Demo23.exe

info
MZ
PE
resources
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	Demo23.exe
size	208299 (0x32dab)
md5	51b4485869c08c1130c8e77d5a07fb51

type	MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x454b
blocks_in_file	0x4e52
num_relocs	0x4c45
header_paragraphs	0x3233
min_extra_paragraphs	0x442e
max_extra_paragraphs	0x4c4c
ss	0
sp	0x4550
checksum	0
ip	0x14c
cs	3
reloc_table_offset	0xb0be
overlay_number	0x4011
reserved0	0x7ceb3476ff50ad00
oem_id	0x148
oem_info	0x10f
reserved2	0x6f4c010b
reserved3	0x694c6461
reserved4	0x72617262
reserved5	0x4179
reserved6	0x1018
lfanew	0x10

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4011b0be
PointerToSymbolTable	0xff50ad00
NumberOfSymbols	0x7ceb3476
SizeOfOptionalHeader	0x148
Characteristics	0x10f
Magic	0x10b
LinkerVersion	76.111
SizeOfCode	0x694c6461
SizeOfInitializedData	0x72617262
SizeOfUninitializedData	0x4179
AddressOfEntryPoint	0x1018
BaseOfCode	0x10
BaseOfData	0x2e000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.57
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x72000
SizeOfHeaders	0x200
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0xa

Packer / Compiler

Upack v0.36 (Dwing)

Sections

name	va	vsize	raw size	flags
PS��	0x1000	0x50000	0x1f0	RWX CODE IDATA
@��F	0x51000	0x20000	0x17fc4	RWX CODE IDATA
�E�@	0x71000	0x1000	0x1f0	RWX CODE IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x711ee	0x14
RESOURCE	0x51000	0x2390
EXCEPTION	0xad3876ff	0xbe3e8b50
SECURITY	0x4710f0	0xf359276a
BASERELOC	0x476ffa5	0x8bffc883
DEBUG	0x1cebabdf	0
ARCHITECTURE	0x50746547	0x41636f72
GLOBALPTR	0x65726464	0x7373
TLS	0	0

show previews

type	name	size
ICON	#1	2216
ICON	#2	1384
ICON	#3	3752
DIALOG	#101	534
DIALOG	#201	470
DIALOG	#301	174
DIALOG	#401	390
DIALOG	#501	308
DIALOG	#701	390
STRING	#2	236
STRING	#41	80
STRING	#55	108
STRING	#56	136
STRING	#67	368
STRING	#68	196
STRING	#69	182
STRING	#72	122
GROUP_ICON	MAIN_ICON	48
MANIFEST	#1	636

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	202715	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 208299 bytes (204 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] unusual size of IMAGE_OPTIONAL_HEADER = 328 (must be 224)

[?] 104 spare bytes after IMAGE_OPTIONAL_HEADER

[?] invalid DOS stub size -205600

[?] can't find file_offset of VA 0x4e118

[?] can't find file_offset of VA 0x4e3e0

[?] can't find file_offset of VA 0x4e330

[?] can't find file_offset of VA 0x4e5b8

[?] can't find file_offset of VA 0x4e8c8

[?] can't find file_offset of VA 0x4e740

[?] can't find file_offset of VA 0x4ec80

[?] can't find file_offset of VA 0x4ed70

[?] can't find file_offset of VA 0x4edc0

[?] can't find file_offset of VA 0x4ee30

[?] can't find file_offset of VA 0x4eeb8

[?] can't find file_offset of VA 0x4f028

[?] can't find file_offset of VA 0x4f0f0

[?] can't find file_offset of VA 0x4f1a8

[?] non-empty last IMAGE_IMPORT_DESCRIPTOR: #<struct PEdump::IMAGE_IMPORT_DESCRIPTOR OriginalFirstThunk=4584, TimeDateStamp=0, ForwarderChain=0, Name=0, FirstThunk=196613, module_name=nil, original_first_thunk=nil, first_thunk=nil>

[?] invalid DOS stub size -205600

[?] can't find file_offset of VA 0xad3876ff

[?] can't find file_offset of VA 0x476ffa5

[?] can't find file_offset of VA 0x1cebabdf

[?] can't find file_offset of VA 0x50746547

[?] can't find file_offset of VA 0x65726464