M2Bob.exe - M2Bob

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	M2Bob.exe
size	90112 (0x16000)
md5	29731a3926cd737777c56e2b093536dc

type	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x46
blocks_in_file	0x49
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0
ss	0x52
sp	0x45
checksum	0
ip	0
cs	0
reloc_table_offset	0
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x40

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	7.0
SizeOfCode	0x11000
SizeOfInitializedData	0x16000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x10eb
BaseOfCode	0x1000
BaseOfData	0xe000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x28000
SizeOfHeaders	0x400
CheckSum	0x18f7b
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xd000	0xc200	R-X CODE
.data	0xe000	0xf000	0x3400	RW- IDATA
.edata	0x1d000	0x3000	0x2200	RW- IDATA
.rsrc	0x20000	0x3000	0x1400	RW- IDATA
.tls	0x23000	0x4000	0x2a00	RWX CODE
.idata	0x27000	0x1000	0x600	RW- IDATA

Data Directory

type	va	size
EXPORT	0x1f000	0x69
IMPORT	0x27000	0x4d0
RESOURCE	0x20000	0x1c00
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x23f98	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x41c000	0x41c0a4	0x40e09f	0	0	0

show previews

type	name	size
ICON	#1	4264
RCDATA	DVCLAL	16
RCDATA	PLATFORMTARGETS	2
GROUP_ICON	MAINICON	20
VERSION	#1	584
MANIFEST	#1	1508

module_name	hint	ord	function_name
kernel32.dll			CloseHandle
kernel32.dll			CopyFileA
kernel32.dll			CreateFileA
kernel32.dll			CreateFileMappingA
kernel32.dll			DeleteCriticalSection
kernel32.dll			DeleteFileA
kernel32.dll			EnterCriticalSection
kernel32.dll			ExitProcess
kernel32.dll			GetACP
kernel32.dll			GetCPInfo
kernel32.dll			GetCommandLineA
kernel32.dll			GetCurrentProcessId
kernel32.dll			GetCurrentThreadId
kernel32.dll			GetEnvironmentStrings
kernel32.dll			GetFileType
kernel32.dll			GetLastError
kernel32.dll			GetLocalTime
kernel32.dll			GetLocaleInfoA
kernel32.dll			GetModuleFileNameA
kernel32.dll			GetModuleHandleA
kernel32.dll			GetOEMCP
kernel32.dll			GetProcAddress
kernel32.dll			GetProcessHeap
kernel32.dll			GetStartupInfoA
kernel32.dll			GetStdHandle
kernel32.dll			GetStringTypeA
kernel32.dll			GetStringTypeW
kernel32.dll			GetSystemDefaultLangID
kernel32.dll			GetUserDefaultLCID
kernel32.dll			GetVersion
kernel32.dll			GetVersionExA
kernel32.dll			HeapAlloc
kernel32.dll			HeapFree
kernel32.dll			InitializeCriticalSection
kernel32.dll			InterlockedDecrement
kernel32.dll			InterlockedIncrement
kernel32.dll			IsDBCSLeadByteEx
kernel32.dll			IsDebuggerPresent
kernel32.dll			IsValidLocale
kernel32.dll			LCMapStringA
kernel32.dll			LeaveCriticalSection
kernel32.dll			LoadLibraryA
kernel32.dll			MapViewOfFile
kernel32.dll			MultiByteToWideChar
kernel32.dll			OpenFileMappingA
kernel32.dll			RaiseException
kernel32.dll			RtlUnwind
kernel32.dll			SetConsoleCtrlHandler
kernel32.dll			SetFilePointer
kernel32.dll			LockResource
kernel32.dll			RestoreLastError
kernel32.dll			SetThreadLocale
kernel32.dll			Sleep
kernel32.dll			TlsAlloc
kernel32.dll			TlsFree
kernel32.dll			TlsGetValue
kernel32.dll			TlsSetValue
kernel32.dll			UnmapViewOfFile
kernel32.dll			VirtualAlloc
kernel32.dll			VirtualFree
kernel32.dll			VirtualQuery
kernel32.dll			WideCharToMultiByte
kernel32.dll			WriteFile
user32.dll			EnumThreadWindows
user32.dll			MessageBoxA
user32.dll			wsprintfA

ord	entry_va	function_name
1	0x1123	__GetExceptDLLinfo
2	0xe0ac	___CPPdebugHook

module_name	M2Bob.exe
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x1f030
Functions(2)	0x1f028
NameOrdinals(2)	0x1f038

StringTable 040904E4

FileDescription	M2Bob
FileVersion	1.0.0.38
LegalCopyright	© M2Bob-Team
OriginalFilename	M2Bob.exe
ProgramID	M2Bob
ProductName	M2Bob
ProductVersion	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	1.0.0.38
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	90112	EXE	01/01/1970 00:00:00	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

M2Bob.exe-

MZ Header

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 040904E4

VS_FIXEDFILEINFO

M2Bob.exe
-