sh.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	sh.exe
size	564224 (0x89c00)
md5	62889b910675c97d27f4c3967786e2af

type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x54441ecb
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30f
Magic	0x10b
LinkerVersion	2.56
SizeOfCode	0x6fa00
SizeOfInitializedData	0x19e00
SizeOfUninitializedData	0x4400
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x71000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x91000
SizeOfHeaders	0x400
CheckSum	0x93a41
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6f860	0x6fa00	R-X CODE
.data	0x71000	0x18aac	0x18c00	RW- IDATA
.data_cy	0x8a000	4	0x200	RW- IDATA
.bss	0x8b000	0x4378	0	RW- UDATA
.idata	0x90000	0xff4	0x1000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x90000	0xff4
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
msys-1.0.dll	9	__errno
msys-1.0.dll	27	__main
msys-1.0.dll	98	_ctype_
msys-1.0.dll	532	abort
msys-1.0.dll	535	access
msys-1.0.dll	549	alarm
msys-1.0.dll	566	atoi
msys-1.0.dll	567	atol
msys-1.0.dll	569	bcopy
msys-1.0.dll	575	calloc
msys-1.0.dll	584	chdir
msys-1.0.dll	591	close
msys-1.0.dll	592	closedir
msys-1.0.dll	594	connect
msys-1.0.dll	621	cygwin_conv_to_full_posix_path
msys-1.0.dll	623	cygwin_conv_to_posix_path
msys-1.0.dll	624	cygwin_conv_to_win32_path
msys-1.0.dll	625	cygwin_internal
msys-1.0.dll	640	dlclose
msys-1.0.dll	641	dlerror
msys-1.0.dll	643	dll_crt0__FP11per_process
msys-1.0.dll	647	dlopen
msys-1.0.dll	648	dlsym
msys-1.0.dll	652	dup
msys-1.0.dll	653	dup2
msys-1.0.dll	657	endgrent
msys-1.0.dll	660	endpwent
msys-1.0.dll	670	execve
msys-1.0.dll	672	exit
msys-1.0.dll	683	fclose
msys-1.0.dll	684	fcntl
msys-1.0.dll	688	fdopen
msys-1.0.dll	691	fflush
msys-1.0.dll	695	fgets
msys-1.0.dll	696	fileno
msys-1.0.dll	704	fopen
msys-1.0.dll	705	fork
msys-1.0.dll	707	fprintf
msys-1.0.dll	708	fputc
msys-1.0.dll	709	fputs
msys-1.0.dll	711	free
msys-1.0.dll	719	fstat
msys-1.0.dll	725	fwrite
msys-1.0.dll	735	getcwd
msys-1.0.dll	737	getdtablesize
msys-1.0.dll	738	getegid
msys-1.0.dll	740	geteuid
msys-1.0.dll	741	getgid
msys-1.0.dll	742	getgrent
msys-1.0.dll	745	getgroups
msys-1.0.dll	747	gethostbyname
msys-1.0.dll	748	gethostname
msys-1.0.dll	755	getpeername
msys-1.0.dll	757	getpgrp
msys-1.0.dll	758	getpid
msys-1.0.dll	759	getppid
msys-1.0.dll	763	getpwent
msys-1.0.dll	764	getpwnam
msys-1.0.dll	766	getpwuid
msys-1.0.dll	768	getrlimit
msys-1.0.dll	769	getrusage
msys-1.0.dll	771	getservbyname
msys-1.0.dll	775	gettimeofday
msys-1.0.dll	776	getuid
msys-1.0.dll	795	inet_aton
msys-1.0.dll	804	ioctl
msys-1.0.dll	809	isatty
msys-1.0.dll	813	isinf
msys-1.0.dll	816	isnan
msys-1.0.dll	830	kill
msys-1.0.dll	831	killpg
msys-1.0.dll	845	localeconv
msys-1.0.dll	846	localtime
msys-1.0.dll	858	longjmp
msys-1.0.dll	860	lseek
msys-1.0.dll	861	lstat
msys-1.0.dll	862	malloc
msys-1.0.dll	870	memcpy
msys-1.0.dll	871	memmove
msys-1.0.dll	872	memset
msys-1.0.dll	874	mkfifo
msys-1.0.dll	897	open
msys-1.0.dll	898	opendir
msys-1.0.dll	900	pathconf
msys-1.0.dll	904	pipe
msys-1.0.dll	909	printf
msys-1.0.dll	976	putc
msys-1.0.dll	977	putchar
msys-1.0.dll	979	puts
msys-1.0.dll	981	qsort
msys-1.0.dll	986	read
msys-1.0.dll	987	readdir
msys-1.0.dll	988	readlink
msys-1.0.dll	990	realloc
msys-1.0.dll	1012	sbrk
msys-1.0.dll	1030	select
msys-1.0.dll	1039	setdtablesize
msys-1.0.dll	1043	setgid
msys-1.0.dll	1044	setgrent
msys-1.0.dll	1047	setjmp
msys-1.0.dll	1048	setlocale
msys-1.0.dll	1051	setmode
msys-1.0.dll	1053	setpgid
msys-1.0.dll	1055	setpwent
msys-1.0.dll	1056	setrlimit
msys-1.0.dll	1061	setuid
msys-1.0.dll	1062	setvbuf
msys-1.0.dll	1072	sigaction
msys-1.0.dll	1073	sigaddset
msys-1.0.dll	1074	sigdelset
msys-1.0.dll	1075	sigemptyset
msys-1.0.dll	1083	sigprocmask
msys-1.0.dll	1090	sleep
msys-1.0.dll	1091	snprintf
msys-1.0.dll	1092	socket
msys-1.0.dll	1102	sprintf
msys-1.0.dll	1110	stat
msys-1.0.dll	1112	strcasecmp
msys-1.0.dll	1113	strcat
msys-1.0.dll	1114	strchr
msys-1.0.dll	1115	strcmp
msys-1.0.dll	1116	strcoll
msys-1.0.dll	1117	strcpy
msys-1.0.dll	1120	strerror
msys-1.0.dll	1121	strftime
msys-1.0.dll	1122	strlen
msys-1.0.dll	1124	strncasecmp
msys-1.0.dll	1126	strncmp
msys-1.0.dll	1127	strncpy
msys-1.0.dll	1128	strpbrk
msys-1.0.dll	1129	strrchr
msys-1.0.dll	1131	strsignal
msys-1.0.dll	1133	strstr
msys-1.0.dll	1134	strtod
msys-1.0.dll	1140	strtoul
msys-1.0.dll	1148	sysconf
msys-1.0.dll	1156	tcflow
msys-1.0.dll	1158	tcgetattr
msys-1.0.dll	1159	tcgetpgrp
msys-1.0.dll	1161	tcsetattr
msys-1.0.dll	1162	tcsetpgrp
msys-1.0.dll	1165	time
msys-1.0.dll	1174	ttyname
msys-1.0.dll	1176	tzset
msys-1.0.dll	1177	umask
msys-1.0.dll	1181	unlink
msys-1.0.dll	1189	vfprintf
msys-1.0.dll	1196	vsnprintf
msys-1.0.dll	1203	waitpid
msys-1.0.dll	1209	write
msys-regex-1.dll	11	regcomp
msys-regex-1.dll	13	regexec
msys-regex-1.dll	14	regfree
msys-termcap-0.dll	15	tgetent
msys-termcap-0.dll	16	tgetflag
msys-termcap-0.dll	17	tgetnum
msys-termcap-0.dll	18	tgetstr
msys-termcap-0.dll	19	tgoto
msys-termcap-0.dll	21	tputs
KERNEL32.dll	335	GetModuleFileNameA
KERNEL32.dll	337	GetModuleHandleA
KERNEL32.dll	364	GetProcAddress
KERNEL32.dll	388	GetStdHandle
KERNEL32.dll	524	LoadLibraryA
KERNEL32.dll	798	VirtualProtect
KERNEL32.dll	801	VirtualQuery
KERNEL32.dll	827	WriteFile

show previews

offset	size	type	comment
0	564224	EXE	10/19/2014 20:27:55	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK