filename1.exe
size61440 (0xf000)
md5060fc72d2ef1567bdb012b142e357a11
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
2065092919
207509299
203509295
1075
185307162
207612191
201610301
204610301

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x56a42586
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0xa200
SizeOfInitializedData0x4e00
SizeOfUninitializedData0
AddressOfEntryPoint0x11271
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x23000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000xa07d0xa200R-X CODE
.rdata0x1c0000x2a3c0x2c00R-- IDATA
.data0x1f0000x6740x400RW- IDATA
.idata0x200000xb640xc00RW- IDATA
.rsrc0x210000x43c0x600R-- IDATA
.reloc0x220000x6e30x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x200000x50
RESOURCE0x210000x43c
EXCEPTION00
SECURITY00
BASERELOC0x220000x51c
DEBUG0x1c9400x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1da600x40
Bound_IAT00
IAT0x202340x1e4
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
MSVCP110D.dll734char const * __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAPBDH@Z

MSVCP110D.dll713char const * __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPBDH@Z

MSVCP110D.dll742void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

MSVCP110D.dll741void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP110D.dll738void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP110D.dll654public: void __thiscall std::_Container_base12::_Orphan_all(void)

?_Orphan_all@_Container_base12@std@@QAEXXZ

MSVCP110D.dll160public: __thiscall std::_Container_base12::~_Container_base12(void)

??1_Container_base12@std@@QAE@XZ

MSVCP110D.dll94public: __thiscall std::_Container_base12::_Container_base12(void)

??0_Container_base12@std@@QAE@XZ

MSVCP110D.dll457void __cdecl std::_Debug_message(wchar_t const *, wchar_t const *, unsigned int)

?_Debug_message@std@@YAXPB_W0I@Z

MSVCR110D.dll601_cexit
MSVCR110D.dll619_configthreadlocale
MSVCR110D.dll535__setusermatherr
MSVCR110D.dll824_initterm_e
MSVCR110D.dll823_initterm
MSVCR110D.dll684_exit
MSVCR110D.dll712_fmode
MSVCR110D.dll618_commode
MSVCR110D.dll675_except_handler4_common
MSVCR110D.dll637_crt_debugger_hook
MSVCR110D.dll460__crtUnhandledException
MSVCR110D.dll459__crtTerminateProcess
MSVCR110D.dll317void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR110D.dll458__crtSetUnhandledExceptionFilter
MSVCR110D.dll829_invoke_watson
MSVCR110D.dll622_controlfp_s
MSVCR110D.dll1742wcscpy_s
MSVCR110D.dll1464_wmakepath_s
MSVCR110D.dll1498_wsplitpath_s
MSVCR110D.dll1549exit
MSVCR110D.dll371_CrtSetCheckCount
MSVCR110D.dll533__set_app_type
MSVCR110D.dll470__getmainargs
MSVCR110D.dll578_amsg_exit
MSVCR110D.dll401_XcptFilter
MSVCR110D.dll112public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR110D.dll349_CRT_RTC_INITW
MSVCR110D.dll1115_onexit
MSVCR110D.dll462__dllonexit
MSVCR110D.dll600_calloc_dbg
MSVCR110D.dll354_CrtDbgReportW
MSVCR110D.dll1313_unlock
MSVCR110D.dll947_lock
MSVCR110D.dll410__CxxFrameHandler3
MSVCR110D.dll381_CxxThrowException
MSVCR110D.dll1643memmove
MSVCR110D.dll1690strlen
MSVCR110D.dll1641memcpy
MSVCR110D.dll1653puts
MSVCR110D.dll115void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR110D.dll113void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR110D.dll1130_purecall
MSVCR110D.dll471__initenv
MSVCR110D.dll1588getchar
KERNEL32.dll279DecodePointer
KERNEL32.dll899IsDebuggerPresent
KERNEL32.dll1096RaiseException
KERNEL32.dll618GetLastError
KERNEL32.dll693GetProcAddress
KERNEL32.dll962LoadLibraryExW
KERNEL32.dll1564lstrlenA
KERNEL32.dll963LoadLibraryW
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll641GetModuleHandleW
KERNEL32.dll637GetModuleFileNameW
KERNEL32.dll440FreeLibrary
KERNEL32.dll1459VirtualQuery
KERNEL32.dll698GetProcessHeap
KERNEL32.dll849HeapFree
KERNEL32.dll845HeapAlloc
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll548GetCurrentProcessId
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll1501WideCharToMultiByte
KERNEL32.dll316EncodePointer
offsetsizetypecomment
061440EXE01/24/2016 01:14:46#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK