ReadPeFile.exe - ReadPeFile

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ReadPeFile.exe
size	273408 (0x42c00)
md5	0abd1812f1c7f7025d0c85b87585b009

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
241	40116	10
243	40116	154
242	40116	24
257	23406	2
259	23406	23
261	23406	42
260	23406	19
206	65501	2
208	65501	1
203	65501	11
1	0	136
265	23506	3
255	23506	1
151	0	1
258	23506	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x56b5bf1d
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	14.0
SizeOfCode	0x24e00
SizeOfInitializedData	0x1e400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x8ed2
BaseOfCode	0x1000
BaseOfData	0x26000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x47000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x24c9e	0x24e00	R-X CODE
.rdata	0x26000	0xbb24	0xbc00	R-- IDATA
.data	0x32000	0x157c	0xc00	RW- IDATA
.gfids	0x34000	0x12c	0x200	R-- IDATA
.tls	0x35000	0xd	0x200	RW- IDATA
.rsrc	0x36000	0x10db8	0x10e00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x30f4c	0x8c
RESOURCE	0x36000	0x10db8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x2fd40	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x2fdd4	0x18
LOAD_CONFIG	0x2fd78	0x40
Bound_IAT	0	0
IAT	0x26000	0x200
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x435000	0x43500c	0x433564	0x426234	0	0x300000

show previews

type	name	size
ICON	#1	67624
GROUP_ICON	#102	20
VERSION	#1	712
MANIFEST	#1	381

module_name	hint	function_name
KERNEL32.dll	698	GetShortPathNameA
KERNEL32.dll	602	GetLongPathNameA
KERNEL32.dll	568	GetFileInformationByHandleEx
KERNEL32.dll	573	GetFileTime
KERNEL32.dll	349	FileTimeToSystemTime
KERNEL32.dll	1374	SystemTimeToTzSpecificLocalTime
KERNEL32.dll	560	GetFileAttributesA
KERNEL32.dll	582	GetFullPathNameA
KERNEL32.dll	736	GetTempFileNameA
KERNEL32.dll	1245	SetConsoleTitleA
KERNEL32.dll	505	GetConsoleWindow
KERNEL32.dll	1277	SetFilePointerEx
KERNEL32.dll	254	DecodePointer
KERNEL32.dll	1258	SetEndOfFile
KERNEL32.dll	822	HeapReAlloc
KERNEL32.dll	1104	ReadFile
KERNEL32.dll	977	MultiByteToWideChar
KERNEL32.dll	521	GetCurrentProcess
KERNEL32.dll	669	GetProcAddress
KERNEL32.dll	612	GetModuleHandleA
KERNEL32.dll	1413	UnmapViewOfFile
KERNEL32.dll	960	MapViewOfFile
KERNEL32.dll	187	CreateFileMappingA
KERNEL32.dll	127	CloseHandle
KERNEL32.dll	572	GetFileSizeEx
KERNEL32.dll	738	GetTempPathA
KERNEL32.dll	186	CreateFileA
KERNEL32.dll	824	HeapSize
KERNEL32.dll	194	CreateFileW
KERNEL32.dll	1504	WriteConsoleW
KERNEL32.dll	761	GetTimeZoneInformation
KERNEL32.dll	1102	ReadConsoleW
KERNEL32.dll	674	GetProcessHeap
KERNEL32.dll	1410	UnhandledExceptionFilter
KERNEL32.dll	1347	SetUnhandledExceptionFilter
KERNEL32.dll	1377	TerminateProcess
KERNEL32.dll	877	IsProcessorFeaturePresent
KERNEL32.dll	1069	QueryPerformanceCounter
KERNEL32.dll	522	GetCurrentProcessId
KERNEL32.dll	526	GetCurrentThreadId
KERNEL32.dll	726	GetSystemTimeAsFileTime
KERNEL32.dll	843	InitializeSListHead
KERNEL32.dll	871	IsDebuggerPresent
KERNEL32.dll	702	GetStartupInfoW
KERNEL32.dll	615	GetModuleHandleW
KERNEL32.dll	289	EncodePointer
KERNEL32.dll	592	GetLastError
KERNEL32.dll	611	GetModuleFileNameW
KERNEL32.dll	1088	RaiseException
KERNEL32.dll	1291	SetLastError
KERNEL32.dll	1197	RtlUnwind
KERNEL32.dll	840	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1395	TlsAlloc
KERNEL32.dll	1397	TlsGetValue
KERNEL32.dll	1398	TlsSetValue
KERNEL32.dll	1396	TlsFree
KERNEL32.dll	414	FreeLibrary
KERNEL32.dll	935	LoadLibraryExW
KERNEL32.dll	293	EnterCriticalSection
KERNEL32.dll	930	LeaveCriticalSection
KERNEL32.dll	261	DeleteCriticalSection
KERNEL32.dll	287	DuplicateHandle
KERNEL32.dll	704	GetStdHandle
KERNEL32.dll	1505	WriteFile
KERNEL32.dll	610	GetModuleFileNameA
KERNEL32.dll	1485	WideCharToMultiByte
KERNEL32.dll	337	ExitProcess
KERNEL32.dll	614	GetModuleHandleExW
KERNEL32.dll	456	GetCommandLineA
KERNEL32.dll	457	GetCommandLineW
KERNEL32.dll	420	GetACP
KERNEL32.dll	819	HeapFree
KERNEL32.dll	815	HeapAlloc
KERNEL32.dll	574	GetFileType
KERNEL32.dll	147	CompareStringW
KERNEL32.dll	918	LCMapStringW
KERNEL32.dll	596	GetLocaleInfoW
KERNEL32.dll	884	IsValidLocale
KERNEL32.dll	764	GetUserDefaultLCID
KERNEL32.dll	327	EnumSystemLocalesW
KERNEL32.dll	1451	WaitForSingleObject
KERNEL32.dll	556	GetExitCodeProcess
KERNEL32.dll	215	CreateProcessA
KERNEL32.dll	562	GetFileAttributesExW
KERNEL32.dll	709	GetStringTypeW
KERNEL32.dll	402	FlushFileBuffers
KERNEL32.dll	476	GetConsoleCP
KERNEL32.dll	494	GetConsoleMode
KERNEL32.dll	1314	SetStdHandle
KERNEL32.dll	360	FindClose
KERNEL32.dll	365	FindFirstFileExA
KERNEL32.dll	381	FindNextFileA
KERNEL32.dll	882	IsValidCodePage
KERNEL32.dll	646	GetOEMCP
KERNEL32.dll	435	GetCPInfo
KERNEL32.dll	551	GetEnvironmentStringsW
KERNEL32.dll	413	FreeEnvironmentStringsW
KERNEL32.dll	1261	SetEnvironmentVariableA
USER32.dll	582	MessageBoxA
USER32.dll	546	LoadIconA
USER32.dll	695	SendMessageA
ADVAPI32.dll	198	CryptDestroyHash
ADVAPI32.dll	212	CryptGetHashParam
ADVAPI32.dll	216	CryptHashData
ADVAPI32.dll	195	CryptCreateHash
ADVAPI32.dll	192	CryptAcquireContextA
ADVAPI32.dll	673	RegSetValueExA
ADVAPI32.dll	609	RegDeleteKeyA
ADVAPI32.dll	596	RegCloseKey
ADVAPI32.dll	657	RegQueryValueExA
ADVAPI32.dll	603	RegCreateKeyA
ADVAPI32.dll	794	SystemFunction036
ADVAPI32.dll	219	CryptReleaseContext
SHELL32.dll	307	ShellExecuteA
SHELL32.dll	199	SHGetFileInfoA
ole32.dll	79	CoInitialize
ole32.dll	127	CoUninitialize
ole32.dll	442	StringFromGUID2
ole32.dll	26	CoCreateInstance
VCOMP140.DLL	67	_vcomp_fork
VCOMP140.DLL	65	_vcomp_for_static_simple_init
VCOMP140.DLL	62	_vcomp_for_static_end

StringTable 080404b0

CompanyName	Paschen
FileDescription	ReadPeFile
FileVersion	1.0.0.1
InternalName	ReadPeFile.exe
LegalCopyright	Copyright (C) Paschen
OriginalFilename	ReadPeFile.exe
ProductName	ReadPeFile.exe
ProductVersion	1.0.0.1

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	273408	EXE	02/06/2016 09:38:37	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x33564

ReadPeFile.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 080404b0

VS_FIXEDFILEINFO

ReadPeFile.exe
-