manatest2.exe - Manalyze test file. - Eicar-Test-Signature-1

info
MZ
PE
resources
strings
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	manatest2.exe
size	72704 (0x11c00)
md5	371d6e5d0346363c8a4b993361d6ef10

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Eicar-Test-Signature-1 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
147	30729	10
257	23406	3
259	23406	1
261	23406	17
260	23406	13
203	65501	2
1	0	45
265	23506	1
256	23506	1
255	23506	1
151	0	1
258	23506	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x56c0b304
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.0
SizeOfCode	0xc00
SizeOfInitializedData	0x10e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1255
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x16000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xbed	0xc00	R-X CODE
.rdata	0x2000	0xaae	0xc00	R-- IDATA
.data	0x3000	0x384	0x200	RW- IDATA
.gfids	0x4000	0x20	0x200	R-- IDATA
.rsrc	0x5000	0xf950	0xfa00	R-- IDATA
.reloc	0x15000	0x140	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x2500	0x48
IMPORT	0x2548	0xa0
RESOURCE	0x5000	0xf950
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x15000	0x140
DEBUG	0x2100	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x2170	0x40
Bound_IAT	0	0
IAT	0x2000	0xbc
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
RC_DATA	#102	16360
ICON	#1	2835
ICON	#2	3752
ICON	#3	2216
ICON	#4	1384
ICON	#5	3146
ICON	#6	16936
ICON	#7	9640
ICON	#8	4264
ICON	#9	1128
STRING	#7	56
GROUP_ICON	#101	132
VERSION	#1	724
MANIFEST	#1	381

id	lang	string
103	1031	Test 1
104	1031	Test 2

module_name	hint	function_name
VCRUNTIME140.dll	72	memset
VCRUNTIME140.dll	41	__telemetry_main_return_trigger
VCRUNTIME140.dll	53	_except_handler4_common
VCRUNTIME140.dll	40	__telemetry_main_invoke_trigger
api-ms-win-crt-runtime-l1-1-0.dll	23	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	62	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	31	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	29	_controlfp_s
api-ms-win-crt-runtime-l1-1-0.dll	106	terminate
api-ms-win-crt-runtime-l1-1-0.dll	66	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	68	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	22	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	63	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	6	__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	5	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	37	_exit
api-ms-win-crt-runtime-l1-1-0.dll	88	exit
api-ms-win-crt-runtime-l1-1-0.dll	57	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	56	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	42	_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	54	_initialize_onexit_table
api-ms-win-crt-math-l1-1-0.dll	46	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
KERNEL32.dll	1347	SetUnhandledExceptionFilter
KERNEL32.dll	521	GetCurrentProcess
KERNEL32.dll	1377	TerminateProcess
KERNEL32.dll	877	IsProcessorFeaturePresent
KERNEL32.dll	1069	QueryPerformanceCounter
KERNEL32.dll	615	GetModuleHandleW
KERNEL32.dll	871	IsDebuggerPresent
KERNEL32.dll	843	InitializeSListHead
KERNEL32.dll	726	GetSystemTimeAsFileTime
KERNEL32.dll	526	GetCurrentThreadId
KERNEL32.dll	522	GetCurrentProcessId
KERNEL32.dll	1410	UnhandledExceptionFilter

ord	entry_va	function_name
1	0x1000	exported

module_name	CSandbox.exe
flags	0
timestamp	2016-02-14 17:01:56
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x252c
Functions(1)	0x2528
NameOrdinals(1)	0x2530

StringTable 040904b0

CompanyName	manalyzer.org
FileDescription	Manalyze test file.
FileVersion	1.0.0.0
InternalName	manatest2.exe
LegalCopyright	Copyright (C) 2016
OriginalFilename	manatest2.exe
ProductName	manatest2.exe
ProductVersion	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	1.0.0.0
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	72704	EXE	02/14/2016 17:01:56	#
15c1	15	HTM		#
2628	2835	PNG	(256 x 256)	#
4df8	3146	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

manatest2.exe- -

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

manatest2.exe
-
-