filenametwunk_32.exe
size31232 (0x7a00)
md50bd6e68f3ea0dd62cd86283d86895381
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307291
1313072919
147307299
1095
1323072911
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bcdf0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x6200
SizeOfInitializedData0x1600
SizeOfUninitializedData0
AddressOfEntryPoint0x63e5
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0x8398
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x608e0x6200R-X CODE
.data0x80000x3d00x200RW- IDATA
.rsrc0x90000x9d80xa00R-- IDATA
.reloc0xa0000x6980x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x690c0x64
RESOURCE0x90000x9d8
EXCEPTION00
SECURITY00
BASERELOC0xa0000x4ec
DEBUG0x11900x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x33200x40
Bound_IAT0x2780x58
IAT0x10000x168
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
GROUP_ICONTWUNK_ICON200
VERSION#16960
MANIFEST#17170
module_namehintordfunction_name
KERNEL32.dll691GlobalAlloc
KERNEL32.dll698GlobalFree
KERNEL32.dll697GlobalFlags
KERNEL32.dll702GlobalLock
KERNEL32.dll514GetLastError
KERNEL32.dll709GlobalUnlock
KERNEL32.dll674GetVersion
KERNEL32.dll1345lstrcmpA
KERNEL32.dll581GetProcAddress
KERNEL32.dll354FreeLibrary
KERNEL32.dll828LoadLibraryA
KERNEL32.dll600GetProfileIntA
KERNEL32.dll723HeapSetInformation
KERNEL32.dll644GetTempPathA
KERNEL32.dll706GlobalSize
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll1235UnhandledExceptionFilter
GDI32.dll525GetStockObject
USER32.dll735ShowWindow
USER32.dll345GetMessageA
USER32.dll174DispatchMessageA
USER32.dll764TranslateMessage
USER32.dll565PostMessageA
USER32.dll610RegisterWindowMessageA
USER32.dll122DdeCreateDataHandle
USER32.dll123DdeCreateStringHandleA
USER32.dll129DdeFreeStringHandle
USER32.dll131DdeGetLastError
USER32.dll134DdeInitializeA
USER32.dll147DdeUninitialize
USER32.dll138DdePostAdvise
USER32.dll492LoadIconA
USER32.dll119DdeCmpStringHandles
USER32.dll130DdeGetData
USER32.dll137DdeNameService
USER32.dll125DdeDisconnect
USER32.dll567PostQuitMessage
USER32.dll155DefWindowProcA
USER32.dll39ChangeMenuA
USER32.dll381GetSystemMenu
USER32.dll109CreateWindowExA
USER32.dll587RegisterClassA
USER32.dll488LoadCursorA
USER32.dll562PeekMessageA
msvcrt.dll145__getmainargs
msvcrt.dll1292sprintf_s
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll500_ismbblead
msvcrt.dll1167exit
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll345_except_handler4_common
msvcrt.dll295_controlfp
msvcrt.dll1303strcpy_s
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1280remove
msvcrt.dll291_close
msvcrt.dll1298strcat_s
msvcrt.dll1096_write
msvcrt.dll579_locking
msvcrt.dll586_lseek
msvcrt.dll772_read
msvcrt.dll833_sopen
msvcrt.dll342_errno
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll276_cexit
msvcrt.dll1258memcpy

StringTable 040904b4

CompanyNameTwain Working Group
FileDescriptionTwain.dll Client's 32-Bit Thunking Server
FileVersion1,7,1,0
InternalNameTwunk_32
OriginalFilenameTwunk_32.exe
ProductNameTwain Thunker
ProductVersion1,7,1,0

VS_FIXEDFILEINFO

FileVersion1.7.1.0
ProductVersion1.7.1.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x10001
FileType1
FileSubtype0
offsetsizetypecomment
031232EXE07/14/2009 00:14:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278