filenameAVIFRATE.EXE
size40960 (0xa000)
md54835032dd502401549cc5b5279a3c953
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0xba2e407d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x818e
Magic0x10b
LinkerVersion2.25
SizeOfCode0x6800
SizeOfInitializedData0x2400
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion1.0
ImageVersion0.0
SubsystemVersion3.10
Reserved10
SizeOfImage0xf000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Borland C++

Sections

namevavsizeraw sizeflags
CODE0x10000x70000x6800R-X CODE
DATA0x80000x40000x1600RW- IDATA
.idata0xc0000x10000x600RW- IDATA
.edata0xd0000x10000x200R-- IDATA
.reloc0xe0000x10000x600R-- IDATA SHARED

Data Directory

typevasize
EXPORT0xd0000xb3
IMPORT0xc0000x434
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0xe0000x524
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dllGetProcAddress
KERNEL32.dllDeleteFileA
KERNEL32.dllGetCommandLineA
KERNEL32.dllExitProcess
KERNEL32.dllFindClose
KERNEL32.dllFindFirstFileA
KERNEL32.dllEnterCriticalSection
KERNEL32.dllGetStartupInfoA
KERNEL32.dllGetCurrentThreadId
KERNEL32.dllGetEnvironmentStrings
KERNEL32.dllGetFileAttributesA
KERNEL32.dllGetFileType
KERNEL32.dllGetLastError
KERNEL32.dllGetLocalTime
KERNEL32.dllGetModuleFileNameA
KERNEL32.dllFindNextFileA
KERNEL32.dllCreateFileA
KERNEL32.dllCloseHandle
KERNEL32.dllGetStdHandle
KERNEL32.dllGetVersion
KERNEL32.dllGlobalMemoryStatus
KERNEL32.dllInitializeCriticalSection
KERNEL32.dllLeaveCriticalSection
KERNEL32.dllRaiseException
KERNEL32.dllReadFile
KERNEL32.dllRtlUnwind
KERNEL32.dllSetConsoleCtrlHandler
KERNEL32.dllSetFilePointer
KERNEL32.dllSetHandleCount
KERNEL32.dllUnhandledExceptionFilter
KERNEL32.dllVirtualAlloc
KERNEL32.dllVirtualFree
KERNEL32.dllWriteFile
KERNEL32.dllGetModuleHandleA
USER32.dllwvsprintfA
USER32.dllwsprintfA
USER32.dllMessageBoxA
USER32.dllEnumThreadWindows
ordentry_vafunction_name
10x1074__GetExceptDLLinfo
20x8580__DebuggerHookData
30x39a4@__lockDebuggerData$qv
40x39cc@__unlockDebuggerData$qv
module_nameavifrate.exe
flags0
timestamp0
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0xd038
Functions(4)0xd028
NameOrdinals(4)0xd048
offsetsizetypecomment
037376EXE12/24/2068 16:49:01#
15c115HTM#
92003584BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 40960 bytes (40 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK