filenameConsoleApplication1.exe
size12288 (0x3000)
md51e228a890c4b4f47a65e1cf22679896b
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072910
257338082
259338083
2603380810
2613380819
257307957
1055
264341231
255341231
258341231

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x671ba240
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.41
SizeOfCode0x1200
SizeOfInitializedData0x2000
SizeOfUninitializedData0
AddressOfEntryPoint0x1430
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x101c0x1200R-X CODE
.rdata0x30000x11060x1200R-- IDATA
.data0x50000x6800x200RW- IDATA
.pdata0x60000x18c0x200R-- IDATA
.rsrc0x70000x1e00x200R-- IDATA
.reloc0x80000x300x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x39940xc8
RESOURCE0x70000x1e0
EXCEPTION0x60000x18c
SECURITY00
BASERELOC0x80000x30
DEBUG0x34800x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x33400x140
Bound_IAT00
IAT0x30000x1d8
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll829GetUserGeoID
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll906InitializeSListHead
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll1476TerminateProcess
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll1269RtlCaptureContext
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll1136QueryPerformanceCounter
USER32.dll1014wsprintfA
WININET.dll201InternetOpenW
WININET.dll149InternetCloseHandle
WININET.dll200InternetOpenUrlW
VCRUNTIME140.dll8__C_specific_handler
VCRUNTIME140.dll27__current_exception
VCRUNTIME140.dll62memset
VCRUNTIME140.dll28__current_exception_context
VCRUNTIME140.dll60memcpy
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0.dll60_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll30_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll103terminate
api-ms-win-crt-runtime-l1-1-0.dll4__p___argc
api-ms-win-crt-runtime-l1-1-0.dll5__p___argv
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll35_exit
api-ms-win-crt-runtime-l1-1-0.dll85exit
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll40_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll66_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll64_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0.dll9__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
offsetsizetypecomment
15c115HTM#
15d06704BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK