parentKid.exe
filenameKid.unpacked.exe
size35328 (0x8a00)
md5172344a7c8f58f6387508ed6ea06a7cb
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
221208063
2242080619
225208067
203655012
1059
225210051
219210051
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x5af46989
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x4400
SizeOfInitializedData0x4600
SizeOfUninitializedData0
AddressOfEntryPoint0x1111d
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x1d000
SizeOfHeaders0x1000
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000x42910x4400R-X CODE
.rdata0x160000x20e90x2200R-- IDATA
.data0x190000xde90xa00RW- IDATA
.idata0x1a0000x8750xa00R-- IDATA
.rsrc0x1b0000x43c0x600R-- IDATA
.reloc0x1c0000x5660x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1a1700x3c
RESOURCE0x1b0000x43c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x175f00x40
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.DLLGetModuleFileNameW
KERNEL32.DLLFreeLibrary
KERNEL32.DLLVirtualQuery
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLDecodePointer
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLIsProcessorFeaturePresent
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLLoadLibraryExW
KERNEL32.DLLGetProcAddress
KERNEL32.DLLGetLastError
KERNEL32.DLLRaiseException
KERNEL32.DLLIsDebuggerPresent
KERNEL32.DLLEncodePointer
KERNEL32.DLLGetModuleHandleW
MSVCR120D.dll_crt_debugger_hook
MSVCR120D.dll__crtUnhandledException
MSVCR120D.dll__crtTerminateProcess
MSVCR120D.dllvoid __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR120D.dll__crtSetUnhandledExceptionFilter
MSVCR120D.dll_lock
MSVCR120D.dll_unlock
MSVCR120D.dll_commode
MSVCR120D.dll__dllonexit
MSVCR120D.dll_onexit
MSVCR120D.dll_invoke_watson
MSVCR120D.dll_controlfp_s
MSVCR120D.dll_except_handler4_common
MSVCR120D.dllwcscpy_s
MSVCR120D.dll_wmakepath_s
MSVCR120D.dll_wsplitpath_s
MSVCR120D.dll_fmode
MSVCR120D.dll__initenv
MSVCR120D.dll_initterm
MSVCR120D.dll_initterm_e
MSVCR120D.dll__setusermatherr
MSVCR120D.dll_configthreadlocale
MSVCR120D.dll_cexit
MSVCR120D.dll_exit
MSVCR120D.dll_CrtSetCheckCount
MSVCR120D.dll_CrtDbgReportW
MSVCR120D.dll__set_app_type
MSVCR120D.dll__getmainargs
MSVCR120D.dll_amsg_exit
MSVCR120D.dll_XcptFilter
MSVCR120D.dll_CRT_RTC_INITW
MSVCR120D.dllstrlen
MSVCR120D.dllmalloc
MSVCR120D.dllexit
MSVCR120D.dllscanf
MSVCR120D.dllputs
MSVCR120D.dll_calloc_dbg
MSVCR120D.dllprintf
MSVCR120D.dllgetchar
offsetsizetypecomment
035328EXE05/10/2018 15:47:21#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK