packed.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	packed.exe
size	751650 (0xb7822)
md5	3adf561240dfcf485d10aee7b4364ff1

type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x51ee187b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	2.22
SizeOfCode	0x40c11
SizeOfInitializedData	0xb6200
SizeOfUninitializedData	0x4e00
AddressOfEntryPoint	0xbf000
BaseOfCode	0xbf000
BaseOfData	0x42000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xbf011
SizeOfHeaders	0x400
CheckSum	0xbec08
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x40b74	0x40c00	R-X CODE IDATA
.data	0x42000	0xacc	0xc00	RW- IDATA
.rdata	0x43000	0x73964	0x73a00	R-- IDATA
.bss	0xb7000	0x4c24	0	RW- UDATA
.idata	0xbc000	0xa9c	0xc00	RW- IDATA
.CRT	0xbd000	0x34	0x200	RW- IDATA
.tls	0xbe000	0x20	0x200	RW- IDATA
.loader	0xbf000	0x11	0x11	R-X CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xbc000	0xa9c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xbe000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xbc1e8	0x1ac
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x4be019	0x4be01c	0x4b9d74	0x4bd020	0	0

module_name	hint	function_name
KERNEL32.dll	196	DeleteCriticalSection
KERNEL32.dll	223	EnterCriticalSection
KERNEL32.dll	433	GetCurrentProcess
KERNEL32.dll	434	GetCurrentProcessId
KERNEL32.dll	437	GetCurrentThreadId
KERNEL32.dll	494	GetLastError
KERNEL32.dll	510	GetModuleHandleA
KERNEL32.dll	553	GetProcAddress
KERNEL32.dll	580	GetStartupInfoA
KERNEL32.dll	603	GetSystemTimeAsFileTime
KERNEL32.dll	627	GetTickCount
KERNEL32.dll	710	InitializeCriticalSection
KERNEL32.dll	738	IsDBCSLeadByteEx
KERNEL32.dll	769	LeaveCriticalSection
KERNEL32.dll	774	LoadLibraryW
KERNEL32.dll	813	MultiByteToWideChar
KERNEL32.dll	871	QueryPerformanceCounter
KERNEL32.dll	1073	SetUnhandledExceptionFilter
KERNEL32.dll	1085	Sleep
KERNEL32.dll	1097	TerminateProcess
KERNEL32.dll	1104	TlsGetValue
KERNEL32.dll	1117	UnhandledExceptionFilter
KERNEL32.dll	1149	VirtualProtect
KERNEL32.dll	1152	VirtualQuery
KERNEL32.dll	1183	WideCharToMultiByte
msvcrt.dll	56	__dllonexit
msvcrt.dll	59	__getmainargs
msvcrt.dll	60	__initenv
msvcrt.dll	69	__lconv_init
msvcrt.dll	70	__mb_cur_max
msvcrt.dll	105	__set_app_type
msvcrt.dll	108	__setusermatherr
msvcrt.dll	122	_acmdln
msvcrt.dll	143	_amsg_exit
msvcrt.dll	160	_cexit
msvcrt.dll	209	_errno
msvcrt.dll	243	_fmode
msvcrt.dll	306	_initterm
msvcrt.dll	310	_iob
msvcrt.dll	408	_lock
msvcrt.dll	569	_onexit
msvcrt.dll	674	_stricmp
msvcrt.dll	684	_strnicmp
msvcrt.dll	857	isxdigit
msvcrt.dll	861	localeconv
msvcrt.dll	862	localtime
msvcrt.dll	866	malloc
msvcrt.dll	873	memcmp
msvcrt.dll	874	memcpy
msvcrt.dll	877	memset
msvcrt.dll	880	perror
msvcrt.dll	881	printf
msvcrt.dll	883	putc
msvcrt.dll	885	puts
msvcrt.dll	888	qsort
msvcrt.dll	893	realloc
msvcrt.dll	894	remove
msvcrt.dll	899	setlocale
msvcrt.dll	901	signal
msvcrt.dll	904	sprintf
msvcrt.dll	907	sscanf
msvcrt.dll	908	strcat
msvcrt.dll	909	strchr
msvcrt.dll	910	strcmp
msvcrt.dll	912	strcpy
msvcrt.dll	914	strcspn
msvcrt.dll	915	strerror
msvcrt.dll	917	strftime
msvcrt.dll	918	strlen
msvcrt.dll	921	strncmp
msvcrt.dll	922	strncpy
msvcrt.dll	925	strpbrk
msvcrt.dll	926	strrchr
msvcrt.dll	927	strspn
msvcrt.dll	933	strtoul
msvcrt.dll	940	_unlock
msvcrt.dll	942	_vsnprintf
msvcrt.dll	1025	abort
msvcrt.dll	1034	atoi
msvcrt.dll	1037	calloc
msvcrt.dll	1046	exit
msvcrt.dll	1049	fclose
msvcrt.dll	1051	ferror
msvcrt.dll	1052	fflush
msvcrt.dll	1053	fgetc
msvcrt.dll	1055	fgets
msvcrt.dll	1060	fopen
msvcrt.dll	1061	fprintf
msvcrt.dll	1062	fputc
msvcrt.dll	1063	fputs
msvcrt.dll	1066	fread
msvcrt.dll	1067	free
msvcrt.dll	1071	fseek
msvcrt.dll	1073	ftell
msvcrt.dll	1075	fwrite
msvcrt.dll	1079	getenv
msvcrt.dll	1083	gmtime
msvcrt.dll	1085	isalnum
msvcrt.dll	1086	isalpha
msvcrt.dll	1094	isspace
msvcrt.dll	1108	time
msvcrt.dll	1113	tolower
msvcrt.dll	1114	toupper
msvcrt.dll	1117	ungetc
msvcrt.dll	1141	wcslen

show previews

offset	size	type	comment
0	747537	EXE	07/23/2013 05:45:31	#
15c1	15	HTM		#
b6811	4113	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 751650 bytes (735 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xb9d74