filenamer0123.exe
size27136 (0x6a00)
md5507daa350dcaa67faf6a11d65e8ff079
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072918
257234064
259234064
2612340625
2602340613
203655015
1085
265235066
255235061
258235061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x58ded5e0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x3000
SizeOfInitializedData0x3800
SizeOfUninitializedData0
AddressOfEntryPoint0x2ffc
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x2f6b0x3000R-X CODE
.rdata0x40000x170c0x1800R-- IDATA
.data0x60000x17d40x1600RW- IDATA
.gfids0x80000x4c0x200R-- IDATA
.rsrc0x90000x1e00x200R-- IDATA
.reloc0xa0000x3fc0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x4d280x118
RESOURCE0x90000x1e0
EXCEPTION00
SECURITY00
BASERELOC0xa0000x3fc
DEBUG0x45a00x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x46100x40
Bound_IAT00
IAT0x40000x170
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll1301SetPriorityClass
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1070QueryPerformanceFrequency
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll843InitializeSListHead
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll1377TerminateProcess
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll522GetCurrentProcessId
MSVCP140.dll654void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP140.dll605unsigned int __cdecl std::_Random_device(void)

?_Random_device@std@@YAIXZ

MSVCP140.dll655void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

MSVCP140.dll651void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

WinSCard.dll8SCardConnectA
WinSCard.dll20SCardFreeMemory
WinSCard.dll48SCardListReadersA
WinSCard.dll76g_rgSCardT1Pci
WinSCard.dll11SCardDisconnect
WinSCard.dll71SCardTransmit
WinSCard.dll13SCardEstablishContext
WinSCard.dll60SCardReleaseContext
VCRUNTIME140.dll71memmove
VCRUNTIME140.dll40__telemetry_main_invoke_trigger
VCRUNTIME140.dll33__std_exception_copy
VCRUNTIME140.dll1_CxxThrowException
VCRUNTIME140.dll72memset
VCRUNTIME140.dll53_except_handler4_common
VCRUNTIME140.dll70memcpy
VCRUNTIME140.dll16__CxxFrameHandler3
VCRUNTIME140.dll34__std_exception_destroy
VCRUNTIME140.dll41__telemetry_main_return_trigger
api-ms-win-crt-stdio-l1-1-0.dll127fputc
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll116fclose
api-ms-win-crt-stdio-l1-1-0.dll13__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll151setbuf
api-ms-win-crt-stdio-l1-1-0.dll125fopen
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-utility-l1-1-0.dll29srand
api-ms-win-crt-utility-l1-1-0.dll27rand
api-ms-win-crt-convert-l1-1-0.dll80atoi
api-ms-win-crt-convert-l1-1-0.dll100strtoul
api-ms-win-crt-convert-l1-1-0.dll97strtol
api-ms-win-crt-time-l1-1-0.dll48_time64
api-ms-win-crt-runtime-l1-1-0.dll5__p___argc
api-ms-win-crt-runtime-l1-1-0.dll6__p___argv
api-ms-win-crt-runtime-l1-1-0.dll23_cexit
api-ms-win-crt-runtime-l1-1-0.dll22_c_exit
api-ms-win-crt-runtime-l1-1-0.dll63_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll59_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll37_exit
api-ms-win-crt-runtime-l1-1-0.dll66_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll54_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll62_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll31_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll29_controlfp_s
api-ms-win-crt-runtime-l1-1-0.dll106terminate
api-ms-win-crt-runtime-l1-1-0.dll25_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll53_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll88exit
api-ms-win-crt-runtime-l1-1-0.dll68_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll57_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll56_initterm
api-ms-win-crt-runtime-l1-1-0.dll42_get_initial_narrow_environment
api-ms-win-crt-environment-l1-1-0.dll16getenv
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-math-l1-1-0.dll64_except1
api-ms-win-crt-math-l1-1-0.dll46__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
offsetsizetypecomment
027136EXE03/31/2017 22:19:12#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK