filenametiuparse.exe
size55808 (0xda00)
md518e19e3cbbf096db96100078780d4a6f
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
152201151
158402192
171402192
147307292
1093
156402195
1704021920
175402191
155402191
154402191
15101
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x54f89110
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x1a00
SizeOfInitializedData0xbc00
SizeOfUninitializedData0
AddressOfEntryPoint0x1762
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x11000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x197c0x1a00R-X CODE
.rdata0x30000xd3a0xe00R-- IDATA
.data0x40000x42c0x200RW- IDATA
.rsrc0x50000xa6980xa800R-- IDATA
.reloc0x100000x2c80x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x3ce00x5a
IMPORT0x35440x50
RESOURCE0x50000xa698
EXCEPTION00
SECURITY00
BASERELOC0x100000x2b4
DEBUG0x31a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x34280x40
Bound_IAT00
IAT0x30000x180
Delay_IAT00
CLR_Header00
typenamesizecp
PHP82FEAC31D0033DCC75B113B690AABA71296531252
PHPRUN98581252
ICON#12961252
ICON#213841252
GROUP_ICON#101341252
MANIFEST#19301252
module_namehintordfunction_name
php5ts.dll490php_request_shutdown
php5ts.dll691sapi_shutdown
php5ts.dll786tsrm_shutdown
php5ts.dll787tsrm_startup
php5ts.dll774ts_resource_ex
php5ts.dll692sapi_startup
php5ts.dll1038zend_llist_init
php5ts.dll679sapi_globals_id
php5ts.dll492php_request_startup
php5ts.dll420php_module_shutdown
php5ts.dll484php_register_variable
php5ts.dll423php_module_startup
php5ts.dll384php_import_environment_variables
php5ts.dll375php_handle_aborted_connection
php5ts.dll422php_module_shutdown_wrapper
php5ts.dll896zend_error
php5ts.dll1260zif_dl
php5ts.dll208core_globals_id
php5ts.dll898zend_eval_string
php5ts.dll224executor_globals_id
MSVCR100.dll1034_setjmp3
MSVCR100.dll1037_setmode
MSVCR100.dll285_CItanh
MSVCR100.dll284_CItan
MSVCR100.dll1388ceil
MSVCR100.dll1492modf
MSVCR100.dll1415fputwc
MSVCR100.dll1468ldexp
MSVCR100.dll357__iob_func
MSVCR100.dll496_copysign
MSVCR100.dll1405fgetwc
MSVCR100.dll1422frexp
MSVCR100.dll483_chgsign
MSVCR100.dll1401fflush
MSVCR100.dll1430fwrite
MSVCR100.dll1411fprintf
MSVCR100.dll1476malloc
MSVCR100.dll568_fileno
MSVCR100.dll581_fmode
MSVCR100.dll1419free
MSVCR100.dll283_CIsqrt
MSVCR100.dll355__getmainargs
MSVCR100.dll476_cexit
MSVCR100.dll554_exit
MSVCR100.dll301_XcptFilter
MSVCR100.dll1395exit
MSVCR100.dll356__initenv
MSVCR100.dll688_initterm
MSVCR100.dll689_initterm_e
MSVCR100.dll492_configthreadlocale
MSVCR100.dll418__setusermatherr
MSVCR100.dll270_CIacos
MSVCR100.dll415__set_app_type
MSVCR100.dll507_crt_debugger_hook
MSVCR100.dll258void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR100.dll1165_unlock
MSVCR100.dll347__dllonexit
MSVCR100.dll803_lock
MSVCR100.dll969_onexit
MSVCR100.dll545_except_handler4_common
MSVCR100.dll696_invoke_watson
MSVCR100.dll495_controlfp_s
MSVCR100.dll282_CIsinh
MSVCR100.dll281_CIsin
MSVCR100.dll280_CIpow
MSVCR100.dll279_CIlog10
MSVCR100.dll278_CIlog
MSVCR100.dll277_CIfmod
MSVCR100.dll1407floor
MSVCR100.dll276_CIexp
MSVCR100.dll275_CIcosh
MSVCR100.dll274_CIcos
MSVCR100.dll273_CIatan2
MSVCR100.dll272_CIatan
MSVCR100.dll271_CIasin
MSVCR100.dll453_amsg_exit
MSVCR100.dll491_commode
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll202DecodePointer
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll234EncodePointer
KERNEL32.dll723HeapSetInformation
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll633GetSystemTimeAsFileTime
ordentry_vafunction_name
10x2450getwchar
20x2430putwchar
module_nameembeder.exe
flags0
timestamp2015-03-05 17:23:28
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x3d10
Functions(2)0x3d08
NameOrdinals(2)0x3d18
offsetsizetypecomment
055808EXE03/05/2015 17:23:28#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK