filenametest10.exe
size99840 (0x18600)
md50c877501abf64693d4f39e7e56ec70eb
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
147307292
149307291
1313072917
123507275
1073
132307299
148210221
15101
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x4f1849ba
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x5200
SizeOfInitializedData0x13800
SizeOfUninitializedData0
AddressOfEntryPoint0x1c70
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x1e000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x502b0x5200R-X CODE
.rdata0x70000x22d30x2400R-- IDATA
.data0xa0000x9580x200RW- IDATA
.pdata0xb0000x4d40x600R-- IDATA
.idata0xc0000xe420x1000RW- IDATA
.rsrc0xd0000xf0860xf200R-- IDATA
.reloc0x1d0000x1ae0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xc0000x50
RESOURCE0xd0000xf086
EXCEPTION0xb0000x354
SECURITY00
BASERELOC0x1d0000x50
DEBUG0x77700x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xc4080x3b8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#22960
ICON#337520
ICON#422160
ICON#513840
ICON#696400
ICON#742640
ICON#811280
ICON#97440
ICON#102960
ICON#1137520
ICON#1222160
ICON#1313840
ICON#1496400
ICON#1542640
ICON#1611280
MENU#109740
DIALOG#1033000
STRING#7560
ACCELERATORS#109160
GROUP_ICON#1071180
GROUP_ICON#1081180
MANIFEST#16650
idlangstring
1031033test10
1091033TEST10
module_namehintordfunction_name
USER32.dll211EndDialog
USER32.dll166DialogBoxParamW
USER32.dll160DestroyWindow
USER32.dll150DefWindowProcW
USER32.dll14BeginPaint
USER32.dll213EndPaint
USER32.dll548PostQuitMessage
USER32.dll104CreateWindowExW
USER32.dll704ShowWindow
USER32.dll753UpdateWindow
USER32.dll475LoadIconW
USER32.dll473LoadCursorW
USER32.dll569RegisterClassExW
USER32.dll488LoadStringW
USER32.dll467LoadAcceleratorsW
USER32.dll336GetMessageW
USER32.dll731TranslateAcceleratorW
USER32.dll733TranslateMessage
USER32.dll169DispatchMessageW
MSVCR90D.dll122__C_specific_handler
MSVCR90D.dll118_XcptFilter
MSVCR90D.dll376_exit
MSVCR90D.dll293_cexit
MSVCR90D.dll1234exit
MSVCR90D.dll1059_wcmdln
MSVCR90D.dll94_CrtSetCheckCount
MSVCR90D.dll77_CrtDbgReportW
MSVCR90D.dll518_initterm
MSVCR90D.dll519_initterm_e
MSVCR90D.dll164__crt_debugger_hook
MSVCR90D.dll68void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90D.dll991_unlock
MSVCR90D.dll166__dllonexit
MSVCR90D.dll628_lock
MSVCR90D.dll797_onexit
MSVCR90D.dll350_decode_pointer
MSVCR90D.dll270_amsg_exit
MSVCR90D.dll224__set_app_type
MSVCR90D.dll361_encode_pointer
MSVCR90D.dll405_fmode
MSVCR90D.dll310_commode
MSVCR90D.dll227__setusermatherr
MSVCR90D.dll311_configthreadlocale
MSVCR90D.dll72_CRT_RTC_INITW
MSVCR90D.dll247__wgetmainargs
KERNEL32.dll333FreeLibrary
KERNEL32.dll1120VirtualQuery
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll547GetProcessHeap
KERNEL32.dll669HeapAlloc
KERNEL32.dll673HeapFree
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll846QueryPerformanceCounter
KERNEL32.dll905RtlCaptureContext
KERNEL32.dll912RtlLookupFunctionEntry
KERNEL32.dll919RtlVirtualUnwind
KERNEL32.dll1049SetUnhandledExceptionFilter
KERNEL32.dll1090UnhandledExceptionFilter
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1073TerminateProcess
KERNEL32.dll747LoadLibraryA
KERNEL32.dll1213lstrlenA
KERNEL32.dll788MultiByteToWideChar
KERNEL32.dll1150WideCharToMultiByte
KERNEL32.dll181DebugBreak
KERNEL32.dll852RaiseException
KERNEL32.dll715IsDebuggerPresent
KERNEL32.dll570GetStartupInfoW
KERNEL32.dll1061Sleep
KERNEL32.dll544GetProcAddress
offsetsizetypecomment
15c115HTM#
15d094256BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK