filenameNETSTAT.EXE
size27136 (0x6a00)
md532297bb17e6ec700d0fc869f9acaf561
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
132307291
149307291
1473072919
1096
1313072924
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc960
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x4a00
SizeOfInitializedData0x2000
SizeOfUninitializedData0
AddressOfEntryPoint0x3807
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0xa1d7
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x49160x4a00R-X CODE
.data0x60000xed40xc00RW- IDATA
.rsrc0x70000x8300xa00R-- IDATA
.reloc0x80000x4aa0x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x50640xb4
RESOURCE0x70000x830
EXCEPTION00
SECURITY00
BASERELOC0x80000x3c0
DEBUG0x11a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13800x40
Bound_IAT0x2700xa8
IAT0x10000x184
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19160
MANIFEST#17300
module_namehintordfunction_name
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll406LookupPrivilegeValueA
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll81CheckTokenMembership
ADVAPI32.dll288FreeSid
ADVAPI32.dll32AllocateAndInitializeSid
KERNEL32.dll349FormatMessageA
KERNEL32.dll723HeapSetInformation
KERNEL32.dll82CloseHandle
KERNEL32.dll586GetProcessHeap
KERNEL32.dll719HeapFree
KERNEL32.dll623GetSystemDirectoryA
KERNEL32.dll514GetLastError
KERNEL32.dll896OpenProcess
KERNEL32.dll828LoadLibraryA
KERNEL32.dll432GetConsoleOutputCP
KERNEL32.dll1176SetThreadPreferredUILanguages
KERNEL32.dll350FormatMessageW
KERNEL32.dll796K32GetModuleBaseNameA
KERNEL32.dll97CompareStringA
KERNEL32.dll624GetSystemDirectoryW
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll1212TerminateProcess
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll658GetTickCount
KERNEL32.dll932QueryPerformanceCounter
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll1185SetUnhandledExceptionFilter
KERNEL32.dll744InterlockedCompareExchange
KERNEL32.dll747InterlockedExchange
KERNEL32.dll831LoadLibraryW
KERNEL32.dll581GetProcAddress
KERNEL32.dll354FreeLibrary
KERNEL32.dll840LocalFree
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1202Sleep
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll145__getmainargs
msvcrt.dll210__set_app_type
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll345_except_handler4_common
msvcrt.dll295_controlfp
msvcrt.dll890_strupr
msvcrt.dll1295sscanf
msvcrt.dll1338toupper
msvcrt.dll475_iob
msvcrt.dll367_fileno
msvcrt.dll812_setmode
msvcrt.dll1183fprintf
msvcrt.dll1102_wsetlocale
msvcrt.dll1332time
msvcrt.dll1262memset
msvcrt.dll1299strchr
msvcrt.dll1329system
msvcrt.dll1167exit
msvcrt.dll974_vsnwprintf
msvcrt.dll968_vsnprintf
dbghelp.dll39SymCleanup
IPHLPAPI.DLL177InternalGetTcpTableWithOwnerModule
IPHLPAPI.DLL171InternalGetTcp6Table2
IPHLPAPI.DLL184InternalGetUdpTableWithOwnerModule
IPHLPAPI.DLL172InternalGetTcp6TableWithOwnerModule
IPHLPAPI.DLL175InternalGetTcpTable2
IPHLPAPI.DLL118GetTcpStatisticsEx
IPHLPAPI.DLL75GetIcmpStatisticsEx
IPHLPAPI.DLL97GetIpStatisticsEx
IPHLPAPI.DLL124GetUdpStatisticsEx
IPHLPAPI.DLL180InternalGetUdp6TableWithOwnerModule
USER32.dll55CharToOemBuffW
USER32.dll54CharToOemBuffA
WS2_32.dll14
WS2_32.dll141getnameinfo
WS2_32.dll15
WS2_32.dll9
WS2_32.dll115
WS2_32.dll57
snmpapi.dll25SnmpUtilOidCpy
snmpapi.dll35SnmpUtilVarBindFree
snmpapi.dll17SnmpUtilMemFree
snmpapi.dll16SnmpUtilMemAlloc

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionTCP/IP Netstat Command
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamenetstat.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamenetstat.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
027136EXE07/13/2009 23:55:12#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x270