filename1.dat
size745284 (0xb5f44)
md57196f70b10108e26085cf809202e6131
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
2592520332
26125203168
2602520326
2592670624
2612670649
2602670631
257252039
10132
2652703418
255270341
258270341

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5df3781d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.16
SizeOfCode0x6f200
SizeOfInitializedData0x3ec00
SizeOfUninitializedData0
AddressOfEntryPoint0x4b191
BaseOfCode0x1000
BaseOfData0x71000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xb2000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x6f0880x6f200R-X CODE
.rdata0x710000x373820x37400R-- IDATA
.data0xa90000x28300x1600RW- IDATA
.rsrc0xac0000x2880x400R-- IDATA
.reloc0xad0000x48280x4a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xa78d00x64
RESOURCE0xac0000x288
EXCEPTION00
SECURITY00
BASERELOC0xad0000x4828
DEBUG0xa61c00x38
ARCHITECTURE00
GLOBALPTR00
TLS0xa62980x18
LOAD_CONFIG0xa61f80x40
Bound_IAT00
IAT0x710000x1e8
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x100a6b0c0x100a6b140x100aa8640x1007131400x300000
typenamesizecp
MANIFEST#25480
module_namehintordfunction_name
USER32.dll32CallWindowProcW
USER32.dll318GetCursorPos
USER32.dll797SetCursorPos
USER32.dll754ReleaseCapture
USER32.dll638MessageBoxA
USER32.dll275FindWindowW
USER32.dll869SetWindowLongW
USER32.dll662OpenClipboard
USER32.dll77CloseClipboard
USER32.dll232EmptyClipboard
USER32.dll307GetClipboardData
USER32.dll791SetClipboardData
USER32.dll354GetKeyState
USER32.dll766ScreenToClient
USER32.dll292GetCapture
USER32.dll75ClientToScreen
USER32.dll539IsChild
USER32.dll338GetForegroundWindow
USER32.dll580LoadCursorW
USER32.dll785SetCapture
USER32.dll795SetCursor
USER32.dll304GetClientRect
USER32.dll288GetAsyncKeyState
XINPUT1_4.dll4
XINPUT1_4.dll2
IMM32.dll107ImmReleaseContext
IMM32.dll119ImmSetCompositionWindow
IMM32.dll59ImmGetContext
KERNEL32.dll688GetProcessHeap
KERNEL32.dll424FreeEnvironmentStringsW
KERNEL32.dll563GetEnvironmentStringsW
KERNEL32.dll469GetCommandLineW
KERNEL32.dll468GetCommandLineA
KERNEL32.dll659GetOEMCP
KERNEL32.dll902IsValidCodePage
KERNEL32.dll392FindNextFileA
KERNEL32.dll1346SetStdHandle
KERNEL32.dll376FindFirstFileExA
KERNEL32.dll371FindClose
KERNEL32.dll840HeapReAlloc
KERNEL32.dll488GetConsoleCP
KERNEL32.dll413FlushFileBuffers
KERNEL32.dll338EnumSystemLocalesW
KERNEL32.dll782GetUserDefaultLCID
KERNEL32.dll904IsValidLocale
KERNEL32.dll202CreateFileW
KERNEL32.dll842HeapSize
KERNEL32.dll447GetCPInfo
KERNEL32.dll1526WideCharToMultiByte
KERNEL32.dll533GetCurrentProcess
KERNEL32.dll1397Sleep
KERNEL32.dll927K32GetModuleInformation
KERNEL32.dll682GetProcAddress
KERNEL32.dll628GetModuleHandleW
KERNEL32.dll772GetTickCount64
KERNEL32.dll1095QueryPerformanceFrequency
KERNEL32.dll1094QueryPerformanceCounter
KERNEL32.dll809GlobalAlloc
KERNEL32.dll816GlobalFree
KERNEL32.dll820GlobalLock
KERNEL32.dll827GlobalUnlock
KERNEL32.dll1476VirtualProtect
KERNEL32.dll426FreeLibraryAndExitThread
KERNEL32.dll284DisableThreadLibraryCalls
KERNEL32.dll241CreateThread
KERNEL32.dll1000MultiByteToWideChar
KERNEL32.dll723GetStringTypeW
KERNEL32.dll303EnterCriticalSection
KERNEL32.dll952LeaveCriticalSection
KERNEL32.dll270DeleteCriticalSection
KERNEL32.dll299EncodePointer
KERNEL32.dll263DecodePointer
KERNEL32.dll1322SetLastError
KERNEL32.dll858InitializeCriticalSectionAndSpinCount
KERNEL32.dll190CreateEventW
KERNEL32.dll1430TlsAlloc
KERNEL32.dll1432TlsGetValue
KERNEL32.dll1433TlsSetValue
KERNEL32.dll1431TlsFree
KERNEL32.dll741GetSystemTimeAsFileTime
KERNEL32.dll940LCMapStringW
KERNEL32.dll609GetLocaleInfoW
KERNEL32.dll1288SetEndOfFile
KERNEL32.dll134CloseHandle
KERNEL32.dll1294SetEvent
KERNEL32.dll1215ResetEvent
KERNEL32.dll1488WaitForSingleObjectEx
KERNEL32.dll890IsDebuggerPresent
KERNEL32.dll1445UnhandledExceptionFilter
KERNEL32.dll1381SetUnhandledExceptionFilter
KERNEL32.dll716GetStartupInfoW
KERNEL32.dll897IsProcessorFeaturePresent
KERNEL32.dll534GetCurrentProcessId
KERNEL32.dll538GetCurrentThreadId
KERNEL32.dll862InitializeSListHead
KERNEL32.dll1412TerminateProcess
KERNEL32.dll1042OutputDebugStringW
KERNEL32.dll1227RtlUnwind
KERNEL32.dll1115RaiseException
KERNEL32.dll871InterlockedFlushSList
KERNEL32.dll605GetLastError
KERNEL32.dll425FreeLibrary
KERNEL32.dll958LoadLibraryExW
KERNEL32.dll718GetStdHandle
KERNEL32.dll586GetFileType
KERNEL32.dll623GetModuleFileNameA
KERNEL32.dll624GetModuleFileNameW
KERNEL32.dll627GetModuleHandleExW
KERNEL32.dll1545WriteConsoleW
KERNEL32.dll1132ReadFile
KERNEL32.dll348ExitProcess
KERNEL32.dll833HeapAlloc
KERNEL32.dll837HeapFree
KERNEL32.dll1546WriteFile
KERNEL32.dll1307SetFilePointerEx
KERNEL32.dll506GetConsoleMode
KERNEL32.dll1129ReadConsoleW
KERNEL32.dll432GetACP
offsetsizetypecomment
0708096DLL12/13/2019 11:38:05#
15c115HTM#
ace0037188BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 745284 bytes (728 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xaa864