filenameexesax-gui.exe
size36352 (0x8e00)
md520de5e27034bf1035e8db9dff4b895ab
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x450eedfc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.56
SizeOfCode0x5200
SizeOfInitializedData0x8a00
SizeOfUninitializedData0xe00
AddressOfEntryPoint0x1290
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xe000
SizeOfHeaders0x400
CheckSum0xc269
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MingWin32 GCC 3.x

Sections

namevavsizeraw sizeflags
.text0x10000x50740x5200R-X CODE IDATA
.data0x70000x400x200RW- IDATA
.rdata0x80000xbe00xc00R-- IDATA
.bss0x90000xd500RW- UDATA
.idata0xa0000x64c0x800RW- IDATA
.rsrc0xb0000x21a00x2200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xa0000x64c
RESOURCE0xb0000x21a0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
BITMAPLOGO49840
ICON#17440
ICON#22960
DIALOGEXESAXDIALOG7580
DIALOGREPORTDIALOG6080
STRING#6263140
STRING#6321140
STRING#6381060
GROUP_ICONICON340
idlangstring
100001033The file was encrypted successfully.
100011033The input file was not found.
100021033The output file could not be created.
100031033Failed to encrypt EXE file. Reason:
101001033Open input .exe
101011033Set name of encrypted .exe
102001033cave (end of code section)
102011033new section
module_namehintordfunction_name
COMDLG32.DLL9GetOpenFileNameA
COMDLG32.DLL11GetSaveFileNameA
KERNEL32.dll1AddAtomA
KERNEL32.dll155ExitProcess
KERNEL32.dll175FindAtomA
KERNEL32.dll220GetAtomNameA
KERNEL32.dll236GetCommandLineA
KERNEL32.dll335GetModuleHandleA
KERNEL32.dll362GetProcAddress
KERNEL32.dll384GetStartupInfoA
KERNEL32.dll522LoadLibraryA
KERNEL32.dll736SetUnhandledExceptionFilter
msvcrt.dll39__getmainargs
msvcrt.dll60__p__environ
msvcrt.dll62__p__fmode
msvcrt.dll80__set_app_type
msvcrt.dll111_assert
msvcrt.dll121_cexit
msvcrt.dll233_iob
msvcrt.dll350_onexit
msvcrt.dll388_setmode
msvcrt.dll445_vsnprintf
msvcrt.dll533abort
msvcrt.dll540atexit
msvcrt.dll545calloc
msvcrt.dll557fclose
msvcrt.dll560fflush
msvcrt.dll568fopen
msvcrt.dll569fprintf
msvcrt.dll574fread
msvcrt.dll575free
msvcrt.dll579fseek
msvcrt.dll581ftell
msvcrt.dll583fwrite
msvcrt.dll626malloc
msvcrt.dll632memcpy
msvcrt.dll634memset
msvcrt.dll639printf
msvcrt.dll647rand
msvcrt.dll648realloc
msvcrt.dll656signal
msvcrt.dll659sprintf
msvcrt.dll665strcmp
USER32.dll146DialogBoxParamA
USER32.dll181EndDialog
USER32.dll252GetDlgItem
USER32.dll348GetWindowTextA
USER32.dll405LoadIconA
USER32.dll415LoadStringA
USER32.dll430MessageBoxA
USER32.dll464PostQuitMessage
USER32.dll502SendMessageA
USER32.dll568SetWindowTextA
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable
everything is OK