packed.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	packed.exe
size	1627762 (0x18d672)
md5	29bcbc52338345a055eb78e7b5634321

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
123	50727	2
158	30319	1
171	30319	2
156	30319	5
1	0	67
170	30319	20
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x50afcae8
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x1200
SizeOfInitializedData	0x18c400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x18d628
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x191000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x11ba	0x1200	R-X CODE
.rdata	0x3000	0x84e	0xa00	R-- IDATA
.data	0x4000	0x18a27c	0x18a000	RW- IDATA
.reloc	0x18f000	0x14f4	0x1600	R-- IDATA DISCARDABLE
.loader	0x191600	0	0x11	R-X

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3204	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x18f000	0x520
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x3140	0x40
Bound_IAT	0	0
IAT	0x3000	0x118
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
python33.dll	922	Py_NoSiteFlag
python33.dll	897	Py_FrozenFlag
python33.dll	912	Py_IgnoreEnvironmentFlag
python33.dll	344	PyImport_FrozenModules
python33.dll	930	Py_SetPythonHome
python33.dll	430	PyMem_Malloc
python33.dll	929	Py_SetProgramName
python33.dll	905	Py_GetProgramFullPath
python33.dll	914	Py_Initialize
python33.dll	678	PySys_SetArgv
python33.dll	896	Py_Finalize
python33.dll	136	PyDict_New
python33.dll	194	PyEval_EvalCode
python33.dll	198	PyEval_GetBuiltins
python33.dll	139	PyDict_SetItemString
python33.dll	352	PyImport_ImportModule
python33.dll	528	PyObject_CallMethod
python33.dll	149	PyErr_Clear
python33.dll	674	PySys_GetObject
python33.dll	376	PyList_Insert
python33.dll	797	PyUnicode_Decode
python33.dll	895	Py_FileSystemDefaultEncoding
python33.dll	771	PyUnicode_AsEncodedString
python33.dll	161	PyErr_Print
python33.dll	893	Py_FatalError
MSVCR100.dll	507	_crt_debugger_hook
MSVCR100.dll	495	_controlfp_s
MSVCR100.dll	696	_invoke_watson
MSVCR100.dll	545	_except_handler4_common
MSVCR100.dll	969	_onexit
MSVCR100.dll	803	_lock
MSVCR100.dll	347	__dllonexit
MSVCR100.dll	1165	_unlock
MSVCR100.dll	258	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR100.dll	1608	wcstombs
MSVCR100.dll	1482	mbstowcs
MSVCR100.dll	1514	setlocale
MSVCR100.dll	453	_amsg_exit
MSVCR100.dll	355	__getmainargs
MSVCR100.dll	476	_cexit
MSVCR100.dll	554	_exit
MSVCR100.dll	301	_XcptFilter
MSVCR100.dll	1395	exit
MSVCR100.dll	356	__initenv
MSVCR100.dll	688	_initterm
MSVCR100.dll	689	_initterm_e
MSVCR100.dll	492	_configthreadlocale
MSVCR100.dll	418	__setusermatherr
MSVCR100.dll	491	_commode
MSVCR100.dll	581	_fmode
MSVCR100.dll	415	__set_app_type
KERNEL32.dll	726	IsDebuggerPresent
KERNEL32.dll	1096	UnhandledExceptionFilter
KERNEL32.dll	426	GetCurrentProcess
KERNEL32.dll	1079	TerminateProcess
KERNEL32.dll	595	GetSystemTimeAsFileTime
KERNEL32.dll	427	GetCurrentProcessId
KERNEL32.dll	430	GetCurrentThreadId
KERNEL32.dll	618	GetTickCount
KERNEL32.dll	857	QueryPerformanceCounter
KERNEL32.dll	184	DecodePointer
KERNEL32.dll	1055	SetUnhandledExceptionFilter
KERNEL32.dll	214	EncodePointer
KERNEL32.dll	682	HeapSetInformation
KERNEL32.dll	703	InterlockedCompareExchange
KERNEL32.dll	1067	Sleep
KERNEL32.dll	706	InterlockedExchange

show previews

offset	size	type	comment
0	1627705	EXE	11/23/2012 19:13:44	#
15c1	15	HTM		#
18d639	57	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1627762 bytes (1590 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK