hailstone.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	hailstone.exe
size	1478704 (0x169030)
md5	13f9d59e78b26a35c2079d5ae0a7444e

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0x12
TimeDateStamp	0x54b43550
PointerToSymbolTable	0xdee00
NumberOfSymbols	0x56b0
SizeOfOptionalHeader	0xe0
Characteristics	0x107
Magic	0x10b
LinkerVersion	2.20
SizeOfCode	0xaba00
SizeOfInitializedData	0xdb200
SizeOfUninitializedData	0x4200
AddressOfEntryPoint	0x1160
BaseOfCode	0x1000
BaseOfData	0xad000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xf1000
SizeOfHeaders	0x600
CheckSum	0x171db9
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x800000
SizeOfStackCommit	0x800000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xab9d0	0xaba00	R-X CODE IDATA
.data	0xad000	0x1d160	0x1d200	RW- IDATA
.rodata	0xcb000	0x10088	0x10200	RW- IDATA
/4	0xdc000	0x320	0x400	RW- IDATA
.bss	0xdd000	0x40fc	0	RW- UDATA
.idata	0xe2000	0x1614	0x1800	RW- IDATA
.CRT	0xe4000	0x18	0x200	RW- IDATA
.tls	0xe5000	0x20	0x200	RW- IDATA
.rsrc	0xe6000	0x254	0x400	RW- IDATA
/14	0xe7000	0x60	0x200	R-- DISCARDABLE
/29	0xe8000	0x225	0x400	R-- DISCARDABLE
/45	0xe9000	0x1b8	0x200	R-- DISCARDABLE
/61	0xea000	0x172b	0x1800	R-- DISCARDABLE
/73	0xec000	0x3df	0x400	R-- DISCARDABLE
/87	0xed000	0x61c	0x800	R-- DISCARDABLE
/99	0xee000	0x210	0x400	R-- DISCARDABLE
/112	0xef000	0x7a	0x200	R-- DISCARDABLE
/123	0xf0000	0x310	0x400	R-- DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xe2000	0x1614
RESOURCE	0xe6000	0x254
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xe5000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x4e5019	0x4e501c	0x4e0670	0x4e4004	0	0

show previews

type	name	size	cp
MANIFEST	#1	506	0

module_name	hint	function_name
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	129	CreateEventA
KERNEL32.dll	169	CreateSemaphoreA
KERNEL32.dll	186	CreateTimerQueue
KERNEL32.dll	187	CreateTimerQueueTimer
KERNEL32.dll	207	DeleteCriticalSection
KERNEL32.dll	215	DeleteTimerQueueEx
KERNEL32.dll	216	DeleteTimerQueueTimer
KERNEL32.dll	236	EnterCriticalSection
KERNEL32.dll	279	ExitProcess
KERNEL32.dll	340	FlushConsoleInputBuffer
KERNEL32.dll	347	FormatMessageA
KERNEL32.dll	348	FormatMessageW
KERNEL32.dll	350	FreeEnvironmentStringsA
KERNEL32.dll	352	FreeLibrary
KERNEL32.dll	358	GetACP
KERNEL32.dll	368	GetCPInfo
KERNEL32.dll	408	GetConsoleCP
KERNEL32.dll	426	GetConsoleMode
KERNEL32.dll	446	GetCurrentProcess
KERNEL32.dll	450	GetCurrentThread
KERNEL32.dll	451	GetCurrentThreadId
KERNEL32.dll	471	GetEnvironmentStringsA
KERNEL32.dll	481	GetFileAttributesA
KERNEL32.dll	488	GetFileInformationByHandle
KERNEL32.dll	495	GetFileType
KERNEL32.dll	510	GetLastError
KERNEL32.dll	529	GetModuleHandleA
KERNEL32.dll	577	GetProcAddress
KERNEL32.dll	590	GetProcessTimes
KERNEL32.dll	608	GetStdHandle
KERNEL32.dll	623	GetSystemInfo
KERNEL32.dll	627	GetSystemTime
KERNEL32.dll	629	GetSystemTimeAsFileTime
KERNEL32.dll	653	GetThreadTimes
KERNEL32.dll	656	GetTickCount
KERNEL32.dll	700	GlobalMemoryStatusEx
KERNEL32.dll	734	InitializeCriticalSection
KERNEL32.dll	744	InterlockedExchange
KERNEL32.dll	763	IsDBCSLeadByteEx
KERNEL32.dll	814	LeaveCriticalSection
KERNEL32.dll	817	LoadLibraryA
KERNEL32.dll	820	LoadLibraryW
KERNEL32.dll	829	LocalFree
KERNEL32.dll	860	MultiByteToWideChar
KERNEL32.dll	892	OutputDebugStringA
KERNEL32.dll	894	PeekConsoleInputA
KERNEL32.dll	896	PeekNamedPipe
KERNEL32.dll	922	QueryPerformanceCounter
KERNEL32.dll	923	QueryPerformanceFrequency
KERNEL32.dll	936	ReadConsoleInputA
KERNEL32.dll	978	ReleaseSemaphore
KERNEL32.dll	995	ResetEvent
KERNEL32.dll	1021	SetConsoleCtrlHandler
KERNEL32.dll	1037	SetConsoleMode
KERNEL32.dll	1065	SetEvent
KERNEL32.dll	1091	SetLastError
KERNEL32.dll	1140	SetUnhandledExceptionFilter
KERNEL32.dll	1152	Sleep
KERNEL32.dll	1163	SystemTimeToFileTime
KERNEL32.dll	1173	TlsGetValue
KERNEL32.dll	1207	VirtualAlloc
KERNEL32.dll	1210	VirtualFree
KERNEL32.dll	1213	VirtualProtect
KERNEL32.dll	1215	VirtualQuery
KERNEL32.dll	1221	WaitForMultipleObjects
KERNEL32.dll	1223	WaitForSingleObject
KERNEL32.dll	1247	WideCharToMultiByte
msvcrt.dll	4	_chmod
msvcrt.dll	6	_close
msvcrt.dll	10	_dup
msvcrt.dll	11	_dup2
msvcrt.dll	38	_getpid
msvcrt.dll	55	_mkdir
msvcrt.dll	64	_read
msvcrt.dll	68	_setmode
msvcrt.dll	80	_strdup
msvcrt.dll	93	_tzname
msvcrt.dll	97	_unlink
msvcrt.dll	99	_wcsdup
msvcrt.dll	109	_write
msvcrt.dll	55	__getmainargs
msvcrt.dll	61	__lc_codepage
msvcrt.dll	65	__mb_cur_max
msvcrt.dll	77	__p__environ
msvcrt.dll	79	__p__fmode
msvcrt.dll	99	__set_app_type
msvcrt.dll	143	_beginthreadex
msvcrt.dll	147	_cexit
msvcrt.dll	155	_chsize
msvcrt.dll	182	_errno
msvcrt.dll	200	_filbuf
msvcrt.dll	205	_findclose
msvcrt.dll	206	_findfirst
msvcrt.dll	209	_findnext
msvcrt.dll	224	_fstati64
msvcrt.dll	228	_fullpath
msvcrt.dll	233	_get_osfhandle
msvcrt.dll	266	_iob
msvcrt.dll	267	_isatty
msvcrt.dll	268	_isctype
msvcrt.dll	317	_lseeki64
msvcrt.dll	383	_onexit
msvcrt.dll	387	_osver
msvcrt.dll	392	_pctype
msvcrt.dll	422	_setjmp
msvcrt.dll	426	_setmode
msvcrt.dll	471	_timezone
msvcrt.dll	474	_tzname
msvcrt.dll	531	_wfopen
msvcrt.dll	538	_winmajor
msvcrt.dll	555	_wsopen
msvcrt.dll	565	_wstat
msvcrt.dll	567	_wstati64
msvcrt.dll	583	abort
msvcrt.dll	585	acos
msvcrt.dll	587	asin
msvcrt.dll	588	atan
msvcrt.dll	590	atexit
msvcrt.dll	591	atof
msvcrt.dll	592	atoi
msvcrt.dll	594	bsearch
msvcrt.dll	595	calloc
msvcrt.dll	599	cos
msvcrt.dll	600	cosh
msvcrt.dll	601	ctime
msvcrt.dll	604	exit
msvcrt.dll	605	exp
msvcrt.dll	607	fclose
msvcrt.dll	610	fflush
msvcrt.dll	618	fopen
msvcrt.dll	619	fprintf
msvcrt.dll	620	fputc
msvcrt.dll	624	fread
msvcrt.dll	625	free
msvcrt.dll	629	fseek
msvcrt.dll	631	ftell
msvcrt.dll	633	fwrite
msvcrt.dll	637	getenv
msvcrt.dll	641	gmtime
msvcrt.dll	643	isalnum
msvcrt.dll	644	isalpha
msvcrt.dll	645	iscntrl
msvcrt.dll	646	isdigit
msvcrt.dll	649	islower
msvcrt.dll	650	isprint
msvcrt.dll	651	ispunct
msvcrt.dll	652	isspace
msvcrt.dll	653	isupper
msvcrt.dll	667	isxdigit
msvcrt.dll	669	ldexp
msvcrt.dll	671	localeconv
msvcrt.dll	672	localtime
msvcrt.dll	673	log
msvcrt.dll	675	longjmp
msvcrt.dll	676	malloc
msvcrt.dll	682	memcpy
msvcrt.dll	683	memmove
msvcrt.dll	684	memset
msvcrt.dll	685	mktime
msvcrt.dll	686	modf
msvcrt.dll	688	pow
msvcrt.dll	696	raise
msvcrt.dll	698	realloc
msvcrt.dll	704	setlocale
msvcrt.dll	706	signal
msvcrt.dll	707	sin
msvcrt.dll	708	sinh
msvcrt.dll	709	sprintf
msvcrt.dll	710	sqrt
msvcrt.dll	715	strcmp
msvcrt.dll	717	strcpy
msvcrt.dll	719	strerror
msvcrt.dll	721	strlen
msvcrt.dll	724	strncpy
msvcrt.dll	726	strrchr
msvcrt.dll	731	strtol
msvcrt.dll	734	swprintf
msvcrt.dll	737	tan
msvcrt.dll	738	tanh
msvcrt.dll	739	time
msvcrt.dll	748	vfprintf
msvcrt.dll	756	wcscmp
msvcrt.dll	758	wcscpy
msvcrt.dll	761	wcslen
USER32.dll	434	MessageBoxA
WINMM.DLL	144	timeBeginPeriod
WINMM.DLL	145	timeEndPeriod
WINMM.DLL	146	timeGetDevCaps
WSOCK32.DLL	26	WSAGetLastError
WSOCK32.DLL	36	bind
WSOCK32.DLL	37	closesocket
WSOCK32.DLL	38	connect
WSOCK32.DLL	40	gethostbyaddr
WSOCK32.DLL	41	gethostbyname
WSOCK32.DLL	42	gethostname
WSOCK32.DLL	45	getprotobyname
WSOCK32.DLL	46	getprotobynumber
WSOCK32.DLL	47	getservbyname
WSOCK32.DLL	48	getservbyport
WSOCK32.DLL	51	htonl
WSOCK32.DLL	52	htons
WSOCK32.DLL	53	inet_addr
WSOCK32.DLL	55	inet_ntoa
WSOCK32.DLL	57	listen
WSOCK32.DLL	59	ntohs
WSOCK32.DLL	61	recv
WSOCK32.DLL	62	recvfrom
WSOCK32.DLL	66	select
WSOCK32.DLL	67	send
WSOCK32.DLL	71	shutdown

show previews

offset	size	type	comment
0	912896	EXE	01/12/2015 20:57:52	#
15c1	15	HTM		#
dee00	565808	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xe0670