filenamemingw32-make.exe
size197120 (0x30200)
md5070ca3b2ee6fc133dab9fc1d76bd5156
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x4d3b562a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.21
SizeOfCode0x27e00
SizeOfInitializedData0x2fe00
SizeOfUninitializedData0x1e00
AddressOfEntryPoint0x1160
BaseOfCode0x1000
BaseOfData0x29000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x36000
SizeOfHeaders0x400
CheckSum0x3062c
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x27c800x27e00R-X CODE IDATA
.data0x290000x8f40xa00RW- IDATA
.rdata0x2a0000x5ec00x6000R-- IDATA
.eh_fram0x300000xdc0x200RW- IDATA
.bss0x310000x1c700RW- UDATA
.idata0x330000xf8c0x1000RW- IDATA
.CRT0x340000x180x200RW- IDATA
.tls0x350000x200x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x330000xf8c
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x350000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x332e40x258
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4350190x43501c0x4321600x43400400
module_namehintordfunction_name
ADVAPI32.DLL254InitializeSecurityDescriptor
libintl-8.dll__printf__
libintl-8.dll24libintl_bindtextdomain
libintl-8.dll30libintl_fprintf
libintl-8.dll32libintl_gettext
libintl-8.dll60libintl_sprintf
libintl-8.dll62libintl_textdomain
libintl-8.dll66libintl_vfprintf
KERNEL32.dll82CloseHandle
KERNEL32.dll135CreateFileA
KERNEL32.dll160CreatePipe
KERNEL32.dll163CreateProcessA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll230DuplicateHandle
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll347FormatMessageA
KERNEL32.dll352FreeLibrary
KERNEL32.dll388GetCommandLineA
KERNEL32.dll444GetCurrentDirectoryA
KERNEL32.dll446GetCurrentProcess
KERNEL32.dll447GetCurrentProcessId
KERNEL32.dll450GetCurrentThread
KERNEL32.dll477GetExitCodeProcess
KERNEL32.dll481GetFileAttributesA
KERNEL32.dll510GetLastError
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll606GetStartupInfoA
KERNEL32.dll608GetStdHandle
KERNEL32.dll640GetTempPathA
KERNEL32.dll673GetVolumeInformationA
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll744InterlockedExchange
KERNEL32.dll763IsDBCSLeadByteEx
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll817LoadLibraryA
KERNEL32.dll860MultiByteToWideChar
KERNEL32.dll947ReadFile
KERNEL32.dll1004SearchPathA
KERNEL32.dll1088SetHandleInformation
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1160SuspendThread
KERNEL32.dll1166TerminateProcess
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1221WaitForMultipleObjects
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1247WideCharToMultiByte
KERNEL32.dll1267WriteFile
msvcrt.dll2_chdir
msvcrt.dll6_close
msvcrt.dll23_fdopen
msvcrt.dll32_fstat
msvcrt.dll37_getcwd
msvcrt.dll51_lseek
msvcrt.dll56_mktemp
msvcrt.dll58_open
msvcrt.dll62_putenv
msvcrt.dll64_read
msvcrt.dll78_stat
msvcrt.dll80_strdup
msvcrt.dll84_strnicmp
msvcrt.dll97_unlink
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll61__lc_codepage
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll137_assert
msvcrt.dll143_beginthreadex
msvcrt.dll147_cexit
msvcrt.dll179_endthreadex
msvcrt.dll182_errno
msvcrt.dll197_fdopen
msvcrt.dll205_findclose
msvcrt.dll206_findfirst
msvcrt.dll209_findnext
msvcrt.dll213_flsbuf
msvcrt.dll228_fullpath
msvcrt.dll266_iob
msvcrt.dll268_isctype
msvcrt.dll383_onexit
msvcrt.dll385_open_osfhandle
msvcrt.dll392_pctype
msvcrt.dll426_setmode
msvcrt.dll451_stricmp
msvcrt.dll452_stricoll
msvcrt.dll455_strnicmp
msvcrt.dll538_winmajor
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll591atof
msvcrt.dll592atoi
msvcrt.dll593atol
msvcrt.dll595calloc
msvcrt.dll601ctime
msvcrt.dll604exit
msvcrt.dll607fclose
msvcrt.dll610fflush
msvcrt.dll613fgets
msvcrt.dll618fopen
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll624fread
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll671localeconv
msvcrt.dll672localtime
msvcrt.dll676malloc
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll692puts
msvcrt.dll695qsort
msvcrt.dll698realloc
msvcrt.dll699remove
msvcrt.dll704setlocale
msvcrt.dll705setvbuf
msvcrt.dll706signal
msvcrt.dll712sscanf
msvcrt.dll714strchr
msvcrt.dll715strcmp
msvcrt.dll716strcoll
msvcrt.dll717strcpy
msvcrt.dll719strerror
msvcrt.dll721strlen
msvcrt.dll723strncmp
msvcrt.dll724strncpy
msvcrt.dll725strpbrk
msvcrt.dll726strrchr
msvcrt.dll728strstr
msvcrt.dll730strtok
msvcrt.dll739time
msvcrt.dll742tolower
msvcrt.dll748vfprintf
msvcrt.dll761wcslen
USER32.dll638wsprintfA
offsetsizetypecomment
0197120EXE01/22/2011 22:11:54#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x32160