dummy.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	dummy.exe
size	8704 (0x2200)
md5	0f2f9647a9c52e2335e8a94a85a584db

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
203	65501	2
1	0	51
221	20806	3
223	20806	1
224	20806	17
225	20806	6
224	40629	1
222	40629	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x56fc6ef4
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	12.0
SizeOfCode	0xa00
SizeOfInitializedData	0x1a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x11cc
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x6000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x93b	0xa00	R-X CODE
.rdata	0x2000	0xc14	0xe00	R-- IDATA
.data	0x3000	0x650	0x200	RW- IDATA
.pdata	0x4000	0xfc	0x200	R-- IDATA
.reloc	0x5000	0x2c	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x27ec	0x3c
RESOURCE	0	0
EXCEPTION	0x4000	0xfc
SECURITY	0	0
BASERELOC	0x5000	0x2c
DEBUG	0x2180	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x2650	0x70
Bound_IAT	0	0
IAT	0x2000	0x138
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
MSVCR120.dll	521	_calloc_crt
MSVCR120.dll	415	__dllonexit
MSVCR120.dll	1026	_onexit
MSVCR120.dll	1223	_unlock
MSVCR120.dll	412	__crtUnhandledException
MSVCR120.dll	411	__crtTerminateProcess
MSVCR120.dll	382	__crtCapturePreviousContext
MSVCR120.dll	859	_lock
MSVCR120.dll	409	__crtSetUnhandledExceptionFilter
MSVCR120.dll	307	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR120.dll	537	_commode
MSVCR120.dll	632	_fmode
MSVCR120.dll	489	_acmdln
MSVCR120.dll	348	__C_specific_handler
MSVCR120.dll	737	_initterm
MSVCR120.dll	738	_initterm_e
MSVCR120.dll	464	__setusermatherr
MSVCR120.dll	538	_configthreadlocale
MSVCR120.dll	771	_ismbblead
MSVCR120.dll	522	_cexit
MSVCR120.dll	600	_exit
MSVCR120.dll	1560	exit
MSVCR120.dll	462	__set_app_type
MSVCR120.dll	423	__getmainargs
MSVCR120.dll	498	_amsg_exit
MSVCR120.dll	397	__crtGetShowWindowMode
MSVCR120.dll	344	_XcptFilter
MSVCR120.dll	413	__crt_debugger_hook
KERNEL32.dll	874	IsDebuggerPresent
KERNEL32.dll	255	DecodePointer
KERNEL32.dll	733	GetSystemTimeAsFileTime
KERNEL32.dll	532	GetCurrentThreadId
KERNEL32.dll	528	GetCurrentProcessId
KERNEL32.dll	1072	QueryPerformanceCounter
KERNEL32.dll	293	EncodePointer
KERNEL32.dll	1020	OutputDebugStringA
KERNEL32.dll	880	IsProcessorFeaturePresent

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	3120	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK