test.packed.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	test.packed.exe
size	712704 (0xae000)
md5	226a986c02223fd6e1131190937a11af

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x40

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	3
TimeDateStamp	0x64a0ca51
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	1.0
SizeOfCode	0x86000
SizeOfInitializedData	0x27a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	0.0
ImageVersion	6.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xb0000
SizeOfHeaders	0x200
CheckSum	0
Subsystem	3
DllCharacteristics	0x120
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x86000	0x86000	RWX CODE
.data	0x87000	0x28000	0x27a00	RW- IDATA
.idata	0xaf000	0x400	0x400	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xaf000	0x28
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
W�
W�			75 f0 0a \|u.. \|
W�	32512		f0 0a \|.. \|
W�	2800
W�	46592		f0 0a \|.. \|
W�	10
W�	58368		f0 0a \|.. \|
W�			06 f1 0a \|... \|
W�	2801
W�	61737
W�	16896		f1 0a \|.. \|
W�			5b f1 0a \|[.. \|
W�	61997
W�	2802
W�			65 f2 0a \|e.. \|
W�	59904		f2 0a \|.. \|
W�			dlclose
W�			dlsym
W�			setlocale
W�			_initterm
W�			_initterm_e
W�			_onexit
W�			_XcptFilter
W�			_CrtSetCheckCount
W�			__p__commode
W�			__p__fmode
W�			__set_app_type
W�			_configthreadlocale
W�			_setusermatherr
W�			__p__environ
W�			__p__wenviron
W�			__wgetmainargs
W�			__set_msvcrt.dll
W�		8502916434571326569
W�	18432		89 4d 08 48 83 f9 \|.M.H.. \|

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	707120	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VA 0x65736f6c636c6400 in OriginalFirstThunk[62] for W?

[?] invalid VA 0x736c640000000000 in OriginalFirstThunk[63] for W?

[?] invalid VA 0x7300000065006d79 in OriginalFirstThunk[64] for W?

[?] invalid VA 0x656c61636f6c7465 in OriginalFirstThunk[65] for W?

[?] invalid VA 0x6e695f000000f600 in OriginalFirstThunk[66] for W?

[?] invalid VA 0x74696e695f000000 in OriginalFirstThunk[68] for W?

[?] invalid VA 0x655f6d726574 in OriginalFirstThunk[69] for W?

[?] invalid VA 0x78656e6f5f000000 in OriginalFirstThunk[70] for W?

[?] invalid VA 0x5f0000006d007469 in OriginalFirstThunk[71] for W?

[?] invalid VA 0x746c694674706358 in OriginalFirstThunk[72] for W?

[?] invalid VA 0x5f00000000007265 in OriginalFirstThunk[73] for W?

[?] invalid VA 0x6843746553747243 in OriginalFirstThunk[74] for W?

[?] invalid VA 0x746e756f436b6365 in OriginalFirstThunk[75] for W?

[?] invalid VA 0x705f5f0000000000 in OriginalFirstThunk[76] for W?

[?] invalid VA 0x646f6d6d6f635f5f in OriginalFirstThunk[77] for W?

[?] invalid VA 0x5f5f0000006f0065 in OriginalFirstThunk[78] for W?

[?] invalid VA 0x65646f6d665f5f70 in OriginalFirstThunk[79] for W?

[?] invalid VA 0x735f5f0000006500 in OriginalFirstThunk[80] for W?

[?] invalid VA 0x745f7070615f7465 in OriginalFirstThunk[81] for W?

[?] invalid VA 0x6e00657079 in OriginalFirstThunk[82] for W?

[?] invalid VA 0x746769666e6f635f in OriginalFirstThunk[83] for W?

[?] invalid VA 0x636f6c6461657268 in OriginalFirstThunk[84] for W?

[?] invalid VA 0x656c61 in OriginalFirstThunk[85] for W?

[?] invalid VA 0x726573757465735f in OriginalFirstThunk[86] for W?

[?] invalid VA 0x7272656874616d in OriginalFirstThunk[87] for W?

[?] invalid VA 0x5f705f5f00000061 in OriginalFirstThunk[88] for W?

[?] invalid VA 0x6e6f7269766e655f in OriginalFirstThunk[89] for W?

[?] invalid VA 0x705f5f0000007200 in OriginalFirstThunk[90] for W?

[?] invalid VA 0x7269766e65775f5f in OriginalFirstThunk[91] for W?

[?] invalid VA 0x5f00000072006e6f in OriginalFirstThunk[92] for W?

[?] invalid VA 0x69616d746567775f in OriginalFirstThunk[93] for W?

[?] invalid VA 0x736772616e in OriginalFirstThunk[94] for W?

[?] invalid VA 0x5f7465735f5f0000 in OriginalFirstThunk[95] for W?

[?] invalid VA 0x642e74726376736d in OriginalFirstThunk[96] for W?

[?] import table: empty FirstThunk for W?