filename123.exe
size49152 (0xc000)
md52e21a3a4b1c2e05209579f7333093030
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
1272912
007
1980228
19803410
1472997
1180472
10804711
480473
10160
49904429
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5315c1d7
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x3000
SizeOfInitializedData0x8000
SizeOfUninitializedData0
AddressOfEntryPoint0x3552
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x26e90x3000R-X CODE
.rdata0x40000x5e060x6000R-- IDATA
.data0xa0000xca00x1000RW- IDATA
.rsrc0xb0000x2800x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x98ec0x50
RESOURCE0xb0000x280
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0xac600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000xec
Delay_IAT00
CLR_Header00
typenamesizecp
JTER5#5121280
ZARR#5121280
RCDATA#5121280
module_namehintordfunction_name
rsaenh.dll3CPDecrypt
rsaenh.dll4CPDeriveKey
rsaenh.dll2CPCreateHash
user32.dll1756FindWindowA
user32.dll1775LoadStringA
user32.dll2332wsprintfW
user32.dll1681DialogBoxParamW
user32.dll1969IsDialogMessageA
user32.dll2040MessageBoxW
user32.dll1601CreateDesktopW
user32.dll1562CharToOemA
user32.dll2079PostMessageW
user32.dll2163SetCursorPos
user32.dll1735SetFocus
user32.dll1963IsCharLowerW
user32.dll1855GetMessageW
user32.dll2007LoadImageA
user32.dll2076PeekMessageW
kernel32.dll685GetVolumePathNameW
kernel32.dll961ReadFile
kernel32.dll1113SetErrorMode
kernel32.dll536LoadLibraryA
kernel32.dll894OpenSemaphoreW
kernel32.dll517GetLocalTime
kernel32.dll362GetACP
kernel32.dll519GetLocaleInfoW
kernel32.dll894OpenMutexW
kernel32.dll479GetEnvironmentVariableA
kernel32.dll294FileTimeToLocalFileTime
kernel32.dll1352lstrcmpA
kernel32.dll498GetFileSize
kernel32.dll749InterlockedIncrement
kernel32.dll456GetDateFormatA
kernel32.dll588GetProcessHeap
kernel32.dll205GetProcAddress
kernel32.dll893OpenMutexW
kernel32.dll157CreateMutexA
kernel32.dll309FindFirstFileW
kernel32.dll173CreateSemaphoreW
kernel32.dll193CreateWaitableTimerA
kernel32.dll1356lstrcpynW
kernel32.dll662GetTickCount
kernel32.dll100CompareStringA
kernel32.dll1206WaitForSingleObject
kernel32.dll521GetLogicalDriveStringsA
kernel32.dll213DeleteFileA
kernel32.dll449GetCurrentDirectoryW
kernel32.dll928QueryDosDeviceA
kernel32.dll126CreateDirectoryA
kernel32.dll1053SearchPathA
kernel32.dll612GetStartupInfoA
kernel32.dll1036ReplaceFileW
kernel32.dll223DeviceIoControl
kernel32.dll610GetShortPathNameA
kernel32.dll351FormatMessageA
offsetsizetypecomment
049152EXE03/04/2014 12:06:47#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK