| parent | flag.exe | |
|---|---|---|
| filename | flag.unpacked.exe | |
| size | 1601171 (0x186e93) | |
| md5 | 46b0a6f74c7844ccff036c077c70138b | |
| type | PE32 executable (console) Intel 80386, for MS Windows | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x90 |
| blocks_in_file | 3 |
| num_relocs | 0 |
| header_paragraphs | 4 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0 |
| reserved0 | 0 |
| oem_id | 0 |
| oem_info | 0 |
| reserved2 | 0 |
| reserved3 | 0 |
| reserved4 | 0 |
| reserved5 | 0 |
| reserved6 | 0 |
| lfanew | 0x80 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Sections
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0xca000 | 0xdc8 | |
| RESOURCE | 0 | 0 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0xcc004 | 0x18 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0 | 0 | |
| Delay_IAT | 0 | 0 | |
| CLR_Header | 0 | 0 |
TLS
| raw start | raw end | index | callbks | zero fill | flags | |
|---|---|---|---|---|---|---|
| 0x4cc001 | 0x4cc01c | 0x4c879c | 0x4cb004 | 0 | 0 |
| module_name | hint | ord | function_name |
|---|---|---|---|
| KERNEL32.DLL | AddAtomA | ||
| KERNEL32.DLL | CloseHandle | ||
| KERNEL32.DLL | CreateEventA | ||
| KERNEL32.DLL | CreateMutexA | ||
| KERNEL32.DLL | CreateSemaphoreA | ||
| KERNEL32.DLL | DeleteCriticalSection | ||
| KERNEL32.DLL | DuplicateHandle | ||
| KERNEL32.DLL | EnterCriticalSection | ||
| KERNEL32.DLL | ExitProcess | ||
| KERNEL32.DLL | FindAtomA | ||
| KERNEL32.DLL | GetAtomNameA | ||
| KERNEL32.DLL | GetCurrentProcess | ||
| KERNEL32.DLL | GetCurrentThread | ||
| KERNEL32.DLL | GetCurrentThreadId | ||
| KERNEL32.DLL | GetHandleInformation | ||
| KERNEL32.DLL | GetLastError | ||
| KERNEL32.DLL | GetModuleHandleA | ||
| KERNEL32.DLL | GetProcAddress | ||
| KERNEL32.DLL | GetProcessAffinityMask | ||
| KERNEL32.DLL | GetSystemTimeAsFileTime | ||
| KERNEL32.DLL | GetThreadContext | ||
| KERNEL32.DLL | GetThreadPriority | ||
| KERNEL32.DLL | InitializeCriticalSection | ||
| KERNEL32.DLL | InterlockedDecrement | ||
| KERNEL32.DLL | InterlockedExchange | ||
| KERNEL32.DLL | InterlockedExchangeAdd | ||
| KERNEL32.DLL | InterlockedIncrement | ||
| KERNEL32.DLL | IsDBCSLeadByteEx | ||
| KERNEL32.DLL | LeaveCriticalSection | ||
| KERNEL32.DLL | MultiByteToWideChar | ||
| KERNEL32.DLL | ReleaseMutex | ||
| KERNEL32.DLL | ReleaseSemaphore | ||
| KERNEL32.DLL | ResetEvent | ||
| KERNEL32.DLL | ResumeThread | ||
| KERNEL32.DLL | SetCriticalSectionSpinCount | ||
| KERNEL32.DLL | SetEvent | ||
| KERNEL32.DLL | SetLastError | ||
| KERNEL32.DLL | SetProcessAffinityMask | ||
| KERNEL32.DLL | SetThreadContext | ||
| KERNEL32.DLL | SetThreadPriority | ||
| KERNEL32.DLL | SetUnhandledExceptionFilter | ||
| KERNEL32.DLL | Sleep | ||
| KERNEL32.DLL | SuspendThread | ||
| KERNEL32.DLL | TlsAlloc | ||
| KERNEL32.DLL | TlsGetValue | ||
| KERNEL32.DLL | TlsSetValue | ||
| KERNEL32.DLL | TryEnterCriticalSection | ||
| KERNEL32.DLL | VirtualProtect | ||
| KERNEL32.DLL | VirtualQuery | ||
| KERNEL32.DLL | WaitForMultipleObjects | ||
| KERNEL32.DLL | WaitForSingleObject | ||
| KERNEL32.DLL | WideCharToMultiByte | ||
| msvcrt.dll | __getmainargs | ||
| msvcrt.dll | __mb_cur_max | ||
| msvcrt.dll | __p__environ | ||
| msvcrt.dll | __p__fmode | ||
| msvcrt.dll | __set_app_type | ||
| msvcrt.dll | _beginthreadex | ||
| msvcrt.dll | _cexit | ||
| msvcrt.dll | _endthreadex | ||
| msvcrt.dll | _errno | ||
| msvcrt.dll | _filelengthi64 | ||
| msvcrt.dll | _fstati64 | ||
| msvcrt.dll | _iob | ||
| msvcrt.dll | _lseeki64 | ||
| msvcrt.dll | _onexit | ||
| msvcrt.dll | _setjmp | ||
| msvcrt.dll | _setmode | ||
| msvcrt.dll | abort | ||
| msvcrt.dll | atexit | ||
| msvcrt.dll | atoi | ||
| msvcrt.dll | calloc | ||
| msvcrt.dll | exit | ||
| msvcrt.dll | fclose | ||
| msvcrt.dll | fflush | ||
| msvcrt.dll | fgetpos | ||
| msvcrt.dll | fopen | ||
| msvcrt.dll | fprintf | ||
| msvcrt.dll | fputc | ||
| msvcrt.dll | fputs | ||
| msvcrt.dll | fread | ||
| msvcrt.dll | free | ||
| msvcrt.dll | fsetpos | ||
| msvcrt.dll | fwrite | ||
| msvcrt.dll | getc | ||
| msvcrt.dll | getenv | ||
| msvcrt.dll | getwc | ||
| msvcrt.dll | iswctype | ||
| msvcrt.dll | localeconv | ||
| msvcrt.dll | longjmp | ||
| msvcrt.dll | malloc | ||
| msvcrt.dll | memchr | ||
| msvcrt.dll | memcmp | ||
| msvcrt.dll | memcpy | ||
| msvcrt.dll | memmove | ||
| msvcrt.dll | memset | ||
| msvcrt.dll | printf | ||
| msvcrt.dll | putc | ||
| msvcrt.dll | putwc | ||
| msvcrt.dll | rand | ||
| msvcrt.dll | realloc | ||
| msvcrt.dll | setlocale | ||
| msvcrt.dll | setvbuf | ||
| msvcrt.dll | signal | ||
| msvcrt.dll | sprintf | ||
| msvcrt.dll | srand | ||
| msvcrt.dll | strchr | ||
| msvcrt.dll | strcmp | ||
| msvcrt.dll | strcoll | ||
| msvcrt.dll | strerror | ||
| msvcrt.dll | strftime | ||
| msvcrt.dll | strlen | ||
| msvcrt.dll | strtod | ||
| msvcrt.dll | strtoul | ||
| msvcrt.dll | strxfrm | ||
| msvcrt.dll | system | ||
| msvcrt.dll | time | ||
| msvcrt.dll | towlower | ||
| msvcrt.dll | towupper | ||
| msvcrt.dll | ungetc | ||
| msvcrt.dll | ungetwc | ||
| msvcrt.dll | vfprintf | ||
| msvcrt.dll | wcscoll | ||
| msvcrt.dll | wcsftime | ||
| msvcrt.dll | wcslen | ||
| msvcrt.dll | wcsxfrm | ||
| msvcrt.dll | _fdopen | ||
| msvcrt.dll | _read | ||
| msvcrt.dll | _write |
 |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[?] can't find file_offset of VA 0xc879c