filename1.orig
size61952 (0xf200)
md55f9a20ef087eb163a5bb8ebffd51353c
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
2065062819
207506289
203506284
1081
185307163
207507272
201507271
204507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x546b3419
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0xa400
SizeOfInitializedData0x4e00
SizeOfUninitializedData0
AddressOfEntryPoint0x11104
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x23000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000xa3ed0xa400R-X CODE
.rdata0x1c0000x2b4c0x2c00R-- IDATA
.data0x1f0000x67c0x400RW- IDATA
.idata0x200000xbf80xc00RW- IDATA
.rsrc0x210000x43c0x600R-- IDATA
.reloc0x220000x7340x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x200000x50
RESOURCE0x210000x43c
EXCEPTION00
SECURITY00
BASERELOC0x220000x564
DEBUG0x1c9400x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1db500x40
Bound_IAT00
IAT0x202540x204
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll214CreateFileW
KERNEL32.dll596GetFileSize
KERNEL32.dll1112ReadFile
KERNEL32.dll142CloseHandle
KERNEL32.dll618GetLastError
KERNEL32.dll637GetModuleFileNameW
KERNEL32.dll440FreeLibrary
KERNEL32.dll1459VirtualQuery
KERNEL32.dll698GetProcessHeap
KERNEL32.dll849HeapFree
KERNEL32.dll845HeapAlloc
KERNEL32.dll785GetTickCount64
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll1501WideCharToMultiByte
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll963LoadLibraryW
KERNEL32.dll1564lstrlenA
KERNEL32.dll962LoadLibraryExW
KERNEL32.dll693GetProcAddress
KERNEL32.dll1096RaiseException
KERNEL32.dll899IsDebuggerPresent
KERNEL32.dll279DecodePointer
KERNEL32.dll316EncodePointer
KERNEL32.dll641GetModuleHandleW
MSVCP110D.dll457void __cdecl std::_Debug_message(wchar_t const *, wchar_t const *, unsigned int)

?_Debug_message@std@@YAXPB_W0I@Z

MSVCP110D.dll160public: __thiscall std::_Container_base12::~_Container_base12(void)

??1_Container_base12@std@@QAE@XZ

MSVCP110D.dll654public: void __thiscall std::_Container_base12::_Orphan_all(void)

?_Orphan_all@_Container_base12@std@@QAEXXZ

MSVCP110D.dll738void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP110D.dll741void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP110D.dll742void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

MSVCP110D.dll713char const * __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPBDH@Z

MSVCP110D.dll734char const * __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAPBDH@Z

MSVCP110D.dll94public: __thiscall std::_Container_base12::_Container_base12(void)

??0_Container_base12@std@@QAE@XZ

MSVCR110D.dll539__wgetmainargs
MSVCR110D.dll517__set_app_type
MSVCR110D.dll371_CrtSetCheckCount
MSVCR110D.dll668_exit
MSVCR110D.dll410__CxxFrameHandler3
MSVCR110D.dll603_configthreadlocale
MSVCR110D.dll519__setusermatherr
MSVCR110D.dll808_initterm_e
MSVCR110D.dll807_initterm
MSVCR110D.dll540__winitenv
MSVCR110D.dll696_fmode
MSVCR110D.dll602_commode
MSVCR110D.dll659_except_handler4_common
MSVCR110D.dll621_crt_debugger_hook
MSVCR110D.dll444__crtUnhandledException
MSVCR110D.dll443__crtTerminateProcess
MSVCR110D.dll562_amsg_exit
MSVCR110D.dll442__crtSetUnhandledExceptionFilter
MSVCR110D.dll813_invoke_watson
MSVCR110D.dll606_controlfp_s
MSVCR110D.dll1726wcscpy_s
MSVCR110D.dll1448_wmakepath_s
MSVCR110D.dll1482_wsplitpath_s
MSVCR110D.dll381_CxxThrowException
MSVCR110D.dll1614malloc
MSVCR110D.dll1533exit
MSVCR110D.dll1674strlen
MSVCR110D.dll1625memcpy
MSVCR110D.dll1627memmove
MSVCR110D.dll1633printf
MSVCR110D.dll1572getchar
MSVCR110D.dll115void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR110D.dll113void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR110D.dll1114_purecall
MSVCR110D.dll401_XcptFilter
MSVCR110D.dll112public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCR110D.dll349_CRT_RTC_INITW
MSVCR110D.dll1099_onexit
MSVCR110D.dll446__dllonexit
MSVCR110D.dll584_calloc_dbg
MSVCR110D.dll354_CrtDbgReportW
MSVCR110D.dll1297_unlock
MSVCR110D.dll317void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR110D.dll931_lock
MSVCR110D.dll585_cexit
offsetsizetypecomment
061952EXE11/18/2014 11:57:13#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK