filenamelzip.exe
size809842 (0xc5b72)
md508335f18446372722645f2b94d844bee
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0x13
TimeDateStamp0x60300e96
PointerToSymbolTable0x7c800
NumberOfSymbols0x209b
SizeOfOptionalHeader0xf0
Characteristics0x26
Magic0x20b
LinkerVersion2.36
SizeOfCode0x38400
SizeOfInitializedData0x47a00
SizeOfUninitializedData0x1a00
AddressOfEntryPoint0x14e0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x89000
SizeOfHeaders0x600
CheckSum0xcef2d
Subsystem3
DllCharacteristics0x160
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x383200x38400R-X CODE IDATA
.data0x3a0000x5200x600RW- IDATA
.rdata0x3b0000x6fa00x7000R-- IDATA
.pdata0x420000x2eb00x3000R-- IDATA
.xdata0x450000x2da00x2e00R-- IDATA
.bss0x480000x19400RW- UDATA
.idata0x4a0000x10d40x1200RW- IDATA
.CRT0x4c0000x700x200RW- IDATA
.tls0x4d0000x100x200RW- IDATA
.rsrc0x4e0000x4e80x600RW- IDATA
.reloc0x4f0000x4640x600R-- IDATA DISCARDABLE
/40x500000x7400x800R-- IDATA DISCARDABLE
/190x510000x12dc80x12e00R-- IDATA DISCARDABLE
/310x640000x33b70x3400R-- IDATA DISCARDABLE
/450x680000x80ea0x8200R-- IDATA DISCARDABLE
/570x710000x18580x1a00R-- IDATA DISCARDABLE
/700x730000x8570xa00R-- IDATA DISCARDABLE
/810x740000x120650x12200R-- IDATA DISCARDABLE
/920x870000x15800x1600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x4a0000x10d4
RESOURCE0x4e0000x4e8
EXCEPTION0x420000x2eb0
SECURITY00
BASERELOC0x4f0000x464
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x3f4800x28
LOAD_CONFIG00
Bound_IAT00
IAT0x4a3fc0x3c0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x14004d0000x14004d0080x140048d6c0x14004c04000
typenamesizecp
MANIFEST#111670
module_namehintordfunction_name
KERNEL32.dll20AddVectoredExceptionHandler
KERNEL32.dll141CloseHandle
KERNEL32.dll197CreateEventA
KERNEL32.dll243CreateSemaphoreA
KERNEL32.dll283DeleteCriticalSection
KERNEL32.dll313DuplicateHandle
KERNEL32.dll319EnterCriticalSection
KERNEL32.dll552GetCurrentProcess
KERNEL32.dll553GetCurrentProcessId
KERNEL32.dll556GetCurrentThread
KERNEL32.dll557GetCurrentThreadId
KERNEL32.dll627GetHandleInformation
KERNEL32.dll630GetLastError
KERNEL32.dll654GetModuleHandleW
KERNEL32.dll710GetProcAddress
KERNEL32.dll711GetProcessAffinityMask
KERNEL32.dll743GetStartupInfoA
KERNEL32.dll769GetSystemTimeAsFileTime
KERNEL32.dll783GetThreadContext
KERNEL32.dll793GetThreadPriority
KERNEL32.dll800GetTickCount64
KERNEL32.dll892InitializeCriticalSection
KERNEL32.dll919IsDBCSLeadByteEx
KERNEL32.dll920IsDebuggerPresent
KERNEL32.dll984LeaveCriticalSection
KERNEL32.dll991LoadLibraryW
KERNEL32.dll1036MultiByteToWideChar
KERNEL32.dll1069OpenProcess
KERNEL32.dll1078OutputDebugStringA
KERNEL32.dll1153RaiseException
KERNEL32.dll1196ReleaseSemaphore
KERNEL32.dll1207RemoveVectoredExceptionHandler
KERNEL32.dll1214ResetEvent
KERNEL32.dll1221ResumeThread
KERNEL32.dll1223RtlCaptureContext
KERNEL32.dll1230RtlLookupFunctionEntry
KERNEL32.dll1236RtlUnwindEx
KERNEL32.dll1237RtlVirtualUnwind
KERNEL32.dll1306SetEvent
KERNEL32.dll1334SetLastError
KERNEL32.dll1345SetProcessAffinityMask
KERNEL32.dll1368SetThreadContext
KERNEL32.dll1378SetThreadPriority
KERNEL32.dll1394SetUnhandledExceptionFilter
KERNEL32.dll1410Sleep
KERNEL32.dll1418SuspendThread
KERNEL32.dll1443TlsAlloc
KERNEL32.dll1445TlsGetValue
KERNEL32.dll1446TlsSetValue
KERNEL32.dll1452TryEnterCriticalSection
KERNEL32.dll1492VirtualProtect
KERNEL32.dll1494VirtualQuery
KERNEL32.dll1501WaitForMultipleObjects
KERNEL32.dll1503WaitForSingleObject
KERNEL32.dll1547WideCharToMultiByte
msvcrt.dll56__C_specific_handler
msvcrt.dll64___lc_codepage_func
msvcrt.dll67___mb_cur_max_func
msvcrt.dll82__getmainargs
msvcrt.dll83__initenv
msvcrt.dll84__iob_func
msvcrt.dll92__lconv_init
msvcrt.dll98__set_app_type
msvcrt.dll100__setusermatherr
msvcrt.dll116_acmdln
msvcrt.dll124_amsg_exit
msvcrt.dll138_beginthreadex
msvcrt.dll142_cexit
msvcrt.dll156_close
msvcrt.dll158_commode
msvcrt.dll200_endthreadex
msvcrt.dll203_errno
msvcrt.dll255_fmode
msvcrt.dll273_fstat64
msvcrt.dll331_initterm
msvcrt.dll335_isatty
msvcrt.dll443_lock
msvcrt.dll454_lseeki64
msvcrt.dll615_onexit
msvcrt.dll619_open
msvcrt.dll641_read
msvcrt.dll670_setjmp
msvcrt.dll675_setmode
msvcrt.dll728_strdup
msvcrt.dll810_ultoa
msvcrt.dll819_unlock
msvcrt.dll833_utime64
msvcrt.dll985_write
msvcrt.dll1038abort
msvcrt.dll1055calloc
msvcrt.dll1068exit
msvcrt.dll1075fflush
msvcrt.dll1088fprintf
msvcrt.dll1090fputc
msvcrt.dll1091fputs
msvcrt.dll1095free
msvcrt.dll1109fwrite
msvcrt.dll1128isprint
msvcrt.dll1149localeconv
msvcrt.dll1155longjmp
msvcrt.dll1156malloc
msvcrt.dll1162memchr
msvcrt.dll1163memcmp
msvcrt.dll1164memcpy
msvcrt.dll1165memmove
msvcrt.dll1166memset
msvcrt.dll1174printf
msvcrt.dll1186remove
msvcrt.dll1185realloc
msvcrt.dll1196signal
msvcrt.dll1212strcmp
msvcrt.dll1217strerror
msvcrt.dll1219strlen
msvcrt.dll1222strncmp
msvcrt.dll1233strtol
msvcrt.dll1234strtoul
msvcrt.dll1258vfprintf
msvcrt.dll1283wcslen
offsetsizetypecomment
0809842EXE02/19/2021 19:16:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x48d6c