filenameHash.exe
size29184 (0x7200)
md55ed9d3341034c227b46a2b393b1b70bd
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
480472
1472994
10804711
2592106
9320672
9321797
1085
10030776
9430521
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x45319d7a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x4800
SizeOfInitializedData0xa600
SizeOfUninitializedData0
AddressOfEntryPoint0x532c
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x12000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x470c0x4800R-X CODE
.rdata0x60000xf940x1000R-- IDATA
.data0x70000x81bc0x200RW- IDATA
.rsrc0x100000x12400x1400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x67600xb4
RESOURCE0x100000x1240
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x61800x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x60000x174
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#122160
DIALOG#1017680
GROUP_ICON#102200
VERSION#17440
MANIFEST#15330
module_namehintordfunction_name
KERNEL32.dll899WaitForSingleObject
KERNEL32.dll777SetEvent
KERNEL32.dll73CreateEventA
KERNEL32.dll822SetThreadPriority
KERNEL32.dll46CloseHandle
KERNEL32.dll709ResumeThread
KERNEL32.dll77CreateFileA
KERNEL32.dll347GetFileSize
KERNEL32.dll953lstrcpynA
KERNEL32.dll505GlobalLock
KERNEL32.dll470GetTimeFormatA
KERNEL32.dll234FormatMessageA
KERNEL32.dll319GetDateFormatA
KERNEL32.dll916WriteFile
KERNEL32.dll956lstrlenA
KERNEL32.dll494GlobalAlloc
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll188FileTimeToSystemTime
KERNEL32.dll681ReadFile
KERNEL32.dll512GlobalUnlock
KERNEL32.dll201FindFirstFileA
KERNEL32.dll361GetLastError
KERNEL32.dll197FindClose
KERNEL32.dll211FindNextFileA
KERNEL32.dll312GetCurrentDirectoryA
KERNEL32.dll349GetFileTime
KERNEL32.dll187FileTimeToLocalFileTime
KERNEL32.dll594LocalFree
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll474GetUserDefaultLangID
KERNEL32.dll944lstrcmpA
KERNEL32.dll431GetStartupInfoA
USER32.dll196EnableWindow
USER32.dll534RegisterClassA
USER32.dll66CloseClipboard
USER32.dll278GetFocus
USER32.dll445LoadIconA
USER32.dll726wsprintfA
USER32.dll598SetFocus
USER32.dll595SetDlgItemTextA
USER32.dll691UnregisterClassA
USER32.dll193EmptyClipboard
USER32.dll273GetDlgItem
USER32.dll198EndDialog
USER32.dll56CheckDlgButton
USER32.dll419IsDlgButtonChecked
USER32.dll246GetClassInfoA
USER32.dll513PostMessageA
USER32.dll501OpenClipboard
USER32.dll646SetWindowTextA
USER32.dll158DialogBoxParamA
USER32.dll586SetClipboardData
USER32.dll571SendMessageA
comdlg32.dll11GetSaveFileNameA
comdlg32.dll9GetOpenFileNameA
SHELL32.dll30DragAcceptFiles
SHELL32.dll33DragQueryFileA
MSVCRT.dll328_makepath
MSVCRT.dll183_controlfp
MSVCRT.dll202_except_handler3
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll143_acmdln
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
MSVCRT.dll390_onexit
MSVCRT.dll85__dllonexit
MSVCRT.dll441_splitpath
MSVCRT.dll481_vsnprintf
MSVCRT.dll430_snprintf
MSVCRT.dll166_beginthreadex
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll664memmove
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

SHLWAPI.dll19PathAddBackslashA
COMCTL32.dll93InitCommonControlsEx
VERSION.dll10VerQueryValueA
VERSION.dll1GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA

StringTable 040904b0

CommentsFile hasher
CompanyNamekeir.net
FileDescriptionFile hasher
FileVersion1, 0, 4, 0
InternalNameHash
LegalCopyrightCopyright (C) 2006 Robin Keir
OriginalFilenameHash.exe
ProductNameHash
ProductVersion1, 0, 4, 0

VS_FIXEDFILEINFO

FileVersion1.0.4.0
ProductVersion1.0.4.0
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
029184EXE10/15/2006 02:31:22#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK