filenamesnake_eater.exe
size7238040 (0x6e7198)
md552eaabffa4a20fecb4c50a937e720e7d
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
259307958
26130795186
2603079510
253319354
2613193540
2603193517
259319359
257307957
10120
2603221721
258322171

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x6514446b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.35
SizeOfCode0x29e00
SizeOfInitializedData0x25600
SizeOfUninitializedData0
AddressOfEntryPoint0xb750
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x56000
SizeOfHeaders0x400
CheckSum0x6f073c
Subsystem3
DllCharacteristics0xc160
SizeOfStackReserve0x1e8480
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x29e000x29e00R-X CODE
.rdata0x2b0000x129220x12a00R-- IDATA
.data0x3e0000x33380xe00RW- IDATA
.pdata0x420000x22ec0x2400R-- IDATA
_RDATA0x450000x15c0x200R-- IDATA
.rsrc0x460000xef8c0xf000R-- IDATA
.reloc0x550000x7580x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x3ccfc0x50
RESOURCE0x460000xef8c
EXCEPTION0x420000x22ec
SECURITY00
BASERELOC0x550000x758
DEBUG0x3a2000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x3a0c00x140
Bound_IAT00
IAT0x2b0000x378
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#137521252
ICON#222161252
ICON#313841252
ICON#4370191252
ICON#596401252
ICON#642641252
ICON#711281252
GROUP_ICON#11041252
MANIFEST#112931252
module_namehintordfunction_name
USER32.dll506GetWindowThreadProcessId
USER32.dll919ShowWindow
KERNEL32.dll657GetModuleFileNameW
KERNEL32.dll257CreateSymbolicLinkW
KERNEL32.dll717GetProcAddress
KERNEL32.dll497GetCommandLineW
KERNEL32.dll597GetEnvironmentVariableW
KERNEL32.dll1350SetEnvironmentVariableW
KERNEL32.dll380ExpandEnvironmentStringsW
KERNEL32.dll201CreateDirectoryW
KERNEL32.dll793GetTempPathW
KERNEL32.dll1552WaitForSingleObject
KERNEL32.dll1460Sleep
KERNEL32.dll600GetExitCodeProcess
KERNEL32.dll246CreateProcessW
KERNEL32.dll1344SetDllDirectoryW
KERNEL32.dll453FreeLibrary
KERNEL32.dll998LoadLibraryExW
KERNEL32.dll1307SetConsoleCtrlHandler
KERNEL32.dll399FindClose
KERNEL32.dll405FindFirstFileExW
KERNEL32.dll148CloseHandle
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll1010LocalFree
KERNEL32.dll449FormatMessageW
KERNEL32.dll1042MultiByteToWideChar
KERNEL32.dll1591WideCharToMultiByte
KERNEL32.dll545GetConsoleWindow
KERNEL32.dll819GetTimeZoneInformation
KERNEL32.dll637GetLastError
KERNEL32.dll885HeapSize
KERNEL32.dll1610WriteConsoleW
KERNEL32.dll753GetStartupInfoW
KERNEL32.dll1497TlsSetValue
KERNEL32.dll1269RtlCaptureContext
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll1476TerminateProcess
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll1136QueryPerformanceCounter
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll906InitializeSListHead
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll1283RtlUnwindEx
KERNEL32.dll1380SetLastError
KERNEL32.dll329EnterCriticalSection
KERNEL32.dll992LeaveCriticalSection
KERNEL32.dll291DeleteCriticalSection
KERNEL32.dll902InitializeCriticalSectionAndSpinCount
KERNEL32.dll1494TlsAlloc
KERNEL32.dll1496TlsGetValue
KERNEL32.dll1346SetEndOfFile
KERNEL32.dll1495TlsFree
KERNEL32.dll325EncodePointer
KERNEL32.dll1159RaiseException
KERNEL32.dll1279RtlPcToFileHeader
KERNEL32.dll496GetCommandLineA
KERNEL32.dll218CreateFileW
KERNEL32.dll587GetDriveTypeW
KERNEL32.dll611GetFileInformationByHandle
KERNEL32.dll618GetFileType
KERNEL32.dll1091PeekNamedPipe
KERNEL32.dll1473SystemTimeToTzSpecificLocalTime
KERNEL32.dll388FileTimeToSystemTime
KERNEL32.dll629GetFullPathNameW
KERNEL32.dll1247RemoveDirectoryW
KERNEL32.dll422FindNextFileW
KERNEL32.dll1407SetStdHandle
KERNEL32.dll296DeleteFileW
KERNEL32.dll1176ReadFile
KERNEL32.dll755GetStdHandle
KERNEL32.dll1611WriteFile
KERNEL32.dll376ExitProcess
KERNEL32.dll660GetModuleHandleExW
KERNEL32.dll880HeapFree
KERNEL32.dll534GetConsoleMode
KERNEL32.dll1173ReadConsoleW
KERNEL32.dll1365SetFilePointerEx
KERNEL32.dll538GetConsoleOutputCP
KERNEL32.dll616GetFileSizeEx
KERNEL32.dll876HeapAlloc
KERNEL32.dll436FlsAlloc
KERNEL32.dll438FlsGetValue
KERNEL32.dll439FlsSetValue
KERNEL32.dll437FlsFree
KERNEL32.dll170CompareStringW
KERNEL32.dll980LCMapStringW
KERNEL32.dll555GetCurrentDirectoryW
KERNEL32.dll441FlushFileBuffers
KERNEL32.dll883HeapReAlloc
KERNEL32.dll606GetFileAttributesExW
KERNEL32.dll760GetStringTypeW
KERNEL32.dll942IsValidCodePage
KERNEL32.dll460GetACP
KERNEL32.dll694GetOEMCP
KERNEL32.dll475GetCPInfo
KERNEL32.dll595GetEnvironmentStringsW
KERNEL32.dll452FreeEnvironmentStringsW
KERNEL32.dll724GetProcessHeap
ADVAPI32.dll123ConvertSidToStringSidW
ADVAPI32.dll347GetTokenInformation
ADVAPI32.dll523OpenProcessToken
ADVAPI32.dll129ConvertStringSecurityDescriptorToSecurityDescriptorW
offsetsizetypecomment
15c115HTM#
41ec037019PNG(256 x 256)#
4af5b6931005BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 7238040 bytes (7069 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER