filenameupdate_plesk.exe
size5366784 (0x51e400)
md527f1e8c067ef9a492e77a5a68184db83
typePE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xa
TimeDateStamp0x5895f01f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22f
Magic0x20b
LinkerVersion2.25
SizeOfCode0x3800
SizeOfInitializedData0x3c00
SizeOfUninitializedData0xe00
AddressOfEntryPoint0x14d0
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0xf000
SizeOfHeaders0x400
CheckSum0x8a2f
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x37100x3800R-X CODE
.data0x50000xc00x200RW- IDATA
.rdata0x60000xe100x1000R-- IDATA
.pdata0x70000x3240x400R-- IDATA
.xdata0x80000x3300x400R-- IDATA
.bss0x90000xc500RW- UDATA
.idata0xa0000xbec0xc00RW- IDATA
.CRT0xb0000x680x200RW- IDATA
.tls0xc0000x680x200RW- IDATA
.rsrc0xd0000x10880x517e00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xa0000xbec
RESOURCE0xd0000x1088
EXCEPTION0x70000x324
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xc0200x28
LOAD_CONFIG00
Bound_IAT00
IAT0xa3080x2b8
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x40c0000x40c0600x40977c0x40b04000
typenamesizecp
ICON#17440
ICON#22960
GROUP_ICON#1340
VERSION#153421800
module_namehintordfunction_name
KERNEL32.dll216DeleteCriticalSection
KERNEL32.dll248EnterCriticalSection
KERNEL32.dll366FreeLibrary
KERNEL32.dll450GetConsoleTitleA
KERNEL32.dll461GetCurrentProcess
KERNEL32.dll462GetCurrentProcessId
KERNEL32.dll466GetCurrentThreadId
KERNEL32.dll528GetLastError
KERNEL32.dll546GetModuleFileNameA
KERNEL32.dll598GetProcAddress
KERNEL32.dll627GetStartupInfoA
KERNEL32.dll650GetSystemTimeAsFileTime
KERNEL32.dll677GetTickCount
KERNEL32.dll694GetVersionExA
KERNEL32.dll761InitializeCriticalSection
KERNEL32.dll843LeaveCriticalSection
KERNEL32.dll846LoadLibraryA
KERNEL32.dll955QueryPerformanceCounter
KERNEL32.dll1025RtlAddFunctionTable
KERNEL32.dll1026RtlCaptureContext
KERNEL32.dll1033RtlLookupFunctionEntry
KERNEL32.dll1040RtlVirtualUnwind
KERNEL32.dll1132SetLastError
KERNEL32.dll1183SetUnhandledExceptionFilter
KERNEL32.dll1196Sleep
KERNEL32.dll1210TerminateProcess
KERNEL32.dll1217TlsGetValue
KERNEL32.dll1230UnhandledExceptionFilter
KERNEL32.dll1260VirtualProtect
KERNEL32.dll1262VirtualQuery
msvcrt.dll55__C_specific_handler
msvcrt.dll78__dllonexit
msvcrt.dll81__getmainargs
msvcrt.dll82__initenv
msvcrt.dll83__iob_func
msvcrt.dll91__lconv_init
msvcrt.dll97__set_app_type
msvcrt.dll99__setusermatherr
msvcrt.dll116_acmdln
msvcrt.dll123_amsg_exit
msvcrt.dll141_cexit
msvcrt.dll156_close
msvcrt.dll202_errno
msvcrt.dll252_fmode
msvcrt.dll307_getpid
msvcrt.dll330_initterm
msvcrt.dll438_lock
msvcrt.dll448_lseek
msvcrt.dll604_mkdir
msvcrt.dll610_onexit
msvcrt.dll630_open
msvcrt.dll637_read
msvcrt.dll642_rmdir
msvcrt.dll721_stat64
msvcrt.dll820_unlock
msvcrt.dll990_write
msvcrt.dll1031abort
msvcrt.dll1046atol
msvcrt.dll1049calloc
msvcrt.dll1062exit
msvcrt.dll1069fflush
msvcrt.dll1081fprintf
msvcrt.dll1088free
msvcrt.dll1099fwrite
msvcrt.dll1104getenv
msvcrt.dll1146malloc
msvcrt.dll1153memcmp
msvcrt.dll1154memcpy
msvcrt.dll1163printf
msvcrt.dll1167puts
msvcrt.dll1175remove
msvcrt.dll1184signal
msvcrt.dll1189sprintf
msvcrt.dll1193sscanf
msvcrt.dll1195strcat
msvcrt.dll1197strchr
msvcrt.dll1200strcpy
msvcrt.dll1205strlen
msvcrt.dll1208strncmp
msvcrt.dll1209strncpy
msvcrt.dll1214strstr
msvcrt.dll1240vfprintf
msvcrt.dll1246vsprintf
USER32.dll489MessageBoxA

StringTable 040904E4

CompanyNamezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
FileDescriptionzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
FileVersion1.0.0.0zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
InternalNamezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
LegalCopyrightzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
LegalTrademarkszzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
OriginalFilenamezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
ProductNamezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
ProductVersionzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
Commentzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz

VS_FIXEDFILEINFO

FileVersion1.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d05361200BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x977c