test

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	test
size	162304 (0x27a00)
md5	081ec797ad5b949920696c3cf045181b

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x78
blocks_in_file	1
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0
ss	0
sp	0
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x78

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 24 00 00                           |mode.$..        |

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x649fb162
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x20000
SizeOfInitializedData	0x7600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1520
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x2e000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x1000000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1fec6	0x20000	R-X CODE
.rdata	0x21000	0x54fc	0x5600	R-- IDATA
.buildid	0x27000	0x3d	0x200	R-- IDATA
.data	0x28000	0x1b40	0x200	RW- IDATA
.pdata	0x2a000	0x1770	0x1800	R-- IDATA
.tls	0x2c000	0x10	0x200	RW- IDATA
.reloc	0x2d000	0x78	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x24468	0x3c
RESOURCE	0	0
EXCEPTION	0x2a000	0x1770
SECURITY	0	0
BASERELOC	0x2d000	0x78
DEBUG	0x27000	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x21108	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x24640	0x198
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x14002c000	0x14002c008	0x1400280f0	0x140024430	0	0x400000

module_name	hint	ord	function_name
KERNEL32.dll			DeleteCriticalSection
KERNEL32.dll			EnterCriticalSection
KERNEL32.dll			ExitProcess
KERNEL32.dll			GetLastError
KERNEL32.dll			GetStartupInfoA
KERNEL32.dll			InitializeCriticalSection
KERNEL32.dll			IsDBCSLeadByteEx
KERNEL32.dll			LeaveCriticalSection
KERNEL32.dll			MultiByteToWideChar
KERNEL32.dll			SetUnhandledExceptionFilter
KERNEL32.dll			Sleep
KERNEL32.dll			TlsGetValue
KERNEL32.dll			VirtualProtect
KERNEL32.dll			VirtualQuery
KERNEL32.dll			WideCharToMultiByte
KERNEL32.dll			__C_specific_handler
msvcrt.dll			___lc_codepage_func
msvcrt.dll			___mb_cur_max_func
msvcrt.dll			__getmainargs
msvcrt.dll			__initenv
msvcrt.dll			__iob_func
msvcrt.dll			__set_app_type
msvcrt.dll			__setusermatherr
msvcrt.dll			_acmdln
msvcrt.dll			_amsg_exit
msvcrt.dll			_cexit
msvcrt.dll			_commode
msvcrt.dll			_errno
msvcrt.dll			_fmode
msvcrt.dll			_initterm
msvcrt.dll			_lock
msvcrt.dll			_onexit
msvcrt.dll			_unlock
msvcrt.dll			abort
msvcrt.dll			calloc
msvcrt.dll			exit
msvcrt.dll			fprintf
msvcrt.dll			fputc
msvcrt.dll			free
msvcrt.dll			fwrite
msvcrt.dll			localeconv
msvcrt.dll			malloc
msvcrt.dll			signal
msvcrt.dll			strerror
msvcrt.dll			strlen
msvcrt.dll			strncmp
msvcrt.dll			strncpy
msvcrt.dll			vfprintf
msvcrt.dll			wcslen

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	156720	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK