filenameAT.exe
size27136 (0x6a00)
md5050191edab0972e2265a9a2decf2b725
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
6492101
1079
25921015
6991111
28917819
6192101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3d6dd956
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.0
SizeOfCode0x3400
SizeOfInitializedData0x3200
SizeOfUninitializedData0
AddressOfEntryPoint0x274a
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0xa000
SizeOfHeaders0x400
CheckSum0xe7df
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.1 EXE / v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x329e0x3400R-X CODE
.data0x50000x18d40x800RW- IDATA
.rsrc0x70000x28c00x2a00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x3c100xa0
RESOURCE0x70000x28c0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x11600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2500x9c
IAT0x10000x144
Delay_IAT00
CLR_Header00
typenamesizecp
MESSAGETABLE#134161252
MESSAGETABLE#149441252
VERSION#19441252
VERSION#19201252
module_namehintordfunction_name
msvcrt.dll676free
msvcrt.dll110__initenv
msvcrt.dll200_cexit
msvcrt.dll78_XcptFilter
msvcrt.dll246_exit
msvcrt.dll197_c_exit
msvcrt.dll765strchr
msvcrt.dll109__getmainargs
msvcrt.dll664fgets
msvcrt.dll805wcscat
msvcrt.dll821wcstok
msvcrt.dll806wcschr
msvcrt.dll563_wcsupr
msvcrt.dll815wcsncpy
msvcrt.dll785swprintf
msvcrt.dll314_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll214_controlfp
msvcrt.dll318_iob
msvcrt.dll763sscanf
msvcrt.dll778strspn
msvcrt.dll776strpbrk
msvcrt.dll503_stricmp
msvcrt.dll351_itoa
msvcrt.dll807wcscmp
msvcrt.dll817wcsrchr
msvcrt.dll655exit
msvcrt.dll809wcscpy
msvcrt.dll552_wcsicmp
msvcrt.dll812wcslen
msvcrt.dll727malloc
msvcrt.dll237_except_handler3
ADVAPI32.dll456RegCloseKey
ADVAPI32.dll482RegOpenKeyExW
ADVAPI32.dll492RegQueryValueExW
KERNEL32.dll576LocalAlloc
KERNEL32.dll412GetProfileIntA
KERNEL32.dll416GetProfileStringA
KERNEL32.dll366GetModuleHandleA
KERNEL32.dll246GetCPInfo
KERNEL32.dll805SetThreadLocale
KERNEL32.dll429GetSystemDefaultLangID
KERNEL32.dll573LoadLibraryW
KERNEL32.dll259GetCommandLineW
KERNEL32.dll666ReadConsoleW
KERNEL32.dll436GetSystemTime
KERNEL32.dll453GetThreadLocale
KERNEL32.dll460GetTimeFormatW
KERNEL32.dll353GetLastError
KERNEL32.dll295GetConsoleOutputCP
KERNEL32.dll580LocalFree
KERNEL32.dll899WriteConsoleW
KERNEL32.dll900WriteFile
KERNEL32.dll423GetStdHandle
KERNEL32.dll343GetFileType
KERNEL32.dll887WideCharToMultiByte
KERNEL32.dll572LoadLibraryExW
KERNEL32.dll233FreeLibrary
KERNEL32.dll605MultiByteToWideChar
KERNEL32.dll229FormatMessageW
NETAPI32.dll196NetScheduleJobAdd
NETAPI32.dll104NetApiBufferFree
NETAPI32.dll198NetScheduleJobEnum
NETAPI32.dll197NetScheduleJobDel
NETAPI32.dll199NetScheduleJobGetInfo
NETAPI32.dll82I_NetNameValidate
SHELL32.dll7CommandLineToArgvW
USER32.dll729wsprintfW
ntdll.dll252NtQuerySystemTime
ntdll.dll803RtlTimeToSecondsSince1970

StringTable 040404B0

CompanyNameMicrosoft Corporation
FileDescriptionSchedule service command line interface
FileVersion5.1.2600.1106 (xpsp1.020828-1920)
InternalNameAT.EXE
LegalCopyright(C) Microsoft Corporation. All rights reserved.
OriginalFilenameAT.EXE
ProductNameMicrosoft(R) Windows(R) Operating System
ProductVersion5.1.2600.1106

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSchedule service command line interface
FileVersion5.1.2600.1106 (xpsp1.020828-1920)
InternalNameAT.EXE
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameAT.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.1106

VS_FIXEDFILEINFO

FileVersion5.1.2600.1106
ProductVersion5.1.2600.1106
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
027136EXE08/29/2002 08:20:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x250