filenamelua.exe
size275162 (0x432da)
md50e4285ce6e23c59f368304fb811db52a
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xe
TimeDateStamp0x4f1e8fb2
PointerToSymbolTable0x34e00
NumberOfSymbols0xa1e
SizeOfOptionalHeader0xe0
Characteristics0x107
Magic0x10b
LinkerVersion2.56
SizeOfCode0x1e400
SizeOfInitializedData0x23000
SizeOfUninitializedData0xc00
AddressOfEntryPoint0x10fc
BaseOfCode0x1000
BaseOfData0x20000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x3e000
SizeOfHeaders0x400
CheckSum0x4b475
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1e26c0x1e400R-X CODE IDATA
.data0x200000x2c0x200RW- IDATA
.rdata0x210000x3d5c0x3e00R-- IDATA
.bss0x250000xaf80RW- UDATA
.idata0x260000xa0c0xc00RW- IDATA
/40x270000x1c00x200--- DISCARDABLE
/190x280000x4db0x600--- DISCARDABLE
/350x290000x4c4b0x4e00--- DISCARDABLE
/470x2e0000x12db0x1400--- DISCARDABLE
/610x300000x12b30x1400--- DISCARDABLE
/730x320000xdd40xe00--- DISCARDABLE
/860x330000x640x200--- DISCARDABLE
/970x340000x88790x8a00--- DISCARDABLE
/1080x3d0000x1780x200--- DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x260000xa0c
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll107DeleteCriticalSection
KERNEL32.dll126EnterCriticalSection
KERNEL32.dll156ExitProcess
KERNEL32.dll209FormatMessageA
KERNEL32.dll214FreeLibrary
KERNEL32.dll325GetLastError
KERNEL32.dll335GetModuleFileNameA
KERNEL32.dll337GetModuleHandleA
KERNEL32.dll364GetProcAddress
KERNEL32.dll492InitializeCriticalSection
KERNEL32.dll497InterlockedExchange
KERNEL32.dll523LeaveCriticalSection
KERNEL32.dll525LoadLibraryExA
KERNEL32.dll739SetUnhandledExceptionFilter
KERNEL32.dll751Sleep
msvcrt.dll39__getmainargs
msvcrt.dll48__mb_cur_max
msvcrt.dll60__p__environ
msvcrt.dll62__p__fmode
msvcrt.dll80__set_app_type
msvcrt.dll121_cexit
msvcrt.dll152_errno
msvcrt.dll170_filbuf
msvcrt.dll233_iob
msvcrt.dll234_isatty
msvcrt.dll235_isctype
msvcrt.dll350_onexit
msvcrt.dll358_pclose
msvcrt.dll359_pctype
msvcrt.dll362_popen
msvcrt.dll384_setjmp
msvcrt.dll388_setmode
msvcrt.dll533abort
msvcrt.dll535acos
msvcrt.dll537asin
msvcrt.dll538atan
msvcrt.dll539atan2
msvcrt.dll540atexit
msvcrt.dll546ceil
msvcrt.dll547clearerr
msvcrt.dll548clock
msvcrt.dll549cos
msvcrt.dll550cosh
msvcrt.dll552difftime
msvcrt.dll554exit
msvcrt.dll555exp
msvcrt.dll557fclose
msvcrt.dll560fflush
msvcrt.dll563fgets
msvcrt.dll566floor
msvcrt.dll567fmod
msvcrt.dll568fopen
msvcrt.dll569fprintf
msvcrt.dll571fputs
msvcrt.dll574fread
msvcrt.dll575free
msvcrt.dll576freopen
msvcrt.dll577frexp
msvcrt.dll578fscanf
msvcrt.dll579fseek
msvcrt.dll581ftell
msvcrt.dll583fwrite
msvcrt.dll587getenv
msvcrt.dll591gmtime
msvcrt.dll619ldexp
msvcrt.dll621localeconv
msvcrt.dll622localtime
msvcrt.dll623log
msvcrt.dll624log10
msvcrt.dll625longjmp
msvcrt.dll626malloc
msvcrt.dll630memchr
msvcrt.dll635mktime
msvcrt.dll636modf
msvcrt.dll638pow
msvcrt.dll647rand
msvcrt.dll648realloc
msvcrt.dll649remove
msvcrt.dll650rename
msvcrt.dll654setlocale
msvcrt.dll655setvbuf
msvcrt.dll656signal
msvcrt.dll657sin
msvcrt.dll658sinh
msvcrt.dll659sprintf
msvcrt.dll660sqrt
msvcrt.dll661srand
msvcrt.dll664strchr
msvcrt.dll665strcmp
msvcrt.dll666strcoll
msvcrt.dll667strcpy
msvcrt.dll669strerror
msvcrt.dll670strftime
msvcrt.dll675strpbrk
msvcrt.dll676strrchr
msvcrt.dll677strspn
msvcrt.dll678strstr
msvcrt.dll686system
msvcrt.dll687tan
msvcrt.dll688tanh
msvcrt.dll689time
msvcrt.dll690tmpfile
msvcrt.dll691tmpnam
msvcrt.dll692tolower
msvcrt.dll693toupper
msvcrt.dll696ungetc
offsetsizetypecomment
0216576EXE01/24/2012 11:02:10#
15c115HTM#
34e0058586BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK