filenameDownloader_VS.exe
size42496 (0xa600)
md5574cc722e9e071d9fd32d1865e023087
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x120

Rich Header

lib idversiontimes used
199411186
261286191
260286192
259286199
261274125
260274124
257270322
260288068
2612880662
257274123
10157
261283161
265291113
255291111
258291111

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5f5c1f91
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.27
SizeOfCode0x6200
SizeOfInitializedData0x4800
SizeOfUninitializedData0
AddressOfEntryPoint0x32a0
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xe000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x615a0x6200R-X CODE
.rdata0x80000x2fe80x3000R-- IDATA
.data0xb0000xa500x400RW- IDATA
.rsrc0xc0000x1e00x200R-- IDATA
.reloc0xd0000x8e00xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xa8900x3c
RESOURCE0xc0000x1e0
EXCEPTION00
SECURITY00
BASERELOC0xd0000x8e0
DEBUG0x980c0x70
ARCHITECTURE00
GLOBALPTR00
TLS0x99380x18
LOAD_CONFIG0x98800x40
Bound_IAT00
IAT0x80000x168
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x40a1a80x40a1b00x40b7180x4081b000x300000
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll688GetProcAddress
KERNEL32.dll429FreeLibrary
KERNEL32.dll1422TerminateProcess
KERNEL32.dll537GetCurrentProcess
KERNEL32.dll267DecodePointer
KERNEL32.dll303EncodePointer
KERNEL32.dll274DeleteCriticalSection
KERNEL32.dll960LeaveCriticalSection
KERNEL32.dll307EnterCriticalSection
KERNEL32.dll859InitOnceExecuteOnce
KERNEL32.dll634GetModuleHandleW
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll1391SetUnhandledExceptionFilter
KERNEL32.dll1455UnhandledExceptionFilter
KERNEL32.dll897IsDebuggerPresent
KERNEL32.dll869InitializeSListHead
KERNEL32.dll866InitializeCriticalSectionEx
KERNEL32.dll778GetTickCount64
KERNEL32.dll747GetSystemTimeAsFileTime
KERNEL32.dll542GetCurrentThreadId
KERNEL32.dll538GetCurrentProcessId
KERNEL32.dll1102QueryPerformanceCounter
msvcrt.dll354_exit
msvcrt.dll804_set_fmode
msvcrt.dll276_cexit
msvcrt.dll272_c_exit
msvcrt.dll185__p__commode
msvcrt.dll131__argc
msvcrt.dll132__argv
msvcrt.dll23_environ
msvcrt.dll257_amsg_exit
msvcrt.dll345_except_handler4_common
msvcrt.dll145__getmainargs
msvcrt.dll1150atexit
msvcrt.dll296_controlfp_s
msvcrt.dll1262memset
msvcrt.dll99_CxxThrowException
msvcrt.dll1260memmove
msvcrt.dll1170fclose
msvcrt.dll1173fflush
msvcrt.dll1174fgetc
msvcrt.dll1175fgetpos
msvcrt.dll1189fread
msvcrt.dll1197fsetpos
msvcrt.dll393_fseeki64
msvcrt.dll1287setvbuf
msvcrt.dll1341ungetc
msvcrt.dll1246malloc
msvcrt.dll1286setlocale
msvcrt.dll20__uncaught_exception
msvcrt.dll1142abort
msvcrt.dll470_initterm_e
msvcrt.dll120__DestructExceptionObject
msvcrt.dll474_invalid_parameter
msvcrt.dll210__set_app_type
msvcrt.dll578_lock
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll475_iob
msvcrt.dll478_isatty
msvcrt.dll367_fileno
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll212__setusermatherr
msvcrt.dll1190free
msvcrt.dll50public: char const * __thiscall type_info::name(void)const

?name@type_info@@QBEPBDXZ

msvcrt.dll11public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dll9public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

msvcrt.dll16public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dll57public: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dll764_purecall
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll43void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

msvcrt.dll115__CxxFrameHandler3
msvcrt.dll1258memcpy
msvcrt.dll125___lc_codepage_func
msvcrt.dll127___lc_handle_func
msvcrt.dll138__crtLCMapStringA
msvcrt.dll1157calloc
msvcrt.dll342_errno
msvcrt.dll1219islower
msvcrt.dll1223isupper
msvcrt.dll206__pctype_func
msvcrt.dll1167exit
msvcrt.dllfputc
msvcrt.dll2fwrite
offsetsizetypecomment
042496EXE09/12/2020 01:08:33#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xb718