filenameTFTP.EXE
size17408 (0x4400)
md5150a785bb6f18131263f6748fb51060c
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
132307291
149307292
1473072911
1098
1313072925
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc963
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3200
SizeOfInitializedData0x1200
SizeOfUninitializedData0
AddressOfEntryPoint0x212e
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x8000
SizeOfHeaders0x400
CheckSum0xedff
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x30460x3200R-X CODE
.data0x50000x5cc0x200RW- IDATA
.rsrc0x60000x7e00x800R-- IDATA
.reloc0x70000x3c20x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x39a40x78
RESOURCE0x60000x7e0
EXCEPTION00
SECURITY00
BASERELOC0x70000x2c4
DEBUG0x11b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13280x40
Bound_IAT0x2800x6c
IAT0x10000x188
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19320
MANIFEST#16390
module_namehintordfunction_name
KERNEL32.dll349FormatMessageA
KERNEL32.dll862MoveFileA
KERNEL32.dll211DeleteFileA
KERNEL32.dll1181SetThreadUILanguage
KERNEL32.dll723HeapSetInformation
KERNEL32.dll840LocalFree
KERNEL32.dll767IsDBCSLeadByteEx
KERNEL32.dll514GetLastError
KERNEL32.dll515GetLocalTime
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll447GetCurrentProcess
KERNEL32.dll1212TerminateProcess
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll658GetTickCount
KERNEL32.dll932QueryPerformanceCounter
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll1185SetUnhandledExceptionFilter
KERNEL32.dll744InterlockedCompareExchange
KERNEL32.dll1198Sleep
KERNEL32.dll747InterlockedExchange
msvcrt.dll475_iob
msvcrt.dll367_fileno
msvcrt.dll334_dup
msvcrt.dll360_fdopen
msvcrt.dll1181fopen
msvcrt.dll1269putc
msvcrt.dll932_unlink
msvcrt.dll1170fclose
msvcrt.dll748_open
msvcrt.dll1096_write
msvcrt.dll291_close
msvcrt.dll342_errno
msvcrt.dll1258memcpy
msvcrt.dll295_controlfp
msvcrt.dll345_except_handler4_common
msvcrt.dll1153atol
msvcrt.dll872_strnicmp
msvcrt.dll862_stricmp
msvcrt.dll229_access
msvcrt.dll1190free
msvcrt.dll1303strcpy_s
msvcrt.dll1246malloc
msvcrt.dll1220isprint
msvcrt.dll1186fputs
msvcrt.dll1183fprintf
msvcrt.dll1313strncpy_s
msvcrt.dll561_itoa
msvcrt.dll1262memset
msvcrt.dll1152atoi
msvcrt.dll405_ftol2_sse
msvcrt.dll68_CIpow
msvcrt.dll1298strcat_s
msvcrt.dll1157calloc
msvcrt.dll1292sprintf_s
msvcrt.dll968_vsnprintf
msvcrt.dll812_setmode
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll145__getmainargs
msvcrt.dll1167exit
msvcrt.dll1332time
msvcrt.dll1204getc
msvcrt.dll1172ferror
msvcrt.dll772_read
msvcrt.dll850_stat
WS2_32.dll20
WS2_32.dll3
WS2_32.dll18
WS2_32.dll6
WS2_32.dll55
WS2_32.dll141getnameinfo
WS2_32.dll9
WS2_32.dll15
WS2_32.dll2
WS2_32.dll23
WS2_32.dll17
WS2_32.dll115
WS2_32.dll111
WS2_32.dll137getaddrinfo
WS2_32.dll136freeaddrinfo
USER32.dll54CharToOemBuffA
USER32.dll48CharNextExA
MSWSOCK.dll28s_perror

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionTrivial File Transfer Protocol App
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNametftp.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenametftp.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
017408EXE07/13/2009 23:55:15#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280