filenamePING.EXE
size18432 (0x4800)
md560dd39fe21bf99a2f1549a8ddb23d962
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072930
207655011
205655012
2066550120
1088
203655019
210655013
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x54503d48
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x2800
SizeOfInitializedData0x3200
SizeOfUninitializedData0
AddressOfEntryPoint0x3150
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0x133c0
Subsystem3
DllCharacteristics0xc140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x27a40x2800R-X CODE
.data0x40000x16900x200RW- IDATA
.idata0x60000xaec0xc00R-- IDATA
.rsrc0x70000x8180xa00R-- IDATA
.reloc0x80000x3280x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x61600x17c
RESOURCE0x70000x818
EXCEPTION00
SECURITY00
BASERELOC0x80000x328
DEBUG0x10500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x11980x5c
Bound_IAT00
IAT0x60000x15c
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19040
MANIFEST#17210
module_namehintordfunction_name
msvcrt.dll364_except_handler4_common
msvcrt.dll313_controlfp
msvcrt.dll490_initterm
msvcrt.dll208__p__fmode
msvcrt.dll294_cexit
msvcrt.dll373_exit
msvcrt.dll228__set_app_type
msvcrt.dll243__wgetmainargs
msvcrt.dll275_amsg_exit
msvcrt.dll203__p__commode
msvcrt.dll230__setusermatherr
msvcrt.dll113_XcptFilter
msvcrt.dll1200exit
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll496_iob
msvcrt.dll1261iswctype
msvcrt.dll1420wcstoul
msvcrt.dll1291memcpy
msvcrt.dll1394wcschr
msvcrt.dll1039_wcsicmp
msvcrt.dll1232fwprintf
msvcrt.dll1208fgetpos
msvcrt.dll1206fflush
msvcrt.dll386_fileno
msvcrt.dll844_setmode
msvcrt.dll447_get_osfhandle
msvcrt.dll1129_write
msvcrt.dll1295memset
IPHLPAPI.DLL133IcmpCreateFile
IPHLPAPI.DLL129Icmp6CreateFile
IPHLPAPI.DLL131Icmp6SendEcho2
IPHLPAPI.DLL86GetIpForwardTable
IPHLPAPI.DLL227SetCurrentThreadCompartmentId
IPHLPAPI.DLL190InternalIcmpCreateFileEx
IPHLPAPI.DLL84GetIpErrorString
IPHLPAPI.DLL137IcmpSendEcho2Ex
IPHLPAPI.DLL132IcmpCloseHandle
WS2_32.dll10InetNtopW
WS2_32.dll9GetNameInfoW
WS2_32.dll115
WS2_32.dll2FreeAddrInfoW
WS2_32.dll116
WS2_32.dll7GetAddrInfoW
api-ms-win-core-localization-l1-2-1.dll56SetThreadUILanguage
api-ms-win-core-localization-l1-2-1.dll8FormatMessageW
api-ms-win-core-registry-l1-1-0.dllRegCloseKey
api-ms-win-core-registry-l1-1-0.dll33RegQueryValueExW
api-ms-win-core-registry-l1-1-0.dll28RegOpenKeyExW
api-ms-win-core-synch-l1-2-0.dll43Sleep
api-ms-win-core-errorhandling-l1-1-1.dll11UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll10SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll3GetLastError
api-ms-win-core-console-l1-1-0.dll2GetConsoleMode
api-ms-win-core-console-l1-1-0.dll10SetConsoleCtrlHandler
api-ms-win-core-heap-l1-2-0.dll10HeapSetInformation
api-ms-win-core-processthreads-l1-1-2.dll12GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-2.dll65TerminateProcess
api-ms-win-core-processthreads-l1-1-2.dll16GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll11GetCurrentProcess
api-ms-win-core-libraryloader-l1-2-0.dll15GetModuleHandleA
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1.dll17GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll21GetTickCount
api-ms-win-core-processenvironment-l1-2-0.dll11GetEnvironmentVariableW
api-ms-win-core-file-l1-2-1.dll42GetFileType
api-ms-win-core-string-l1-1-0.dll7WideCharToMultiByte
api-ms-win-core-heap-obsolete-l1-1-0.dll10LocalFree
api-ms-win-core-heap-obsolete-l1-1-0.dll8LocalAlloc
ntdll.dll1053RtlIpv4StringToAddressW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionTCP/IP Ping Command
FileVersion6.3.9600.17415 (winblue_r4.141028-1500)
InternalNameping.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameping.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.17415

VS_FIXEDFILEINFO

FileVersion6.3.9600.17415
ProductVersion6.3.9600.17415
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
018432EXE10/29/2014 01:05:12#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK