filenameLabyrinth.exe
size1181484 (0x12072c)
md52e80b7c89a32ddd092256f7da8f314bc
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x53a9440c
PointerToSymbolTable0xdc200
NumberOfSymbols0x1b95
SizeOfOptionalHeader0xe0
Characteristics0x307
Magic0x10b
LinkerVersion2.20
SizeOfCode0xc2c00
SizeOfInitializedData0xdb200
SizeOfUninitializedData0x2600
AddressOfEntryPoint0x1160
BaseOfCode0x1000
BaseOfData0xc4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xe3000
SizeOfHeaders0x400
CheckSum0x125958
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xc2a980xc2c00R-X CODE IDATA
.data0xc40000x79a40x7a00RW- IDATA
.rdata0xcc0000xb7c0xc00R-- IDATA
.eh_fram0xcd0000xeec00xf000RW- IDATA
.bss0xdc0000x24780RW- UDATA
.idata0xdf0000x17480x1800RW- IDATA
.CRT0xe10000x180x200RW- IDATA
.tls0xe20000x200x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xdf0000x1748
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xe20000x18
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4e20190x4e201c0x4dd8f00x4e100400
module_namehintordfunction_name
libpcre-0.dll1pcre_compile
libpcre-0.dll7pcre_exec
libpcre-0.dll8pcre_free
libpcre-0.dll11pcre_fullinfo
libpcre-0.dll18pcre_maketables
libpcre-0.dll19pcre_malloc
libpcre-0.dll23pcre_study
gc.dll44GC_free
gc.dll66GC_malloc
gc.dll67GC_malloc_atomic
gc.dll97GC_set_warn_proc
KERNEL32.dll82CloseHandle
KERNEL32.dll135CreateFileA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll292FillConsoleOutputAttribute
KERNEL32.dll293FillConsoleOutputCharacterA
KERNEL32.dll352FreeLibrary
KERNEL32.dll432GetConsoleScreenBufferInfo
KERNEL32.dll481GetFileAttributesA
KERNEL32.dll510GetLastError
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll608GetStdHandle
KERNEL32.dll627GetSystemTime
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll744InterlockedExchange
KERNEL32.dll763IsDBCSLeadByteEx
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll817LoadLibraryA
KERNEL32.dll860MultiByteToWideChar
KERNEL32.dll1025SetConsoleCursorPosition
KERNEL32.dll1046SetConsoleTextAttribute
KERNEL32.dll1082SetFileTime
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1163SystemTimeToFileTime
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1247WideCharToMultiByte
KERNEL32.dll1256WriteConsoleA
KERNEL32.dll1267WriteFile
msvcrt.dll2_chdir
msvcrt.dll6_close
msvcrt.dll10_dup
msvcrt.dll11_dup2
msvcrt.dll23_fdopen
msvcrt.dll32_fstat
msvcrt.dll35_getch
msvcrt.dll37_getcwd
msvcrt.dll55_mkdir
msvcrt.dll58_open
msvcrt.dll59_pclose
msvcrt.dll60_popen
msvcrt.dll62_putenv
msvcrt.dll64_read
msvcrt.dll65_rmdir
msvcrt.dll78_stat
msvcrt.dll93_tzname
msvcrt.dll94_tzset
msvcrt.dll95_umask
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll61__lc_codepage
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll147_cexit
msvcrt.dll173_daylight
msvcrt.dll182_errno
msvcrt.dll200_filbuf
msvcrt.dll205_findclose
msvcrt.dll206_findfirst
msvcrt.dll209_findnext
msvcrt.dll225_ftime
msvcrt.dll228_fullpath
msvcrt.dll266_iob
msvcrt.dll267_isatty
msvcrt.dll268_isctype
msvcrt.dll383_onexit
msvcrt.dll392_pctype
msvcrt.dll426_setmode
msvcrt.dll471_timezone
msvcrt.dll538_winmajor
msvcrt.dll583abort
msvcrt.dll585acos
msvcrt.dll586asctime
msvcrt.dll589atan2
msvcrt.dll590atexit
msvcrt.dll595calloc
msvcrt.dll596ceil
msvcrt.dll598clock
msvcrt.dll599cos
msvcrt.dll604exit
msvcrt.dll605exp
msvcrt.dll607fclose
msvcrt.dll610fflush
msvcrt.dll616floor
msvcrt.dll617fmod
msvcrt.dll618fopen
msvcrt.dll620fputc
msvcrt.dll625free
msvcrt.dll629fseek
msvcrt.dll631ftell
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll641gmtime
msvcrt.dll671localeconv
msvcrt.dll672localtime
msvcrt.dll673log
msvcrt.dll676malloc
msvcrt.dll680memchr
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll685mktime
msvcrt.dll688pow
msvcrt.dll689printf
msvcrt.dll691putchar
msvcrt.dll692puts
msvcrt.dll698realloc
msvcrt.dll699remove
msvcrt.dll700rename
msvcrt.dll706signal
msvcrt.dll707sin
msvcrt.dll709sprintf
msvcrt.dll710sqrt
msvcrt.dll714strchr
msvcrt.dll717strcpy
msvcrt.dll719strerror
msvcrt.dll720strftime
msvcrt.dll721strlen
msvcrt.dll723strncmp
msvcrt.dll726strrchr
msvcrt.dll731strtol
msvcrt.dll736system
msvcrt.dll739time
msvcrt.dll742tolower
msvcrt.dll743toupper
msvcrt.dll748vfprintf
msvcrt.dll761wcslen
libgcc_s_dw2-1.dll14_Unwind_Resume
libgcc_s_dw2-1.dll34__deregister_frame_info
libgcc_s_dw2-1.dll80__moddi3
libgcc_s_dw2-1.dll103__register_frame_info
libgcc_s_dw2-1.dll115__udivdi3
libgcc_s_dw2-1.dll117__umoddi3
libstdc++-6.dll66_ZN9__gnu_cxx12__atomic_addEPVii
libstdc++-6.dll70_ZN9__gnu_cxx18__exchange_and_addEPVii
libstdc++-6.dll939_ZNSo9_M_insertIdEERSoT_
libstdc++-6.dll961_ZNSolsEi
libstdc++-6.dll987_ZNSs4_Rep10_M_destroyERKSaIcE
libstdc++-6.dll996_ZNSs4_Rep20_S_empty_rep_storageE
libstdc++-6.dll1000_ZNSs4_Rep9_S_createEjjRKSaIcE
libstdc++-6.dll1018_ZNSs6assignERKSs
libstdc++-6.dll1080_ZNSsD1Ev
libstdc++-6.dll2217_ZNSt18basic_stringstreamIcSt11char_traitsIcESaIcEED1Ev
libstdc++-6.dll2355_ZNSt6localeC1Ev
libstdc++-6.dll2362_ZNSt6localeD1Ev
libstdc++-6.dll2443_ZNSt8ios_base4InitC1Ev
libstdc++-6.dll2445_ZNSt8ios_base4InitD1Ev
libstdc++-6.dll2474_ZNSt8ios_baseC2Ev
libstdc++-6.dll2477_ZNSt8ios_baseD2Ev
libstdc++-6.dll2566_ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_E
libstdc++-6.dll2567_ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate
libstdc++-6.dll2637_ZSt13set_terminatePFvvE
libstdc++-6.dll2645_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_i
libstdc++-6.dll2660_ZSt19__throw_logic_errorPKc
libstdc++-6.dll2666_ZSt20__throw_length_errorPKc
libstdc++-6.dll2667_ZSt20__throw_out_of_rangePKc
libstdc++-6.dll2727_ZSt9terminatev
libstdc++-6.dll3189_ZTTSt18basic_stringstreamIcSt11char_traitsIcESaIcEE
libstdc++-6.dll3198_ZTVN10__cxxabiv117__class_type_infoE
libstdc++-6.dll3200_ZTVN10__cxxabiv119__pointer_type_infoE
libstdc++-6.dll3202_ZTVN10__cxxabiv120__si_class_type_infoE
libstdc++-6.dll3251_ZTVSt15basic_streambufIcSt11char_traitsIcEE
libstdc++-6.dll3253_ZTVSt15basic_stringbufIcSt11char_traitsIcESaIcEE
libstdc++-6.dll3269_ZTVSt18basic_stringstreamIcSt11char_traitsIcESaIcEE
libstdc++-6.dll3298_ZTVSt9basic_iosIcSt11char_traitsIcEE
libstdc++-6.dll3367_Znaj
libstdc++-6.dll3369_Znwj
libstdc++-6.dll3373__cxa_allocate_exception
libstdc++-6.dll3376__cxa_begin_catch
libstdc++-6.dll3377__cxa_call_unexpected
libstdc++-6.dll3380__cxa_end_catch
libstdc++-6.dll3388__cxa_pure_virtual
libstdc++-6.dll3389__cxa_rethrow
libstdc++-6.dll3390__cxa_throw
libstdc++-6.dll3402__gxx_personality_v0
offsetsizetypecomment
0901632EXE06/24/2014 09:25:32#
15c115HTM#
dc200279852BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xdd8f0