filenamec .exe
size504320 (0x7b200)
md565f839e2400a89988297758a9fca3ce5
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x4fdf4453
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.22
SizeOfCode0x43600
SizeOfInitializedData0x7ae00
SizeOfUninitializedData0x2600
AddressOfEntryPoint0x14e0
BaseOfCode0x1000
BaseOfData0x45000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x82000
SizeOfHeaders0x400
CheckSum0x886a1
Subsystem3
DllCharacteristics0
SizeOfStackReserve0xc00000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x434940x43600R-X CODE IDATA
.data0x450000x5d80x600RW- IDATA
.rdata0x460000x35da40x35e00R-- IDATA
.bss0x7c0000x256c0RW- UDATA
.idata0x7f0000xf540x1000RW- IDATA
.CRT0x800000x340x200RW- IDATA
.tls0x810000x200x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x7f0000xf54
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x810000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x7f2cc0x268
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4810190x48101c0x47c53c0x48002000
module_namehintordfunction_name
KERNEL32.dll69CloseHandle
KERNEL32.dll124CreateFileA
KERNEL32.dll152CreateProcessA
KERNEL32.dll196DeleteCriticalSection
KERNEL32.dll223EnterCriticalSection
KERNEL32.dll339FreeLibrary
KERNEL32.dll433GetCurrentProcess
KERNEL32.dll434GetCurrentProcessId
KERNEL32.dll437GetCurrentThreadId
KERNEL32.dll461GetExitCodeProcess
KERNEL32.dll465GetFileAttributesA
KERNEL32.dll484GetFullPathNameA
KERNEL32.dll494GetLastError
KERNEL32.dll510GetModuleHandleA
KERNEL32.dll553GetProcAddress
KERNEL32.dll580GetStartupInfoA
KERNEL32.dll603GetSystemTimeAsFileTime
KERNEL32.dll614GetTempPathA
KERNEL32.dll627GetTickCount
KERNEL32.dll631GetTimeZoneInformation
KERNEL32.dll642GetVersionExA
KERNEL32.dll710InitializeCriticalSection
KERNEL32.dll738IsDBCSLeadByteEx
KERNEL32.dll769LeaveCriticalSection
KERNEL32.dll771LoadLibraryA
KERNEL32.dll774LoadLibraryW
KERNEL32.dll813MultiByteToWideChar
KERNEL32.dll871QueryPerformanceCounter
KERNEL32.dll1026SetHandleInformation
KERNEL32.dll1073SetUnhandledExceptionFilter
KERNEL32.dll1085Sleep
KERNEL32.dll1097TerminateProcess
KERNEL32.dll1104TlsGetValue
KERNEL32.dll1117UnhandledExceptionFilter
KERNEL32.dll1149VirtualProtect
KERNEL32.dll1152VirtualQuery
KERNEL32.dll1161WaitForSingleObject
KERNEL32.dll1183WideCharToMultiByte
msvcrt.dll5_close
msvcrt.dll22_fdopen
msvcrt.dll35_getpid
msvcrt.dll54_open
msvcrt.dll58_putenv
msvcrt.dll60_read
msvcrt.dll75_strdup
msvcrt.dll92_unlink
msvcrt.dll56__dllonexit
msvcrt.dll59__getmainargs
msvcrt.dll60__initenv
msvcrt.dll69__lconv_init
msvcrt.dll70__mb_cur_max
msvcrt.dll105__set_app_type
msvcrt.dll108__setusermatherr
msvcrt.dll121_access
msvcrt.dll122_acmdln
msvcrt.dll143_amsg_exit
msvcrt.dll160_cexit
msvcrt.dll173_close
msvcrt.dll210_dup
msvcrt.dll218_errno
msvcrt.dll242_findclose
msvcrt.dll243_findfirst
msvcrt.dll246_findnext
msvcrt.dll252_fmode
msvcrt.dll265_fstati64
msvcrt.dll272_fullpath
msvcrt.dll284_get_osfhandle
msvcrt.dll318_initterm
msvcrt.dll322_iob
msvcrt.dll422_lock
msvcrt.dll584_onexit
msvcrt.dll585_open
msvcrt.dll595_pipe
msvcrt.dll609_read
msvcrt.dll683_stati64
msvcrt.dll692_stricmp
msvcrt.dll702_strnicmp
msvcrt.dll760_unlock
msvcrt.dll794_vsnprintf
msvcrt.dll896_winmajor
msvcrt.dll962abort
msvcrt.dll965asctime
msvcrt.dll972atoi
msvcrt.dll974bsearch
msvcrt.dll976calloc
msvcrt.dll986exit
msvcrt.dll989fclose
msvcrt.dll991ferror
msvcrt.dll992fflush
msvcrt.dll993fgetc
msvcrt.dll1000fopen
msvcrt.dll1002fprintf
msvcrt.dll1004fputc
msvcrt.dll1005fputs
msvcrt.dll1008fread
msvcrt.dll1009free
msvcrt.dll1010freopen
msvcrt.dll1015fseek
msvcrt.dll1017ftell
msvcrt.dll1020fwrite
msvcrt.dll1023getc
msvcrt.dll1025getenv
msvcrt.dll1032isalnum
msvcrt.dll1033isalpha
msvcrt.dll1034iscntrl
msvcrt.dll1038islower
msvcrt.dll1039isprint
msvcrt.dll1040ispunct
msvcrt.dll1041isspace
msvcrt.dll1042isupper
msvcrt.dll1056isxdigit
msvcrt.dll1060localeconv
msvcrt.dll1061localtime
msvcrt.dll1065malloc
msvcrt.dll1072memcmp
msvcrt.dll1073memcpy
msvcrt.dll1075memmove
msvcrt.dll1077memset
msvcrt.dll1081printf
msvcrt.dll1083putc
msvcrt.dll1084putchar
msvcrt.dll1085puts
msvcrt.dll1088qsort
msvcrt.dll1090raise
msvcrt.dll1093realloc
msvcrt.dll1094remove
msvcrt.dll1100setlocale
msvcrt.dll1102signal
msvcrt.dll1105sprintf
msvcrt.dll1109sscanf
msvcrt.dll1111strcat
msvcrt.dll1113strchr
msvcrt.dll1114strcmp
msvcrt.dll1116strcpy
msvcrt.dll1118strcspn
msvcrt.dll1119strerror
msvcrt.dll1122strlen
msvcrt.dll1125strncmp
msvcrt.dll1126strncpy
msvcrt.dll1129strpbrk
msvcrt.dll1130strrchr
msvcrt.dll1132strstr
msvcrt.dll1137strtoul
msvcrt.dll1146time
msvcrt.dll1151tolower
msvcrt.dll1155ungetc
msvcrt.dll1157vfprintf
msvcrt.dll1163vsprintf
msvcrt.dll1179wcslen
USER32.dll36CharLowerBuffA
offsetsizetypecomment
0504320EXE06/18/2012 15:08:03#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x7c53c