MZ Header

Rich Header

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Packer / Compiler

Sections

Data Directory

No certificates in

#<struct PEdump::WIN_CERTIFICATE dwLength=3126010091, wRevision=50559, wCertificateType=12315, data=nil>

Cannot call to_der on

#<struct PEdump::WIN_CERTIFICATE dwLength=3126010091, wRevision=50559, wCertificateType=12315, data=nil>
offsetsizetypecomment
041216EXE06/25/2015 13:30:15#
a10050122BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

[?] cannot find rich_hdr start_idx, using heuristics

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: 18434 entries in directory, but got EOF on 7288-th.

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 33039

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 83727

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 73999

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 60687

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 70927

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61711

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 38159

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 38671

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 49423

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 88335

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 37647

[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "\r\xD8" followed by "q@" on UTF-16LE

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 19727

[?] too many errors getting resource data, stopped on 325 of 7288

[?] can't find file_offset of VA 0x8400

[?] can't find file_offset of VA 0xb32d2b1

[?] can't find file_offset of VA 0xdd53afa0

[?] can't find file_offset of VA 0x814d81ab

[?] can't find file_offset of VA 0x3aa134c4

[?] can't find file_offset of VA 0xdedab2bb

[?] can't find file_offset of VA 0x73007900

[?] can't find file_offset of VA 0x3039c5a7

[?] can't find file_offset of VA 0xf5820810

[?] can't find file_offset of VA 0xc4ae5ad1

[?] can't find file_offset of VA 0x483c5944

[?] can't find file_offset of VA 0x404d9059

[?] can't find file_offset of VA 0xb3c14798

[?] can't find file_offset of VA 0xf9f3ffff

[?] can't find file_offset of VA 0x1df8377f

[?] can't find file_offset of VA 0x176ca18b

[?] can't find file_offset of VA 0x9be95adb

[?] can't find file_offset of VA 0x90608c

[?] can't find file_offset of VA 0x100

[!] PEdump::WIN_CERTIFICATE: too big length 3126010091

[?] can't find file_offset of VA 0x100

[!] PEdump::WIN_CERTIFICATE: too big length 3126010091