filenamecrark-7z.exe
size333824 (0x51800)
md56edc9d6fb0812b010f8ef3a0bdd73014
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
149210222
203509292
199411182
205509292
2065092920
207509297
188307161
185307167
10112
205507275
206610307
0013
204610301

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x55cb39c0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion11.0
SizeOfCode0x41e00
SizeOfInitializedData0x146e00
SizeOfUninitializedData0
AddressOfEntryPoint0x26248
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x18c000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x41dfb0x41e00R-X CODE
.rdata0x430000x679a0x6800R-- IDATA
.data0x4a0000x13ab480x3400RW- IDATA
.pdata0x1850000x1c080x1e00R-- IDATA
.data10x1870000x157c0x1600RW- IDATA
_DATA10x1890000x10000x1000RW- IDATA
.reloc0x18a0000x159c0x1600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x48ea00x64
RESOURCE00
EXCEPTION0x1850000x1c08
SECURITY00
BASERELOC0x18a0000x658
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x460700x70
Bound_IAT00
IAT0x430000x2f8
Delay_IAT0x48ba40x40
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll206CreateFileA
KERNEL32.dll1517WideCharToMultiByte
KERNEL32.dll142CloseHandle
KERNEL32.dll553GetCurrentProcess
KERNEL32.dll689GetPriorityClass
KERNEL32.dll1327SetPriorityClass
KERNEL32.dll1246SetConsoleCtrlHandler
KERNEL32.dll624GetLastError
KERNEL32.dll1390Sleep
KERNEL32.dll1007MultiByteToWideChar
KERNEL32.dll966LoadLibraryW
KERNEL32.dll446FreeLibrary
KERNEL32.dll700GetProcAddress
KERNEL32.dll214CreateFileW
KERNEL32.dll1116ReadFile
KERNEL32.dll1303SetFilePointer
KERNEL32.dll603GetFileSize
KERNEL32.dll1225RtlVirtualUnwind
KERNEL32.dll280DecodePointer
KERNEL32.dll763GetSystemTimeAsFileTime
KERNEL32.dll558GetCurrentThreadId
KERNEL32.dll554GetCurrentProcessId
KERNEL32.dll1087QueryPerformanceCounter
KERNEL32.dll902IsDebuggerPresent
KERNEL32.dll320EncodePointer
KERNEL32.dll964LoadLibraryExA
KERNEL32.dll1100RaiseException
KERNEL32.dll907IsProcessorFeaturePresent
USER32.dll53CharToOemA
OLEAUT32.dll2
OLEAUT32.dll9
MSVCR110.dll1451fprintf
MSVCR110.dll1432exit
MSVCR110.dll1416atoi
MSVCR110.dll1474getchar
MSVCR110.dll352__C_specific_handler
MSVCR110.dll1531memmove
MSVCR110.dll1667wprintf
MSVCR110.dll1439fflush
MSVCR110.dll330_CxxThrowException
MSVCR110.dll358__CxxFrameHandler3
MSVCR110.dll1449fopen
MSVCR110.dll1465fseek
MSVCR110.dll1467ftell
MSVCR110.dll1457fread
MSVCR110.dll1436fclose
MSVCR110.dll1539printf
MSVCR110.dll1536perror
MSVCR110.dll1575strchr
MSVCR110.dll1588strncpy
MSVCR110.dll1533memset
MSVCR110.dll654_ftime64
MSVCR110.dll1529memcpy
MSVCR110.dll1438ferror
MSVCR110.dll1473getc
MSVCR110.dll1566sprintf
MSVCR110.dll1617ungetc
MSVCR110.dll1485isdigit
MSVCR110.dll1506isxdigit
MSVCR110.dll1614toupper
MSVCR110.dll348_XcptFilter
MSVCR110.dll496_amsg_exit
MSVCR110.dll421__getmainargs
MSVCR110.dll460__set_app_type
MSVCR110.dll593_exit
MSVCR110.dll519_cexit
MSVCR110.dll535_configthreadlocale
MSVCR110.dll462__setusermatherr
MSVCR110.dll727_initterm_e
MSVCR110.dll726_initterm
MSVCR110.dll422__initenv
MSVCR110.dll621_fmode
MSVCR110.dll534_commode
MSVCR110.dll411__crt_debugger_hook
MSVCR110.dll410__crtUnhandledException
MSVCR110.dll409__crtTerminateProcess
MSVCR110.dll384__crtCaptureCurrentContext
MSVCR110.dll385__crtCapturePreviousContext
MSVCR110.dll313void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR110.dll289public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR110.dll408__crtSetUnhandledExceptionFilter
MSVCR110.dll838_lock
MSVCR110.dll1195_unlock
MSVCR110.dll518_calloc_crt
MSVCR110.dll413__dllonexit
MSVCR110.dll1005_onexit
MSVCR110.dll1454fputs
MSVCR110.dll1518malloc
MSVCR110.dll1459free
MSVCR110.dll423__iob_func
MSVCR110.dll1135_strrev
offsetsizetypecomment
15c115HTM#
15d0328240BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK