filenametor.exe
size3613710 (0x37240e)
md5628d4f33bd604203d25dbc6a5bb35b90
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x53d6e29f
PointerToSymbolTable0x372400
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.22
SizeOfCode0x273800
SizeOfInitializedData0x372000
SizeOfUninitializedData0x6200
AddressOfEntryPoint0x126c
BaseOfCode0x1000
BaseOfData0x275000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x37e000
SizeOfHeaders0x400
CheckSum0x37c0e8
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2737680x273800R-X CODE IDATA
.data0x2750000xca080xcc00RW- IDATA
.rdata0x2820000x9b4000x9b400R-- IDATA
/40x31e0000x54b800x54c00R-- IDATA
.bss0x3730000x61880RW- UDATA
.idata0x37a0000x17b40x1800RW- IDATA
.CRT0x37c0000x180x200RW- IDATA
.tls0x37d0000x200x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x37a0000x17b4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x37d0000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x37a4480x394
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x77d0190x77d01c0x7777600x77c00400
module_namehintordfunction_name
ADVAPI32.DLL93CryptAcquireContextA
ADVAPI32.DLL110CryptGenRandom
ADVAPI32.DLL136DeregisterEventSource
ADVAPI32.DLL386RegCloseKey
ADVAPI32.DLL413RegOpenKeyExA
ADVAPI32.DLL423RegQueryValueExA
ADVAPI32.DLL439RegisterEventSourceA
ADVAPI32.DLL449ReportEventA
GDI32.dll12BitBlt
GDI32.dll33CreateCompatibleBitmap
GDI32.dll34CreateCompatibleDC
GDI32.dll35CreateDCA
GDI32.dll70DeleteDC
GDI32.dll73DeleteObject
GDI32.dll119GetBitmapBits
GDI32.dll148GetDeviceCaps
GDI32.dll185GetObjectA
GDI32.dll281SelectObject
KERNEL32.dll82CloseHandle
KERNEL32.dll135CreateFileA
KERNEL32.dll136CreateFileMappingA
KERNEL32.dll147CreateIoCompletionPort
KERNEL32.dll160CreatePipe
KERNEL32.dll163CreateProcessA
KERNEL32.dll169CreateSemaphoreA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll300FindClose
KERNEL32.dll304FindFirstFileA
KERNEL32.dll321FindNextFileA
KERNEL32.dll347FormatMessageA
KERNEL32.dll352FreeLibrary
KERNEL32.dll447GetCurrentProcessId
KERNEL32.dll451GetCurrentThreadId
KERNEL32.dll477GetExitCodeProcess
KERNEL32.dll492GetFileSize
KERNEL32.dll495GetFileType
KERNEL32.dll510GetLastError
KERNEL32.dll527GetModuleFileNameA
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll602GetQueuedCompletionStatus
KERNEL32.dll608GetStdHandle
KERNEL32.dll619GetSystemDirectoryA
KERNEL32.dll623GetSystemInfo
KERNEL32.dll629GetSystemTimeAsFileTime
KERNEL32.dll656GetTickCount
KERNEL32.dll670GetVersion
KERNEL32.dll671GetVersionExA
KERNEL32.dll699GlobalMemoryStatus
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll735InitializeCriticalSectionAndSpinCount
KERNEL32.dll744InterlockedExchange
KERNEL32.dll763IsDBCSLeadByteEx
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll817LoadLibraryA
KERNEL32.dll829LocalFree
KERNEL32.dll844MapViewOfFile
KERNEL32.dll860MultiByteToWideChar
KERNEL32.dll885OpenProcess
KERNEL32.dll896PeekNamedPipe
KERNEL32.dll897PostQueuedCompletionStatus
KERNEL32.dll922QueryPerformanceCounter
KERNEL32.dll947ReadFile
KERNEL32.dll978ReleaseSemaphore
KERNEL32.dll1088SetHandleInformation
KERNEL32.dll1091SetLastError
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1166TerminateProcess
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1188UnmapViewOfFile
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1247WideCharToMultiByte
msvcrt.dll6_close
msvcrt.dll23_fdopen
msvcrt.dll32_fstat
msvcrt.dll37_getcwd
msvcrt.dll55_mkdir
msvcrt.dll58_open
msvcrt.dll64_read
msvcrt.dll65_rmdir
msvcrt.dll78_stat
msvcrt.dll80_strdup
msvcrt.dll97_unlink
msvcrt.dll98_utime
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll137_assert
msvcrt.dll142_beginthread
msvcrt.dll147_cexit
msvcrt.dll157_close
msvcrt.dll178_endthread
msvcrt.dll182_errno
msvcrt.dll193_exit
msvcrt.dll224_fstati64
msvcrt.dll225_ftime
msvcrt.dll228_fullpath
msvcrt.dll235_getch
msvcrt.dll245_getpid
msvcrt.dll266_iob
msvcrt.dll268_isctype
msvcrt.dll310_locking
msvcrt.dll316_lseek
msvcrt.dll383_onexit
msvcrt.dll384_open
msvcrt.dll392_pctype
msvcrt.dll403_read
msvcrt.dll426_setmode
msvcrt.dll429_snprintf
msvcrt.dll443_stat
msvcrt.dll449_strdup
msvcrt.dll451_stricmp
msvcrt.dll455_strnicmp
msvcrt.dll488_vscprintf
msvcrt.dll490_vsnprintf
msvcrt.dll531_wfopen
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll591atof
msvcrt.dll592atoi
msvcrt.dll595calloc
msvcrt.dll604exit
msvcrt.dll605exp
msvcrt.dll607fclose
msvcrt.dll610fflush
msvcrt.dll613fgets
msvcrt.dll618fopen
msvcrt.dll619fprintf
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll624fread
msvcrt.dll625free
msvcrt.dll629fseek
msvcrt.dll631ftell
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll641gmtime
msvcrt.dll671localeconv
msvcrt.dll672localtime
msvcrt.dll673log
msvcrt.dll676malloc
msvcrt.dll680memchr
msvcrt.dll681memcmp
msvcrt.dll683memmove
msvcrt.dll685mktime
msvcrt.dll688pow
msvcrt.dll689printf
msvcrt.dll692puts
msvcrt.dll695qsort
msvcrt.dll696raise
msvcrt.dll697rand
msvcrt.dll698realloc
msvcrt.dll700rename
msvcrt.dll704setlocale
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll712sscanf
msvcrt.dll713strcat
msvcrt.dll714strchr
msvcrt.dll715strcmp
msvcrt.dll717strcpy
msvcrt.dll719strerror
msvcrt.dll720strftime
msvcrt.dll721strlen
msvcrt.dll723strncmp
msvcrt.dll724strncpy
msvcrt.dll726strrchr
msvcrt.dll727strspn
msvcrt.dll728strstr
msvcrt.dll729strtod
msvcrt.dll731strtol
msvcrt.dll732strtoul
msvcrt.dll739time
msvcrt.dll742tolower
msvcrt.dll748vfprintf
msvcrt.dll761wcslen
msvcrt.dll768wcsstr
SHELL32.DLL96SHGetMalloc
SHELL32.DLL101SHGetPathFromIDListA
SHELL32.DLL105SHGetSpecialFolderLocation
SHELL32.DLL106SHGetSpecialFolderPathA
USER32.dll250GetDesktopWindow
USER32.dll307GetProcessWindowStation
USER32.dll336GetUserObjectInformationW
USER32.dll434MessageBoxA
WS2_32.dll26WSACleanup
WS2_32.dll43WSAGetLastError
WS2_32.dll54WSAIoctl
WS2_32.dll79WSASetLastError
WS2_32.dll84WSAStartup
WS2_32.dll132accept
WS2_32.dll133bind
WS2_32.dll134closesocket
WS2_32.dll135connect
WS2_32.dll139gethostbyname
WS2_32.dll140gethostname
WS2_32.dll145getservbyname
WS2_32.dll147getsockname
WS2_32.dll148getsockopt
WS2_32.dll149htonl
WS2_32.dll150htons
WS2_32.dll155ioctlsocket
WS2_32.dll156listen
WS2_32.dll157ntohl
WS2_32.dll158ntohs
WS2_32.dll159recv
WS2_32.dll160recvfrom
WS2_32.dll161select
WS2_32.dll162send
WS2_32.dll163sendto
WS2_32.dll164setsockopt
WS2_32.dll165shutdown
WS2_32.dll166socket
offsetsizetypecomment
03613696EXE07/28/2014 23:54:07#
15c115HTM#
2ac822667HTM#
37240014BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 3613710 bytes (3530 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x377760