filenamelzma.exe
size73216 (0x11e00)
md571dc11c495355f883498ff5e8702bb3d
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
1180473
1472998
10804711
480472
9521901
1075
9321795
11978223
1703031911
158303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce553f4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0xf800
SizeOfInitializedData0x4200
SizeOfUninitializedData0
AddressOfEntryPoint0x10004
BaseOfCode0x1000
BaseOfData0x11000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000xf7d20xf800R-X CODE
.rdata0x110000x14e00x1600R-- IDATA
.data0x130000x296c0xa00RW- IDATA
.sxdata0x1600040x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x11f540x50
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x110000x110
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
USER32.dll55CharUpperW
USER32.dll52CharUpperA
MSVCRT.dll183_controlfp
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll100__p___initenv
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
MSVCRT.dll46void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll202_except_handler3
MSVCRT.dll166_beginthreadex
MSVCRT.dll665memset
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll702strlen
MSVCRT.dll663memcpy
MSVCRT.dll664memmove
MSVCRT.dll602fputs
MSVCRT.dll662memcmp
MSVCRT.dll65_CxxThrowException
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll275_iob
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll427_setmode
MSVCRT.dll600fprintf
MSVCRT.dll402_purecall
MSVCRT.dll129__set_app_type
KERNEL32.dll537InitializeCriticalSection
KERNEL32.dll697ReleaseSemaphore
KERNEL32.dll101CreateSemaphoreA
KERNEL32.dll708ResetEvent
KERNEL32.dll779SetEvent
KERNEL32.dll901WaitForSingleObject
KERNEL32.dll888VirtualFree
KERNEL32.dll885VirtualAlloc
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll418GetProcessTimes
KERNEL32.dll469GetTickCount
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll583LeaveCriticalSection
KERNEL32.dll433GetStdHandle
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll408GetProcAddress
KERNEL32.dll506GlobalMemoryStatus
KERNEL32.dll443GetSystemInfo
KERNEL32.dll773SetEndOfFile
KERNEL32.dll919WriteFile
KERNEL32.dll683ReadFile
KERNEL32.dll784SetFilePointer
KERNEL32.dll347GetFileSize
KERNEL32.dll46CloseHandle
KERNEL32.dll77CreateFileA
KERNEL32.dll361GetLastError
KERNEL32.dll905WideCharToMultiByte
KERNEL32.dll619MultiByteToWideChar
KERNEL32.dll479GetVersionExA
KERNEL32.dll73CreateEventA
offsetsizetypecomment
073216EXE11/18/2010 16:27:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK