesExW
KERNEL32.dll590LocalFree
KERNEL32.dll332GetDriveTypeW
KERNEL32.dll536InitializeCriticalSection
KERNEL32.dll734SetConsoleCtrlHandler
KERNEL32.dll489GetWindowsDirectoryW
KERNEL32.dll307GetConsoleTitleW
KERNEL32.dll373GetModuleFileNameW
KERNEL32.dll477GetVersion
KERNEL32.dll150EnterCriticalSection
KERNEL32.dll579LeaveCriticalSection
KERNEL32.dll186ExpandEnvironmentStringsW
KERNEL32.dll716SearchPathW
KERNEL32.dll911WriteFile
KERNEL32.dll481GetVolumeInformationW
KERNEL32.dll790SetLastError
KERNEL32.dll611MoveFileW
KERNEL32.dll759SetConsoleTitleW
KERNEL32.dll610MoveFileExW
KERNEL32.dll251GetBinaryTypeW
KERNEL32.dll345GetFileAttributesW
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll102CreateProcessW
KERNEL32.dll583LoadLibraryW
KERNEL32.dll681ReadProcessMemory
KERNEL32.dll771SetErrorMode
KERNEL32.dll300GetConsoleMode
KERNEL32.dll749SetConsoleMode
KERNEL32.dll878VirtualAlloc
KERNEL32.dll881VirtualFree
KERNEL32.dll770SetEnvironmentVariableW
KERNEL32.dll337GetEnvironmentVariableW
KERNEL32.dll266GetCommandLineW
KERNEL32.dll335GetEnvironmentStringsW
KERNEL32.dll362GetLocalTime
KERNEL32.dll470GetTimeFormatW
KERNEL32.dll194FileTimeToLocalFileTime
KERNEL32.dll320GetDateFormatW
KERNEL32.dll360GetLastError
KERNEL32.dll49CloseHandle
KERNEL32.dll816SetThreadLocale
KERNEL32.dll408GetProcAddress
KERNEL32.dll377GetModuleHandleW
KERNEL32.dll777SetFilePointer
KERNEL32.dll940lstrcmpW
KERNEL32.dll943lstrcmpiW
KERNEL32.dll517HeapAlloc
KERNEL32.dll412GetProcessHeap
KERNEL32.dll523HeapFree
KERNEL32.dll615MultiByteToWideChar
KERNEL32.dll678ReadFile
KERNEL32.dll910WriteConsoleW
KERNEL32.dll198FillConsoleOutputCharacterW
KERNEL32.dll738SetConsoleCursorPosition
KERNEL32.dll676ReadConsoleW
KERNEL32.dll304GetConsoleScreenBufferInfo
KERNEL32.dll432GetStdHandle
KERNEL32.dll350GetFileType
KERNEL32.dll886VirtualQuery
KERNEL32.dll665RaiseException
KERNEL32.dll253GetCPInfo
KERNEL32.dll302GetConsoleOutputCP
KERNEL32.dll898WideCharToMultiByte
KERNEL32.dll347GetFileSize
KERNEL32.dll82CreateFileW
KERNEL32.dll204FindClose
KERNEL32.dll218FindNextFileW
KERNEL32.dll211FindFirstFileW
KERNEL32.dll354GetFullPathNameW
KERNEL32.dll472GetUserDefaultLCID
KERNEL32.dll364GetLocaleInfoW
KERNEL32.dll793SetLocalTime
KERNEL32.dll839SystemTimeToFileTime
KERNEL32.dll446GetSystemTime
KERNEL32.dll195FileTimeToSystemTime
msvcrt.dll133__p__fmode
msvcrt.dll128__p__commode
msvcrt.dll182_adjust_fdiv
msvcrt.dll154__setusermatherr
msvcrt.dll315_initterm
msvcrt.dll109__getmainargs
msvcrt.dll110__initenv
msvcrt.dll200_cexit
msvcrt.dll78_XcptFilter
msvcrt.dll246_exit
msvcrt.dll197_c_exit
msvcrt.dll647calloc
msvcrt.dll555_wcslwr
msvcrt.dll747qsort
msvcrt.dll544_vsnwprintf
msvcrt.dll820wcsstr
msvcrt.dll229_dup2
msvcrt.dll228_dup
msvcrt.dll438_open_osfhandle
msvcrt.dll210_close
msvcrt.dll787swscanf
msvcrt.dll531_ultoa
msvcrt.dll447_pipe
msvcrt.dll470_seh_longjmp_unwind
msvcrt.dll479_setmode
msvcrt.dll815wcsncmp
msvcrt.dll718iswxdigit
msvcrt.dll662fflush
msvcrt.dll656exit
msvcrt.dll628_wtol
msvcrt.dll791time
msvcrt.dll763srand
msvcrt.dll152__set_app_type
msvcrt.dll818wcsrchr
msvcrt.dll728malloc
msvcrt.dll677free
msvcrt.dll825wcstoul
msvcrt.dll235_errno
msvcrt.dll707iswalpha
msvcrt.dll741printf
msvcrt.dll749rand
msvcrt.dll786swprintf
msvcrt.dll319_iob
msvcrt.dll671fprintf
msvcrt.dll796towlower
msvcrt.dll750realloc
msvcrt.dll756setlocale
msvcrt.dll484_snwprintf
msvcrt.dll806wcscat
msvcrt.dll564_wcsupr
msvcrt.dll816wcsncpy
msvcrt.dll599_wpopen
msvcrt.dll665fgets
msvcrt.dll444_pclose
msvcrt.dll735memmove
msvcrt.dll807wcschr
msvcrt.dll716iswspace
msvcrt.dll520_tell
msvcrt.dll727longjmp
msvcrt.dll808wcscmp
msvcrt.dll557_wcsnicmp
msvcrt.dll553_wcsicmp
msvcrt.dll823wcstol
msvcrt.dll711iswdigit
msvcrt.dll288_getch
msvcrt.dll286_get_osfhandle
msvcrt.dll214_controlfp
msvcrt.dll476_setjmp3
msvcrt.dll237_except_handler3
msvcrt.dll810wcscpy
msvcrt.dll813wcslen
msvcrt.dll819wcsspn
msvcrt.dll797towupper
USER32.dll359GetUserObjectInformationW
USER32.dll353GetThreadDesktop
USER32.dll475MessageBeep
USER32.dll328GetProcessWindowStation

StringTable 041904B0

CompanyNameКорпорация Майкрософт
FileDescriptionОбработчик команд Windows
FileVersion5.1.2600.5512 (xpsp.080413-2111)
InternalNamecmd
LegalCopyright© Корпорация Майкрософт. Все права защищены.
OriginalFilenameCmd.Exe
ProductNameОперационная система Microsoft® Windows®
ProductVersion5.1.2600.5512

VS_FIXEDFILEINFO

FileVersion5.1.2600.5512
ProductVersion5.1.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0399360EXE04/13/2008 19:14:55#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x248