filenameSHA_Teaser_bin100_4d128dfbfedbd7e9a7fc47f9b7c9af9d.exe
size827488 (0xca060)
md54d128dfbfedbd7e9a7fc47f9b7c9af9d
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1472994
484472
12729112
10111
9340359
10844726
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x50a21a5d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0xb000
SizeOfInitializedData0xbe000
SizeOfUninitializedData0
AddressOfEntryPoint0x8cca
BaseOfCode0x1000
BaseOfData0xc000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xca000
SizeOfHeaders0x1000
CheckSum0xd63e6
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x1000000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000xa8d00xb000R-X CODE
.rdata0xc0000x1c900x2000R-- IDATA
.data0xe0000x18600x2000RW- IDATA
.rsrc0x100000xb95880xba000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xd4440x78
RESOURCE0x100000xb9588
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0xc1d00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0xc0000x1d0
Delay_IAT00
CLR_Header00
typenamesizecp
BFS#17574281252
VERSION#16601252
MANIFEST#18371252
module_namehintordfunction_name
COMCTL32.dll17
KERNEL32.dll594LoadLibraryA
KERNEL32.dll489GetVersionExA
KERNEL32.dll438GetShortPathNameW
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll206FindClose
KERNEL32.dll210FindFirstFileA
KERNEL32.dll276GetComputerNameA
KERNEL32.dll52CloseHandle
KERNEL32.dll354GetFileInformationByHandle
KERNEL32.dll83CreateFileA
KERNEL32.dll859SystemTimeToFileTime
KERNEL32.dll799SetFileTime
KERNEL32.dll369GetLastError
KERNEL32.dll220FindNextFileA
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll653OutputDebugStringA
KERNEL32.dll416GetProcAddress
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll469GetTempPathA
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll787SetEnvironmentVariableA
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll595LoadLibraryExA
KERNEL32.dll613LockResource
KERNEL32.dll599LoadResource
KERNEL32.dll227FindResourceA
KERNEL32.dll808SetLastError
KERNEL32.dll902VirtualProtect
KERNEL32.dll899VirtualFree
KERNEL32.dll897VirtualAlloc
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll186ExitThread
KERNEL32.dll248FreeLibrary
KERNEL32.dll593LeaveCriticalSection
USER32.dll479MessageBoxA
ADVAPI32.dll292GetUserNameA
MSVCRT.dll183_controlfp
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll696strcmp
MSVCRT.dll600fprintf
MSVCRT.dll275_iob
MSVCRT.dll588fclose
MSVCRT.dll702strlen
MSVCRT.dll594fgets
MSVCRT.dll599fopen
MSVCRT.dll690sprintf
MSVCRT.dll694strcat
MSVCRT.dll698strcpy
MSVCRT.dll618getenv
MSVCRT.dll742wcslen
MSVCRT.dll663memcpy
MSVCRT.dll662memcmp
MSVCRT.dll695strchr
MSVCRT.dll709strstr
MSVCRT.dll720time
MSVCRT.dll241_ftol
MSVCRT.dll653localtime
MSVCRT.dll574atol
MSVCRT.dll398_pctype
MSVCRT.dll277_isctype
MSVCRT.dll97__mb_cur_max
MSVCRT.dll573atoi
MSVCRT.dll614fwrite
MSVCRT.dll678rand
MSVCRT.dll692srand
MSVCRT.dll605fread
MSVCRT.dll200_errno
MSVCRT.dll705strncpy
MSVCRT.dll591fflush
MSVCRT.dll601fputc
MSVCRT.dll602fputs
MSVCRT.dll732vsprintf
MSVCRT.dll109__p__environ
MSVCRT.dll665memset
MSVCRT.dll668perror
MSVCRT.dll564abort
MSVCRT.dll424_setjmp3
MSVCRT.dll724toupper
MSVCRT.dll664memmove
MSVCRT.dll707strrchr
MSVCRT.dll737wcscmp
MSVCRT.dll442_stat
MSVCRT.dll447_strdup
MSVCRT.dll386_mkdir
MSVCRT.dll257_getpid
MSVCRT.dll176_chmod
MSVCRT.dll453_strnicmp
MSVCRT.dll194_dup2
MSVCRT.dll222_fileno
MSVCRT.dll404_putenv
MSVCRT.dll409_rmdir
MSVCRT.dll477_unlink
MSVCRT.dll449_stricmp
MSVCRT.dll85__dllonexit
MSVCRT.dll390_onexit
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll100__p___initenv
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll576calloc

StringTable 000004B0

CompanyName
FileDescription
FileVersion0.0.0.0
ProductName
ProductVersion0.0.0.0
LegalCopyright
LegalTrademarks
OriginalFilenameSHA_Teaser_bin100.exe
InternalNameSHA_Teaser_bin100.exe

VS_FIXEDFILEINFO

FileVersion0.0.0.0
ProductVersion0.0.0.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0
FileType0
FileSubtype0
offsetsizetypecomment
0827392EXE11/13/2012 10:01:01#
15c115HTM#
ca00096BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK