wifipass.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	wifipass.exe
size	182272 (0x2c800)
md5	2628d87f3aed69dbab5652dc83efe15b

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
147	30729	12
257	33030	2
261	33030	23
260	33030	9
259	33030	3
1	0	195
0	0	46
258	33135	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x65bd7a06
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.38
SizeOfCode	0x1f200
SizeOfInitializedData	0xd400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1e5e0
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x30000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1f1aa	0x1f200	R-X CODE
.rdata	0x21000	0xaf9e	0xb000	R-- IDATA
.data	0x2c000	0x388	0x200	RW- IDATA
.pdata	0x2d000	0x1980	0x1a00	R-- IDATA
.reloc	0x2f000	0x424	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2b39c	0xf0
RESOURCE	0	0
EXCEPTION	0x2d000	0x1980
SECURITY	0	0
BASERELOC	0x2f000	0x424
DEBUG	0x26bb0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x26c00	0x28
LOAD_CONFIG	0x26a70	0x140
Bound_IAT	0	0
IAT	0x21000	0x328
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x140027050	0x1400270b0	0x14002c300	0x1400213a8	0	0x400000

module_name	hint	function_name
wlanapi.dll	14	WlanEnumInterfaces
wlanapi.dll	39	WlanOpenHandle
wlanapi.dll	24	WlanGetProfileList
wlanapi.dll	22	WlanGetProfile
wlanapi.dll	8	WlanCloseHandle
wlanapi.dll	16	WlanFreeMemory
kernel32.dll	432	GetCurrentProcess
kernel32.dll	463	GetEnvironmentVariableW
kernel32.dll	425	GetCurrentDirectoryW
kernel32.dll	1112	SetLastError
kernel32.dll	1029	RtlLookupFunctionEntry
kernel32.dll	1035	RtlVirtualUnwind
kernel32.dll	1023	RtlCaptureContext
kernel32.dll		AcquireSRWLockExclusive
kernel32.dll	957	QueryPerformanceCounter
kernel32.dll	615	GetStdHandle
kernel32.dll	433	GetCurrentProcessId
kernel32.dll	585	GetProcessHeap
kernel32.dll	1209	TryAcquireSRWLockExclusive
kernel32.dll	740	HeapReAlloc
kernel32.dll	1	AcquireSRWLockShared
kernel32.dll	1000	ReleaseSRWLockShared
kernel32.dll	996	ReleaseMutex
kernel32.dll	522	GetModuleHandleA
kernel32.dll	1160	SetThreadStackGuarantee
kernel32.dll	785	IsProcessorFeaturePresent
kernel32.dll	16	AddVectoredExceptionHandler
kernel32.dll	406	GetConsoleMode
kernel32.dll	999	ReleaseSRWLockExclusive
kernel32.dll	525	GetModuleHandleW
kernel32.dll	341	FormatMessageW
kernel32.dll	67	CloseHandle
kernel32.dll	885	MultiByteToWideChar
kernel32.dll	1296	WriteConsoleW
kernel32.dll	436	GetCurrentThread
kernel32.dll	638	GetSystemTimeAsFileTime
kernel32.dll	1253	WaitForSingleObject
kernel32.dll	733	HeapAlloc
kernel32.dll	1254	WaitForSingleObjectEx
kernel32.dll	841	LoadLibraryA
kernel32.dll	139	CreateMutexA
kernel32.dll	501	GetLastError
kernel32.dll	345	FreeLibrary
kernel32.dll	578	GetProcAddress
kernel32.dll	842	LoadLibraryExA
kernel32.dll	761	InitializeSListHead
kernel32.dll	437	GetCurrentThreadId
kernel32.dll	778	IsDebuggerPresent
kernel32.dll	1216	UnhandledExceptionFilter
kernel32.dll	737	HeapFree
kernel32.dll	1172	SetUnhandledExceptionFilter
oleaut32.dll	22	GetErrorInfo
oleaut32.dll	94	SysFreeString
oleaut32.dll	99	SysStringLen
ntdll.dll	332	RtlNtStatusToDosError
ntdll.dll	110	NtWriteFile
VCRUNTIME140.dll	62	memset
VCRUNTIME140.dll	60	memcpy
VCRUNTIME140.dll	14	__CxxFrameHandler3
VCRUNTIME140.dll	61	memmove
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	8	__C_specific_handler
VCRUNTIME140.dll	27	__current_exception
VCRUNTIME140.dll	28	__current_exception_context
VCRUNTIME140.dll	59	memcmp
api-ms-win-crt-string-l1-1-0.dll	163	wcslen
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	24	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	40	_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	5	__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	24	free

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	176688	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2c300