filenamekeymaker.exe
size49664 (0xc200)
md56e9bef2220f2c467044c2d49a82acc06
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
19807865
109
9340353
1884445
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.12
SizeOfCode0x1600
SizeOfInitializedData0xb800
SizeOfUninitializedData0
AddressOfEntryPoint0x21a1
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x10000
SizeOfHeaders0x400
CheckSum0x13f76
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig2(h)

Sections

namevavsizeraw sizeflags
.text0x10000x159c0x1600R-X CODE
.rdata0x30000x68a0x800R-- IDATA
.data0x40000x23140x1400RW- IDATA
.rsrc0x70000x8ae00x8c00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x31000xc8
RESOURCE0x70000x8ae0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x30000xf8
Delay_IAT00
CLR_Header00
typenamesizecp
IMAGE#100165380
ICON#111280
ICON#224400
ICON#342640
ICON#496400
DIALOG#1003200
GROUP_ICON#1620
MANIFEST#16010
module_namehintordfunction_name
ntdll.dll754RtlRandom
ntdll.dll434RtlComputeCrc32
ntdll.dll706RtlMoveMemory
ntdll.dll877RtlZeroMemory
kernel32.dll35CloseHandle
kernel32.dll61CreateFileA
kernel32.dll74CreateMutexA
kernel32.dll155ExitProcess
kernel32.dll283GetFileInformationByHandle
kernel32.dll296GetLastError
kernel32.dll308GetModuleHandleA
kernel32.dll421GlobalAlloc
kernel32.dll428GlobalFree
kernel32.dll783lstrcatA
kernel32.dll793lstrlenA
kernel32.dll192FindResourceA
kernel32.dll495LoadResource
kernel32.dll509LockResource
kernel32.dll656SetLastError
kernel32.dll694SizeofResource
kernel32.dll522MulDiv
comctl32.dll84InitCommonControls
user32.dll245GetDC
user32.dll637wsprintfA
user32.dll573SetWindowTextA
user32.dll531SetDlgItemTextA
user32.dll509SendMessageA
user32.dll504SendDlgItemMessageA
user32.dll493ReleaseCapture
user32.dll433MessageBoxA
user32.dll408LoadIconA
user32.dll252GetDlgItemTextA
user32.dll250GetDlgItem
user32.dll208FindWindowA
user32.dll178EnableWindow
user32.dll144DialogBoxParamA
user32.dll33CharLowerBuffA
user32.dll180EndDialog
shlwapi.dll207SHSetValueA
shlwapi.dll158SHGetValueA
shell32.dll60IsUserAnAdmin
gdi32.dll75DeleteObject
gdi32.dll170GetDeviceCaps
gdi32.dll302SelectObject
gdi32.dll72DeleteDC
gdi32.dll34CreateCompatibleDC
gdi32.dll33CreateCompatibleBitmap
ole32.dll96CoTaskMemFree
ole32.dll100CoUninitialize
ole32.dll95CoTaskMemAlloc
ole32.dll140CreateStreamOnHGlobal
ole32.dll56CoInitialize
oleaut32.dll40OleLoadPicture
offsetsizetypecomment
049664EXE01/01/1970 00:00:00#
15c115HTM#
382016538JPG#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK