0533955D39F432641484679E51B00EF9

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	0533955D39F432641484679E51B00EF9
size	40448 (0x9e00)
md5	0533955d39f432641484679e51b00ef9

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
239	40116	2
257	24123	2
261	24123	23
260	24123	13
203	65501	5
1	0	79
260	24215	1
255	24210	1
258	24215	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x59135c2d
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.0
SizeOfCode	0x5800
SizeOfInitializedData	0x4600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1037
BaseOfCode	0x1000
BaseOfData	0x7000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x10000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x56de	0x5800	R-X CODE
.rdata	0x7000	0x213d	0x2200	R-- IDATA
.data	0xa000	0x7fc	0x400	RW- IDATA
.idata	0xb000	0xbca	0xc00	R-- IDATA
.gfids	0xc000	0x13a	0x200	R-- IDATA
.00cfg	0xd000	0x104	0x200	R-- IDATA
.rsrc	0xe000	0x43c	0x600	R-- IDATA
.reloc	0xf000	0x521	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xb224	0x64
RESOURCE	0xe000	0x43c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xf000	0x3f4
DEBUG	0x84f0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x8528	0x40
Bound_IAT	0	0
IAT	0xb000	0x224
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	ord	function_name
WS2_32.dll	149		freeaddrinfo
WS2_32.dll	150		getaddrinfo
WS2_32.dll		116
WS2_32.dll		115
WS2_32.dll		23
WS2_32.dll		22
WS2_32.dll		19
WS2_32.dll		16
WS2_32.dll		4
WS2_32.dll		3
WS2_32.dll		111
VCRUNTIME140D.dll	49		__vcrt_LoadLibraryExW
VCRUNTIME140D.dll	47		__vcrt_GetModuleHandleW
VCRUNTIME140D.dll	46		__vcrt_GetModuleFileNameW
VCRUNTIME140D.dll	53		_except_handler4_common
VCRUNTIME140D.dll	37		__std_type_info_destroy_list
VCRUNTIME140D.dll	72		memset
ucrtbased.dll	219		_configthreadlocale
ucrtbased.dll	761		_set_new_mode
ucrtbased.dll	115		__p__commode
ucrtbased.dll	142		__stdio_common_vsprintf_s
ucrtbased.dll	749		_seh_filter_dll
ucrtbased.dll	407		_initialize_onexit_table
ucrtbased.dll	737		_register_onexit_function
ucrtbased.dll	268		_execute_onexit_table
ucrtbased.dll	232		_crt_atexit
ucrtbased.dll	231		_crt_at_quick_exit
ucrtbased.dll	224		_controlfp_s
ucrtbased.dll	1381		terminate
ucrtbased.dll	968		_wmakepath_s
ucrtbased.dll	996		_wsplitpath_s
ucrtbased.dll	1406		wcscpy_s
ucrtbased.dll	738		_register_thread_local_exe_atexit_callback
ucrtbased.dll	202		_cexit
ucrtbased.dll	112		__p___argv
ucrtbased.dll	111		__p___argc
ucrtbased.dll	758		_set_fmode
ucrtbased.dll	273		_exit
ucrtbased.dll	1141		exit
ucrtbased.dll	410		_initterm_e
ucrtbased.dll	409		_initterm
ucrtbased.dll	354		_get_initial_narrow_environment
ucrtbased.dll	406		_initialize_narrow_environment
ucrtbased.dll	220		_configure_narrow_argv
ucrtbased.dll	129		__setusermatherr
ucrtbased.dll	753		_set_app_type
ucrtbased.dll	750		_seh_filter_exe
ucrtbased.dll	21		_CrtDbgReportW
ucrtbased.dll	20		_CrtDbgReport
ucrtbased.dll	1272		malloc
ucrtbased.dll	140		__stdio_common_vsprintf
ucrtbased.dll	130		__stdio_common_vfprintf
ucrtbased.dll	69		__acrt_iob_func
ucrtbased.dll	1357		strlen
ucrtbased.dll	1349		strcmp
ucrtbased.dll	197		_c_exit
KERNEL32.dll	1088		RaiseException
KERNEL32.dll	977		MultiByteToWideChar
KERNEL32.dll	1485		WideCharToMultiByte
KERNEL32.dll	1410		UnhandledExceptionFilter
KERNEL32.dll	1347		SetUnhandledExceptionFilter
KERNEL32.dll	521		GetCurrentProcess
KERNEL32.dll	1377		TerminateProcess
KERNEL32.dll	877		IsProcessorFeaturePresent
KERNEL32.dll	1069		QueryPerformanceCounter
KERNEL32.dll	522		GetCurrentProcessId
KERNEL32.dll	526		GetCurrentThreadId
KERNEL32.dll	726		GetSystemTimeAsFileTime
KERNEL32.dll	843		InitializeSListHead
KERNEL32.dll	702		GetStartupInfoW
KERNEL32.dll	615		GetModuleHandleW
KERNEL32.dll	592		GetLastError
KERNEL32.dll	815		HeapAlloc
KERNEL32.dll	819		HeapFree
KERNEL32.dll	669		GetProcAddress
KERNEL32.dll	414		FreeLibrary
KERNEL32.dll	1443		VirtualQuery
KERNEL32.dll	674		GetProcessHeap
KERNEL32.dll	871		IsDebuggerPresent

show previews

offset	size	type	comment
0	40448	EXE	05/10/2017 18:30:05	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK