filenamecalc.exe
size176128 (0x2b000)
md51ed2124313cce34c877247574212efc8
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
125507274
1095072722
10149
1235072719
1105072728
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4549b0be
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x12e00
SizeOfInitializedData0x18800
SizeOfUninitializedData0
AddressOfEntryPoint0x126fe
BaseOfCode0x1000
BaseOfData0x14000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion6.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x2e000
SizeOfHeaders0x400
CheckSum0x39b6f
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x12d360x12e00R-X CODE
.data0x140000x131c0xa00RW- IDATA
.rsrc0x160000x158e80x15a00R-- IDATA
.reloc0x2c0000x19760x1a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x130740xc8
RESOURCE0x160000x158e8
EXCEPTION00
SECURITY00
BASERELOC0x2c0000x16f4
DEBUG0x12800x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x17100x40
Bound_IAT0x2780xb8
IAT0x10000x260
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12240
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#7601750
ICON#896400
ICON#942640
ICON#1011280
GROUP_ICONSC1460
VERSION#18960
MANIFEST#19500
module_namehintordfunction_name
SHELL32.dll272ShellAboutW
ADVAPI32.dll566RegCreateKeyW
ADVAPI32.dll632RegSetValueExW
ADVAPI32.dll616RegQueryValueExW
ADVAPI32.dll554RegCloseKey
OLEAUT32.dll6
OLEAUT32.dll2
ole32.dll16CoCreateInstance
ntdll.dll1352WinSqmAddToStream
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll368GetCommandLineW
KERNEL32.dll560GetProfileIntW
KERNEL32.dll761LocalAlloc
KERNEL32.dll765LocalFree
KERNEL32.dll1194lstrcmpW
KERNEL32.dll564GetProfileStringW
KERNEL32.dll768LocalReAlloc
KERNEL32.dll1069TerminateProcess
KERNEL32.dll1206lstrlenW
KERNEL32.dll67CloseHandle
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll979SetEvent
KERNEL32.dll163CreateThread
KERNEL32.dll117CreateEventW
KERNEL32.dll906ResetEvent
KERNEL32.dll663GlobalUnlock
KERNEL32.dll660GlobalSize
KERNEL32.dll656GlobalLock
KERNEL32.dll1057Sleep
KERNEL32.dll652GlobalFree
KERNEL32.dll645GlobalAlloc
KERNEL32.dll659GlobalReAlloc
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll677HeapSetInformation
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll701InterlockedExchange
GDI32.dll653SetTextColor
GDI32.dll62CreateFontIndirectW
GDI32.dll606SelectObject
GDI32.dll208DeleteObject
GDI32.dll613SetBkColor
GDI32.dll614SetBkMode
USER32.dll631SetDlgItemTextW
USER32.dll61CheckMenuItem
USER32.dll62CheckMenuRadioItem
USER32.dll679SetWindowPos
USER32.dll526OffsetRect
USER32.dll499MapWindowPoints
USER32.dll269GetClientRect
USER32.dll209EnableWindow
USER32.dll481LoadMenuW
USER32.dll677SetWindowLongW
USER32.dll386GetWindowLongW
USER32.dll316GetMenu
USER32.dll93CreateDialogParamW
USER32.dll287GetDlgItem
USER32.dll158DestroyMenu
USER32.dll160DestroyWindow
USER32.dll639SetMenu
USER32.dll392GetWindowRect
USER32.dll709SystemParametersInfoW
USER32.dll169DispatchMessageW
USER32.dll725TranslateMessage
USER32.dll723TranslateAcceleratorW
USER32.dll437IsChild
USER32.dll441IsDialogMessageW
USER32.dll334GetMessageW
USER32.dll463LoadAcceleratorsW
USER32.dll611SendMessageW
USER32.dll484LoadStringW
USER32.dll652SetProcessDefaultLayout
USER32.dll344GetProcessDefaultLayout
USER32.dll651SetProcessDPIAware
USER32.dll624SetCursor
USER32.dll633SetFocus
USER32.dll684SetWindowTextW
USER32.dll63CheckRadioButton
USER32.dll363GetSubMenu
USER32.dll503MessageBeep
USER32.dll511MessageBoxW
USER32.dll211EndDialog
USER32.dll166DialogBoxParamW
USER32.dll364GetSysColor
USER32.dll71CloseClipboard
USER32.dll45CharNextA
USER32.dll271GetClipboardData
USER32.dll527OpenClipboard
USER32.dll29CallWindowProcW
USER32.dll405HideCaret
USER32.dll150DefWindowProcW
USER32.dll207EnableMenuItem
USER32.dll438IsClipboardFormatAvailable
USER32.dll286GetDlgCtrlID
USER32.dll544PostQuitMessage
USER32.dll200DrawTextW
USER32.dll60CheckDlgButton
USER32.dll399GetWindowTextW
USER32.dll629SetDlgItemInt
USER32.dll47CharNextW
USER32.dll565RegisterClassExW
USER32.dll365GetSysColorBrush
USER32.dll469LoadCursorW
USER32.dll471LoadIconW
USER32.dll426InvalidateRect
USER32.dll745UpdateWindow
USER32.dll696ShowWindow
USER32.dll104CreateWindowExW
msvcrt.dll1023_wcsrev
msvcrt.dll145__getmainargs
msvcrt.dll276_cexit
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll500_ismbblead
msvcrt.dll1167exit
msvcrt.dll231_acmdln
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll245_adjust_fdiv
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll345_except_handler4_common
msvcrt.dll295_controlfp
msvcrt.dll1260memmove
msvcrt.dll1338toupper
msvcrt.dll99_CxxThrowException
msvcrt.dll1387wcstoul
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll1262memset
msvcrt.dll1258memcpy
msvcrt.dll1361wcschr

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Calculator
FileVersion6.0.6000.16386 (vista_rtm.061101-2205)
InternalNameCALC
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCALC.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.0.6000.16386

VS_FIXEDFILEINFO

FileVersion6.0.6000.16386
ProductVersion6.0.6000.16386
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0176128EXE11/02/2006 08:47:58#
15c115HTM#
16a2860175PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x278