filenamex64Test.exe
size38912 (0x9800)
md50e0692527d8f5c6b9ce65c6b39e5b5fd
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
147210223
150204132
149210221
1312102216
132210229
123507272
1058
132307292
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x52de0de0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x4a00
SizeOfInitializedData0x5000
SizeOfUninitializedData0
AddressOfEntryPoint0x1460
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0xe000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x49830x4a00R-X CODE
.rdata0x60000x23a10x2400R-- IDATA
.data0x90000x8900x400RW- IDATA
.pdata0xa0000x4440x600R-- IDATA
.idata0xb0000xbc80xc00RW- IDATA
.rsrc0xc0000xc090xe00R-- IDATA
.reloc0xd0000x12c0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xb0000x3c
RESOURCE0xc0000xc09
EXCEPTION0xa0000x2d0
SECURITY00
BASERELOC0xd0000x58
DEBUG0x67700x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xb3180x2d8
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#16650
module_namehintordfunction_name
MSVCR90D.dll628_lock
MSVCR90D.dll166__dllonexit
MSVCR90D.dll350_decode_pointer
MSVCR90D.dll164__crt_debugger_hook
MSVCR90D.dll991_unlock
MSVCR90D.dll57public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR90D.dll68void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90D.dll519_initterm_e
MSVCR90D.dll518_initterm
MSVCR90D.dll77_CrtDbgReportW
MSVCR90D.dll94_CrtSetCheckCount
MSVCR90D.dll248__winitenv
MSVCR90D.dll1234exit
MSVCR90D.dll293_cexit
MSVCR90D.dll376_exit
MSVCR90D.dll118_XcptFilter
MSVCR90D.dll122__C_specific_handler
MSVCR90D.dll247__wgetmainargs
MSVCR90D.dll270_amsg_exit
MSVCR90D.dll224__set_app_type
MSVCR90D.dll361_encode_pointer
MSVCR90D.dll405_fmode
MSVCR90D.dll310_commode
MSVCR90D.dll227__setusermatherr
MSVCR90D.dll311_configthreadlocale
MSVCR90D.dll19void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

MSVCR90D.dll72_CRT_RTC_INITW
MSVCR90D.dll156__clean_type_info_names_internal
MSVCR90D.dll47public: char const * __ptr64 __cdecl type_info::_name_internal_method(struct __type_info_node * __ptr64)const __ptr64

?_name_internal_method@type_info@@QEBAPEBDPEAU__type_info_node@@@Z

MSVCR90D.dll797_onexit
MSVCR90D.dll1339printf
KERNEL32.dll912RtlLookupFunctionEntry
KERNEL32.dll919RtlVirtualUnwind
KERNEL32.dll1090UnhandledExceptionFilter
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1073TerminateProcess
KERNEL32.dll333FreeLibrary
KERNEL32.dll1120VirtualQuery
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll547GetProcessHeap
KERNEL32.dll669HeapAlloc
KERNEL32.dll673HeapFree
KERNEL32.dll747LoadLibraryA
KERNEL32.dll544GetProcAddress
KERNEL32.dll1213lstrlenA
KERNEL32.dll788MultiByteToWideChar
KERNEL32.dll1150WideCharToMultiByte
KERNEL32.dll181DebugBreak
KERNEL32.dll852RaiseException
KERNEL32.dll715IsDebuggerPresent
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll846QueryPerformanceCounter
KERNEL32.dll1049SetUnhandledExceptionFilter
KERNEL32.dll1061Sleep
KERNEL32.dll905RtlCaptureContext
offsetsizetypecomment
15c115HTM#
15d033328BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK