filenamebiopsyHypodermicQT.exe
size268288 (0x41800)
md506c925065dbacdbc031e2d4c743a07fc
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
185307162
205506281
2065062819
1069
203506285
207506287
207507275
202507271
204507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x51af7ed3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x3f600
SizeOfInitializedData0x2200
SizeOfUninitializedData0
AddressOfEntryPoint0x3fb30
BaseOfCode0x1000
BaseOfData0x41000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x45000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x3f56f0x3f600R-X CODE
.rdata0x410000x12d80x1400R-- IDATA
.data0x430000x46c0x200RW- IDATA
.reloc0x440000x6be0x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x422600x78
IMPORT0x41bbc0x50
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x440000x3a4
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x417c00x40
Bound_IAT00
IAT0x410000x120
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
MSVCP110D.dll734char const * __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAPBDH@Z

MSVCP110D.dll713char const * __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPBDH@Z

MSVCP110D.dll118public: __thiscall std::locale::id::id(unsigned int)

??0id@locale@std@@QAE@I@Z

MSVCP110D.dll742void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

MSVCP110D.dll741void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP110D.dll738void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP110D.dll654public: void __thiscall std::_Container_base12::_Orphan_all(void)

?_Orphan_all@_Container_base12@std@@QAEXXZ

MSVCP110D.dll160public: __thiscall std::_Container_base12::~_Container_base12(void)

??1_Container_base12@std@@QAE@XZ

MSVCP110D.dll94public: __thiscall std::_Container_base12::_Container_base12(void)

??0_Container_base12@std@@QAE@XZ

MSVCP110D.dll457void __cdecl std::_Debug_message(wchar_t const *, wchar_t const *, unsigned int)

?_Debug_message@std@@YAXPB_W0I@Z

MSVCR110D.dll1568fwrite
MSVCR110D.dll931_lock
MSVCR110D.dll1297_unlock
MSVCR110D.dll354_CrtDbgReportW
MSVCR110D.dll584_calloc_dbg
MSVCR110D.dll446__dllonexit
MSVCR110D.dll1099_onexit
MSVCR110D.dll112public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR110D.dll401_XcptFilter
MSVCR110D.dll562_amsg_exit
MSVCR110D.dll1549fprintf
MSVCR110D.dll517__set_app_type
MSVCR110D.dll371_CrtSetCheckCount
MSVCR110D.dll668_exit
MSVCR110D.dll585_cexit
MSVCR110D.dll603_configthreadlocale
MSVCR110D.dll519__setusermatherr
MSVCR110D.dll808_initterm_e
MSVCR110D.dll807_initterm
MSVCR110D.dll455__initenv
MSVCR110D.dll696_fmode
MSVCR110D.dll602_commode
MSVCR110D.dll659_except_handler4_common
MSVCR110D.dll621_crt_debugger_hook
MSVCR110D.dll444__crtUnhandledException
MSVCR110D.dll443__crtTerminateProcess
MSVCR110D.dll317void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR110D.dll442__crtSetUnhandledExceptionFilter
MSVCR110D.dll813_invoke_watson
MSVCR110D.dll606_controlfp_s
MSVCR110D.dll1547fopen
MSVCR110D.dll456__iob_func
MSVCR110D.dll1533exit
MSVCR110D.dll1629memset
MSVCR110D.dll410__CxxFrameHandler3
MSVCR110D.dll381_CxxThrowException
MSVCR110D.dll1627memmove
MSVCR110D.dll1674strlen
MSVCR110D.dll1625memcpy
MSVCR110D.dll1557free
MSVCR110D.dll1633printf
MSVCR110D.dll115void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR110D.dll113void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR110D.dll1114_purecall
MSVCR110D.dll454__getmainargs
KERNEL32.dll638GetModuleHandleA
KERNEL32.dll693GetProcAddress
KERNEL32.dll960LoadLibraryA
KERNEL32.dll1375Sleep
KERNEL32.dll1457VirtualProtect
KERNEL32.dll316EncodePointer
KERNEL32.dll279DecodePointer
KERNEL32.dll899IsDebuggerPresent
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll785GetTickCount64
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll1451VirtualAlloc
ordentry_vafunction_name
10x1000?LoadExecutable@@YAKPBEPAU_ExecutableInfo@@K@Z
module_namebiopsyHypodermicQT.exe
flags0
timestamp2013-06-05 18:09:23
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x4228c
Functions(1)0x42288
NameOrdinals(1)0x42290
offsetsizetypecomment
0268288EXE06/05/2013 18:09:23#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK