filenamer0ak.exe
size27648 (0x6c00)
md53758fea9f46c3e965f24793249a3fc6f
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072914
257289202
2612892018
2602892010
259289204
257274129
10100
264291109
255291101
258291101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5f3195ca
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.27
SizeOfCode0x3200
SizeOfInitializedData0x3c00
SizeOfUninitializedData0
AddressOfEntryPoint0x14a0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0xc160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x305c0x3200R-X CODE
.rdata0x50000x19fa0x1a00R-- IDATA
.data0x70000x19680x1400RW- IDATA
.pdata0x90000x3d80x400R-- IDATA
.rsrc0xa0000x1e80x200R-- IDATA
.reloc0xb0000x2c0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x5d900x104
RESOURCE0xa0000x1e8
EXCEPTION0x90000x3d8
SECURITY00
BASERELOC0xb0000x2c
DEBUG0x54400x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x54b00x130
Bound_IAT00
IAT0x50000x358
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13920
module_namehintordfunction_name
ntdll.dll1256RtlLookupFunctionEntry
ntdll.dll754RtlCaptureContext
ntdll.dll1575RtlVirtualUnwind
ntdll.dll2013ZwOpenSection
ntdll.dll717RtlAdjustPrivilege
ntdll.dll504NtQuerySystemInformation
ntdll.dll1134RtlInitUnicodeString
KERNEL32.dll223CreatePipe
KERNEL32.dll1571WriteFile
KERNEL32.dll1421Sleep
KERNEL32.dll968LoadLibraryExA
KERNEL32.dll435FreeLibrary
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll970LoadLibraryW
KERNEL32.dll1495VirtualAlloc
KERNEL32.dll922K32EnumDeviceDrivers
KERNEL32.dll928K32GetDeviceDriverBaseNameA
KERNEL32.dll253CreateToolhelp32Snapshot
KERNEL32.dll1072Process32FirstW
KERNEL32.dll1074Process32NextW
KERNEL32.dll1041OpenProcess
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll996MapViewOfFile
KERNEL32.dll1498VirtualFree
KERNEL32.dll136CloseHandle
KERNEL32.dll1473UnmapViewOfFile
KERNEL32.dll547GetCurrentThread
KERNEL32.dll1389SetThreadPriority
KERNEL32.dll617GetLastError
KERNEL32.dll848HeapAlloc
KERNEL32.dll701GetProcessHeap
KERNEL32.dll852HeapFree
KERNEL32.dll754GetSystemTimeAsFileTime
KERNEL32.dll878InitializeSListHead
KERNEL32.dll900IsDebuggerPresent
KERNEL32.dll695GetProcAddress
KERNEL32.dll548GetCurrentThreadId
KERNEL32.dll907IsProcessorFeaturePresent
KERNEL32.dll1436TerminateProcess
KERNEL32.dll1405SetUnhandledExceptionFilter
KERNEL32.dll1470UnhandledExceptionFilter
KERNEL32.dll1105QueryPerformanceCounter
GDI32.dll5AddFontResourceExW
GDI32.dll806RemoveFontResourceExW
ADVAPI32.dll705RevertToSelf
ADVAPI32.dll755SetThreadToken
ADVAPI32.dll240DuplicateToken
ADVAPI32.dll533OpenProcessToken
ADVAPI32.dll665RegQueryValueExW
ADVAPI32.dll655RegOpenKeyW
ADVAPI32.dll110ControlTraceW
ADVAPI32.dll811TraceSetInformation
ADVAPI32.dll541OpenTraceW
ADVAPI32.dll765StartTraceW
ADVAPI32.dll103CloseTrace
ADVAPI32.dll578ProcessTrace
VCRUNTIME140.dll28__current_exception_context
VCRUNTIME140.dll70wcsstr
VCRUNTIME140.dll64strchr
VCRUNTIME140.dll66strstr
VCRUNTIME140.dll8__C_specific_handler
VCRUNTIME140.dll62memset
VCRUNTIME140.dll27__current_exception
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-convert-l1-1-0.dll101strtoull
api-ms-win-crt-string-l1-1-0.dll108isprint
api-ms-win-crt-string-l1-1-0.dll42_stricmp
api-ms-win-crt-string-l1-1-0.dll133strcat_s
api-ms-win-crt-string-l1-1-0.dll157wcscat_s
api-ms-win-crt-string-l1-1-0.dll137strcpy_s
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll85exit
api-ms-win-crt-runtime-l1-1-0.dll35_exit
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll4__p___argc
api-ms-win-crt-runtime-l1-1-0.dll5__p___argv
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll40_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll66_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll60_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll30_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll103terminate
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll64_seh_filter_exe
api-ms-win-crt-math-l1-1-0.dll9__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
offsetsizetypecomment
15c115HTM#
15d022064BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK