ihloaderx64.exe

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	ihloaderx64.exe
size	1001472 (0xf4800)
md5	5c73a7b95398d975b56fd43bfc91a68a

type	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x40
blocks_in_file	1
num_relocs	0
header_paragraphs	2
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0xa
overlay_number	0
reserved0	0xeba1f0e00000000
oem_id	0xb400
oem_info	0xcd09
reserved2	0x4c01b821
reserved3	0x695721cd
reserved4	0x2034366e
reserved5	0x4558452e
reserved6	0x240a0d2e
lfanew	0x40

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 57 69  |........!..L.!Wi|
00000010: 6e 36 34 20 2e 45 58 45  2e 0d 0a 24 40 00 00 00  |n64 .EXE...$@...|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	3
TimeDateStamp	0x528539d7
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x222
Magic	0x20b
LinkerVersion	10.0
SizeOfCode	0x103c00
SizeOfInitializedData	0x137800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2428d6
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x256000
SizeOfHeaders	0x200
CheckSum	0xfa0ae
Subsystem	2
DllCharacteristics	0x8100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.MPRESS1	0x1000	0x241000	0xe2000	RWX CODE IDATA UDATA
.MPRESS2	0x242000	0x13d0	0x1400	RWX CODE IDATA UDATA
.rsrc	0x244000	0x110b4	0x11200	RW- IDATA

Data Directory

type	va	size
EXPORT	0x242000	0x634
IMPORT	0x242634	0x2a8
RESOURCE	0x244000	0x110b4
EXCEPTION	0x195000	0xe0e8
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x242710	0xa0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
BITMAP	#102	547720	1252
ICON	#1	67624	1252
ICON	#2	1128	1252
GROUP_ICON	#101	20	1252
GROUP_ICON	#104	20	1252
MANIFEST	#1	620	1252

module_name	ord	function_name
KERNEL32		GetModuleHandleA
KERNEL32		GetProcAddress
WS2_32.dll	57
WLDAP32.dll	22
SHELL32.dll		ShellExecuteA
Secur32.dll		GetUserNameExA
ADVAPI32.dll		RegCloseKey
USER32.dll		SetTimer
GDI32.dll		SetBkMode
MSVCP100.dll		void __cdecl std::_Xlength_error(char const * __ptr64) ?_Xlength_error@std@@YAXPEBD@Z
MSVCR100.dll		feof

ord	entry_va	function_name
1	0x124e0	curl_easy_cleanup
2	0x12570	curl_easy_duphandle
3	0x3f0e0	curl_easy_escape
4	0x12540	curl_easy_getinfo
5	0x12310	curl_easy_init
6	0x12820	curl_easy_pause
7	0x12390	curl_easy_perform
8	0x12a10	curl_easy_recv
9	0x12770	curl_easy_reset
10	0x12a80	curl_easy_send
11	0x12360	curl_easy_setopt
12	0x12b30	curl_easy_strerror
13	0x3f330	curl_easy_unescape
14	0x3f3b0	curl_escape
15	0x45c80	curl_formadd
16	0x45ed0	curl_formfree
17	0x46980	curl_formget
18	0x3f390	curl_free
19	0x42910	curl_getdate
20	0x3f040	curl_getenv
21	0x122c0	curl_global_cleanup
22	0x12140	curl_global_init
23	0x12210	curl_global_init_mem
24	0x226f0	curl_maprintf
25	0x228b0	curl_mfprintf
26	0x22860	curl_mprintf
27	0x21cd0	curl_msnprintf
28	0x22820	curl_msprintf
29	0x1c000	curl_multi_add_handle
30	0x1bea0	curl_multi_assign
31	0x1b5c0	curl_multi_cleanup
32	0x1b160	curl_multi_fdset
33	0x1b730	curl_multi_info_read
34	0x1af20	curl_multi_init
35	0x1d3c0	curl_multi_perform
36	0x1c4e0	curl_multi_remove_handle
37	0x1b890	curl_multi_setopt
38	0x1d780	curl_multi_socket
39	0x1d7c0	curl_multi_socket_action
40	0x1d800	curl_multi_socket_all
41	0x12f40	curl_multi_strerror
42	0x1bb10	curl_multi_timeout
43	0x1b2f0	curl_multi_wait
44	0x22790	curl_mvaprintf
45	0x22950	curl_mvfprintf
46	0x22910	curl_mvprintf
47	0x21c70	curl_mvsnprintf
48	0x228e0	curl_mvsprintf
49	0x27490	curl_share_cleanup
50	0x272c0	curl_share_init
51	0x272e0	curl_share_setopt
52	0x12fd0	curl_share_strerror
53	0x1e940	curl_slist_append
54	0x1e9e0	curl_slist_free_all
55	0x41b70	curl_strequal
56	0x41b90	curl_strnequal
57	0x3f3c0	curl_unescape

module_name	nxloader.exe
flags	0
timestamp	2013-11-14 21:00:05
version	0.0
ordinal_base	1
nFunctions	57
nNames	57
Names(57)	0x242119
Functions(57)	0x242028
NameOrdinals(57)	0x2425bf

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	995888	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x1a4190

[?] can't find file_offset of VA 0x195000