filenamea.exe
size167481 (0x28e39)
md50c67723be078d0d3562170c9b1e1f3e4
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0x10
TimeDateStamp0x5f7d747e
PointerToSymbolTable0x25800
NumberOfSymbols0x27a
SizeOfOptionalHeader0xf0
Characteristics0x27
Magic0x20b
LinkerVersion2.34
SizeOfCode0x800
SizeOfInitializedData0x1e00
SizeOfUninitializedData0x200
AddressOfEntryPoint0x1000
BaseOfCode0x1000
ImageBase0x100400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x31000
SizeOfHeaders0x600
CheckSum0x2d9f6
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x6f80x800R-X CODE IDATA
.data0x20000x600x200RW- IDATA
.rdata0x30000x3500x400R-- IDATA
.buildid0x40000x350x200R-- IDATA
.pdata0x50000xcc0x200R-- IDATA
.xdata0x60000x700x200R-- IDATA
.bss0x70000x1a00RW- UDATA
.idata0x80000x25c0x400RW- IDATA
.rsrc0x90000x4e80x600RW- IDATA
/40xa0000x2300x400R-- IDATA DISCARDABLE
/190xb0000x1e4760x1e600R-- IDATA DISCARDABLE
/310x2a0000x18bd0x1a00R-- IDATA DISCARDABLE
/450x2c0000x1e6d0x2000R-- IDATA DISCARDABLE
/570x2e0000x2980x400R-- IDATA DISCARDABLE
/700x2f0000x3e40x400R-- IDATA DISCARDABLE
/810x300000x77f0x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x80000x25c
RESOURCE0x90000x4e8
EXCEPTION0x50000xcc
SECURITY00
BASERELOC00
DEBUG0x40000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x80bc0x80
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#111670
module_namehintordfunction_name
cygwin1.dll15__cxa_atexit
cygwin1.dll46__main
cygwin1.dll108_dll_crt0
cygwin1.dll115_impure_ptr
cygwin1.dll257calloc
cygwin1.dll373cygwin_detach_dll
cygwin1.dll375cygwin_internal
cygwin1.dll403dll_dllcrt0
cygwin1.dll579free
cygwin1.dll909malloc
cygwin1.dll1015posix_memalign
cygwin1.dll1170puts
cygwin1.dll1196realloc
KERNEL32.dll651GetModuleHandleA
offsetsizetypecomment
0167481EXE10/07/2020 07:55:42#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK