SurvivalGuide.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	SurvivalGuide.exe
size	105984 (0x19e00)
md5	65a57a4de271c7622052820f7b20ff75

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
203	65501	2
225	20806	39
224	20806	120
223	20806	8
221	31101	3
1	0	87
224	31101	1
222	31101	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x57fd49f5
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	12.0
SizeOfCode	0x10600
SizeOfInitializedData	0xb800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1adc
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x1f000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x10421	0x10600	R-X CODE
.rdata	0x12000	0x6848	0x6a00	R-- IDATA
.data	0x19000	0x3b28	0x1800	RW- IDATA
.pdata	0x1d000	0xb4c	0xc00	R-- IDATA
.reloc	0x1e000	0x534	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x18018	0x3c
RESOURCE	0	0
EXCEPTION	0x1d000	0xb4c
SECURITY	0	0
BASERELOC	0x1e000	0x534
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x17440	0x70
Bound_IAT	0	0
IAT	0x12000	0x260
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
libcrypto-1_1-x64.dll	8	AES_decrypt
libcrypto-1_1-x64.dll	14	AES_set_decrypt_key
KERNEL32.dll	1392	TerminateProcess
KERNEL32.dll	194	CreateFileW
KERNEL32.dll	1520	WriteConsoleW
KERNEL32.dll	462	GetCommandLineA
KERNEL32.dll	874	IsDebuggerPresent
KERNEL32.dll	293	EncodePointer
KERNEL32.dll	255	DecodePointer
KERNEL32.dll	880	IsProcessorFeaturePresent
KERNEL32.dll	297	EnterCriticalSection
KERNEL32.dll	933	LeaveCriticalSection
KERNEL32.dll	1211	RtlUnwindEx
KERNEL32.dll	598	GetLastError
KERNEL32.dll	828	HeapFree
KERNEL32.dll	1305	SetLastError
KERNEL32.dll	532	GetCurrentThreadId
KERNEL32.dll	343	ExitProcess
KERNEL32.dll	620	GetModuleHandleExW
KERNEL32.dll	676	GetProcAddress
KERNEL32.dll	27	AreFileApisANSI
KERNEL32.dll	980	MultiByteToWideChar
KERNEL32.dll	1501	WideCharToMultiByte
KERNEL32.dll	681	GetProcessHeap
KERNEL32.dll	711	GetStdHandle
KERNEL32.dll	581	GetFileType
KERNEL32.dll	262	DeleteCriticalSection
KERNEL32.dll	709	GetStartupInfoW
KERNEL32.dll	616	GetModuleFileNameA
KERNEL32.dll	1521	WriteFile
KERNEL32.dll	617	GetModuleFileNameW
KERNEL32.dll	1072	QueryPerformanceCounter
KERNEL32.dll	528	GetCurrentProcessId
KERNEL32.dll	733	GetSystemTimeAsFileTime
KERNEL32.dll	558	GetEnvironmentStringsW
KERNEL32.dll	419	FreeEnvironmentStringsW
KERNEL32.dll	1198	RtlCaptureContext
KERNEL32.dll	1205	RtlLookupFunctionEntry
KERNEL32.dll	1212	RtlVirtualUnwind
KERNEL32.dll	1426	UnhandledExceptionFilter
KERNEL32.dll	1362	SetUnhandledExceptionFilter
KERNEL32.dll	849	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1377	Sleep
KERNEL32.dll	527	GetCurrentProcess
KERNEL32.dll	1410	TlsAlloc
KERNEL32.dll	1412	TlsGetValue
KERNEL32.dll	1413	TlsSetValue
KERNEL32.dll	1411	TlsFree
KERNEL32.dll	621	GetModuleHandleW
KERNEL32.dll	885	IsValidCodePage
KERNEL32.dll	426	GetACP
KERNEL32.dll	653	GetOEMCP
KERNEL32.dll	441	GetCPInfo
KERNEL32.dll	127	CloseHandle
KERNEL32.dll	1467	WaitForSingleObject
KERNEL32.dll	563	GetExitCodeProcess
KERNEL32.dll	215	CreateProcessA
KERNEL32.dll	569	GetFileAttributesExW
KERNEL32.dll	938	LoadLibraryExW
KERNEL32.dll	1021	OutputDebugStringW
KERNEL32.dll	408	FlushFileBuffers
KERNEL32.dll	482	GetConsoleCP
KERNEL32.dll	500	GetConsoleMode
KERNEL32.dll	824	HeapAlloc
KERNEL32.dll	831	HeapReAlloc
KERNEL32.dll	716	GetStringTypeW
KERNEL32.dll	1292	SetFilePointerEx
KERNEL32.dll	1108	ReadFile
KERNEL32.dll	1106	ReadConsoleW
KERNEL32.dll	1276	SetEnvironmentVariableA
KERNEL32.dll	833	HeapSize
KERNEL32.dll	147	CompareStringW
KERNEL32.dll	921	LCMapStringW
KERNEL32.dll	1328	SetStdHandle

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	100400	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK