filenamek.exe
size1007616 (0xf6000)
md56a6348f5860cdefb4e5bcaed440f833d
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x7c

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 61 74 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |at program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00              |mode....$...    |

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x52dfa4c1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x29200
SizeOfInitializedData0xcc800
SizeOfUninitializedData0
AddressOfEntryPoint0x16122
BaseOfCode0x1000
BaseOfData0x2b000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0xf9000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x4004
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x291740x29200R-X CODE
.data0x2b0000xa2af0xa400RW- IDATA
.rsrc0x360000xc225e0xc2400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x29a1f0x264
RESOURCE0x360000xc225e
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x29e0d0x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x29e500x40
Bound_IAT00
IAT0x10000x1b0
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#137520
ICON#217360
GROUP_ICON#512380
#32#512368640
#32#51218640
#32#5127505920
module_namehintordfunction_name
kernel32.DLL677GetSystemInfo
kernel32.DLL100CompareStringW
kernel32.DLL205GetProcAddress
kernel32.DLL488GetFileAttributesExA
kernel32.DLL294FileTimeToSystemTime
kernel32.DLL588GetProcessHeap
kernel32.DLL1194SetVolumeLabelW
kernel32.DLL507GetFullPathNameW
kernel32.DLL1224TlsGetValue
kernel32.DLL478GetEnvironmentVariableW
kernel32.DLL84CloseHandle
kernel32.DLL1266VirtualQuery
kernel32.DLL964ReadProcessMemory
kernel32.DLL749InterlockedDecrement
kernel32.DLL133CreateEventW
kernel32.DLL1346lstrcmpA
kernel32.DLL677GetVersionExA
kernel32.DLL162CreateNamedPipeW
kernel32.DLL1101SetCurrentDirectoryA
kernel32.DLL1355lstrcpynA
kernel32.DLL610GetShortPathNameA
kernel32.DLL501GetFileType
kernel32.DLL1349lstrcmpiA
kernel32.DLL535GetModuleHandleA
kernel32.DLL1267VirtualQueryEx
kernel32.DLL518GetLocaleInfoA
clbcatq.DLL12ComPlusMigrate
clbcatq.DLL2CoRegCleanup
clbcatq.DLL25963rnel32.DLL
clbcatq.DLL20589lusMigrate
user32.DLL1708DrawIcon
user32.DLL1562CharToOemA
user32.DLL1680DialogBoxParamA
user32.DLL2163SetCursorPos
user32.DLL1714DispatchMessageA
user32.DLL1618CreateWindowExA
user32.DLL2331wsprintfA
user32.DLL1855GetMessageW
user32.DLL1775GetCaretPos
user32.DLL1969IsDialogMessageA
user32.DLL1914GetWindowLongA
user32.DLL1714DrawTextA
user32.DLL28500OemA
user32.DLLclbcatq.DLL
user32.DLL28516wLongA
user32.DLL29281etPos
user32.DLL24933teWindowExA
user32.DLL28483RegCleanup
user32.DLL26465eA
user32.DLL26479MessageA
user32.DLL25417on
user32.DLL25927tMessageW
user32.DLL28531rPos
offsetsizetypecomment
01007104EXE01/22/2014 11:00:17#
15c115HTM#
f5e00512BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 1007616 bytes (984 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK