edccchk.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	edccchk.exe
size	161866 (0x2784a)
md5	0e520437b5dd26f67101aca5ca45dab2

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xf
TimeDateStamp	0x56c32fef
PointerToSymbolTable	0x1ea00
NumberOfSymbols	0x699
SizeOfOptionalHeader	0xe0
Characteristics	0x107
Magic	0x10b
LinkerVersion	2.26
SizeOfCode	0x3e00
SizeOfInitializedData	0x5a00
SizeOfUninitializedData	0xc00
AddressOfEntryPoint	0x14e0
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x28000
SizeOfHeaders	0x400
CheckSum	0x2c5a8
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3cc4	0x3e00	R-X CODE IDATA
.data	0x5000	0x44	0x200	RW- IDATA
.rdata	0x6000	0xb78	0xc00	R-- IDATA
.bss	0x7000	0xa60	0	RW- UDATA
.idata	0x8000	0x810	0xa00	RW- IDATA
.CRT	0x9000	0x34	0x200	RW- IDATA
.tls	0xa000	0x20	0x200	RW- IDATA
/4	0xb000	0x370	0x400	R-- IDATA DISCARDABLE
/19	0xc000	0xded7	0xe000	R-- IDATA DISCARDABLE
/31	0x1a000	0x230d	0x2400	R-- IDATA DISCARDABLE
/45	0x1d000	0x20eb	0x2200	R-- IDATA DISCARDABLE
/57	0x20000	0xcb0	0xe00	R-- IDATA DISCARDABLE
/70	0x21000	0x4d9	0x600	R-- IDATA DISCARDABLE
/81	0x22000	0x462c	0x4800	R-- IDATA DISCARDABLE
/92	0x27000	0x4a8	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8000	0x810
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xa004	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x8184	0x134
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x40a000	0x40a01c	0x4079f0	0x409020	0	0

module_name	hint	function_name
KERNEL32.dll	212	DeleteCriticalSection
KERNEL32.dll	239	EnterCriticalSection
KERNEL32.dll	452	GetCurrentProcess
KERNEL32.dll	453	GetCurrentProcessId
KERNEL32.dll	457	GetCurrentThreadId
KERNEL32.dll	515	GetLastError
KERNEL32.dll	533	GetModuleHandleA
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	612	GetStartupInfoA
KERNEL32.dll	635	GetSystemTimeAsFileTime
KERNEL32.dll	663	GetTickCount
KERNEL32.dll	677	GetVersion
KERNEL32.dll	747	InitializeCriticalSection
KERNEL32.dll	806	LeaveCriticalSection
KERNEL32.dll	915	QueryPerformanceCounter
KERNEL32.dll	1127	SetUnhandledExceptionFilter
KERNEL32.dll	1140	Sleep
KERNEL32.dll	1154	TerminateProcess
KERNEL32.dll	1161	TlsGetValue
KERNEL32.dll	1174	UnhandledExceptionFilter
KERNEL32.dll	1206	VirtualProtect
KERNEL32.dll	1209	VirtualQuery
msvcrt.dll	55	__dllonexit
msvcrt.dll	56	__doserrno
msvcrt.dll	58	__getmainargs
msvcrt.dll	59	__initenv
msvcrt.dll	68	__lconv_init
msvcrt.dll	100	__pioinfo
msvcrt.dll	104	__set_app_type
msvcrt.dll	107	__setusermatherr
msvcrt.dll	121	_acmdln
msvcrt.dll	142	_amsg_exit
msvcrt.dll	159	_cexit
msvcrt.dll	207	_errno
msvcrt.dll	229	_filelengthi64
msvcrt.dll	230	_fileno
msvcrt.dll	242	_fmode
msvcrt.dll	304	_initterm
msvcrt.dll	308	_iob
msvcrt.dll	405	_lock
msvcrt.dll	413	_lseeki64
msvcrt.dll	562	_onexit
msvcrt.dll	838	calloc
msvcrt.dll	848	exit
msvcrt.dll	851	fclose
msvcrt.dll	852	feof
msvcrt.dll	854	fflush
msvcrt.dll	855	fgetc
msvcrt.dll	856	fgetpos
msvcrt.dll	862	fopen
msvcrt.dll	864	fprintf
msvcrt.dll	866	fputc
msvcrt.dll	870	fread
msvcrt.dll	871	free
msvcrt.dll	878	fsetpos
msvcrt.dll	882	fwrite
msvcrt.dll	895	isalpha
msvcrt.dll	903	isspace
msvcrt.dll	904	isupper
msvcrt.dll	926	malloc
msvcrt.dll	934	memcpy
msvcrt.dll	935	memmove
msvcrt.dll	941	printf
msvcrt.dll	945	puts
msvcrt.dll	961	signal
msvcrt.dll	977	strerror
msvcrt.dll	979	strlen
msvcrt.dll	982	strncmp
msvcrt.dll	1002	_unlock
msvcrt.dll	1055	_write
msvcrt.dll	1083	abort
msvcrt.dll	1105	tolower
msvcrt.dll	1111	vfprintf
USER32.dll	358	GetWindowThreadProcessId

show previews

offset	size	type	comment
0	125440	EXE	02/16/2016 14:19:27	#
15c1	15	HTM		#
1ea00	36426	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x79f0