filenamevmapper.exe
size220672 (0x35e00)
md51cf4d7757d3ba3d64c5256eb9dac37f9
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
241401169
24340116123
2424011624
2592390719
2612390730
2602390717
265239186
1473072913
10160
2612391828
255239181
15101
258239181

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x5743eea1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x22800
SizeOfInitializedData0xe8800
SizeOfUninitializedData0
AddressOfEntryPoint0x190f1
BaseOfCode0x1000
BaseOfData0x24000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x111000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x226300x22800R-X CODE
.rdata0x240000x70ac0x7200R-- IDATA
.data0x2c0000xd70700x1c00RW- IDATA
.tls0x10400090x200RW- IDATA
.gfids0x1050000xc00x200R-- IDATA
.rsrc0x1060000x79500x7a00R-- IDATA
.reloc0x10e0000x24bc0x2600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2a44c0x8c
RESOURCE0x1060000x7950
EXCEPTION00
SECURITY00
BASERELOC0x10e0000x24bc
DEBUG0x29af00x70
ARCHITECTURE00
GLOBALPTR00
TLS0x29bbc0x18
LOAD_CONFIG0x29b600x40
Bound_IAT00
IAT0x240000x230
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x5040000x5040080x4c0cac0x42430000x300000
typenamesizecp
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#996400
ICON#1042640
ICON#1124400
ICON#1211280
GROUP_ICON#11740
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll960ReadFile
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1317WriteFile
KERNEL32.dll691GlobalAlloc
KERNEL32.dll702GlobalLock
KERNEL32.dll706GlobalSize
KERNEL32.dll709GlobalUnlock
KERNEL32.dll390GetCommandLineA
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll1113SetEvent
KERNEL32.dll1039ResetEvent
KERNEL32.dll1274WaitForSingleObjectEx
KERNEL32.dll133CreateEventW
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll581GetProcAddress
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll743InitializeSListHead
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll514GetLastError
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll1221TlsAlloc
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1222TlsFree
KERNEL32.dll354FreeLibrary
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll1139SetLastError
KERNEL32.dll1048RtlUnwind
KERNEL32.dll936QueryPerformanceFrequency
KERNEL32.dll281ExitProcess
KERNEL32.dll535GetModuleHandleExW
KERNEL32.dll612GetStdHandle
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll360GetACP
KERNEL32.dll719HeapFree
KERNEL32.dll715HeapAlloc
KERNEL32.dll722HeapReAlloc
KERNEL32.dll813LCMapStringW
KERNEL32.dll307FindFirstFileExA
KERNEL32.dll778IsValidCodePage
KERNEL32.dll567GetOEMCP
KERNEL32.dll370GetCPInfo
KERNEL32.dll391GetCommandLineW
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll586GetProcessHeap
KERNEL32.dll499GetFileType
KERNEL32.dll1159SetStdHandle
KERNEL32.dll617GetStringTypeW
KERNEL32.dll724HeapSize
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll410GetConsoleCP
KERNEL32.dll428GetConsoleMode
KERNEL32.dll1127SetFilePointerEx
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll202DecodePointer
KERNEL32.dll143CreateFileW
KERNEL32.dll945RaiseException
KERNEL32.dll323FindNextFileA
KERNEL32.dll306FindFirstFileA
KERNEL32.dll302FindClose
KERNEL32.dll515GetLocalTime
KERNEL32.dll136CreateFileA
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll82CloseHandle
USER32.dll256GetActiveWindow
USER32.dll264GetCapture
USER32.dll267GetClassInfoA
USER32.dll276GetClientRect
USER32.dll278GetClipboardData
USER32.dll288GetCursorPos
USER32.dll317GetKeyState
USER32.dll345GetMessageA
USER32.dll356GetParent
USER32.dll382GetSystemMetrics
USER32.dll411GetWindowPlacement
USER32.dll440InsertMenuItemA
USER32.dll446InvalidateRect
USER32.dll458IsClipboardFormatAvailable
USER32.dll480IsWindowVisible
USER32.dll488LoadCursorA
USER32.dll492LoadIconA
USER32.dll550OpenClipboard
USER32.dll562PeekMessageA
USER32.dll565PostMessageA
USER32.dll567PostQuitMessage
USER32.dll587RegisterClassA
USER32.dll612ReleaseCapture
USER32.dll216EnableWindow
USER32.dll646SetClipboardData
USER32.dll648SetCursor
USER32.dll658SetFocus
USER32.dll714SetWindowTextA
USER32.dll735ShowWindow
USER32.dll757TrackMouseEvent
USER32.dll759TrackPopupMenuEx
USER32.dll764TranslateMessage
USER32.dll785UpdateWindow
USER32.dll166DestroyWindow
USER32.dll164DestroyMenu
USER32.dll155DefWindowProcA
USER32.dll109CreateWindowExA
USER32.dll107CreatePopupMenu
USER32.dll106CreateMenu
USER32.dll631SendMessageA
USER32.dll73CloseClipboard
USER32.dll71ClientToScreen
USER32.dll9AppendMenuA
USER32.dll3AdjustWindowRectEx
USER32.dll213EmptyClipboard
USER32.dll621ScreenToClient
USER32.dll174DispatchMessageA
GDI32.dll692StretchDIBits
GDI32.dll649SetDIBitsToDevice
ADVAPI32.dll753SystemFunction036
COMDLG32.dll13GetSaveFileNameA
COMDLG32.dllChooseColorA
COMDLG32.dll11GetOpenFileNameA
SHELL32.dll122SHBrowseForFolderA
SHELL32.dll213SHGetPathFromIDListA
offsetsizetypecomment
0220672EXE05/24/2016 06:03:13#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xc0cac