filenameextract.exe
size88064 (0x15800)
md574d781e1b2feea48307bb1b49fbcc36a
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
9340355
1086
15403517
9640351
9440351
954035139
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x41107d19
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x14000
SizeOfInitializedData0x5000
SizeOfUninitializedData0
AddressOfEntryPoint0x63d8
BaseOfCode0x1000
BaseOfData0x15000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0x20cdf
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 7.0

Sections

namevavsizeraw sizeflags
.text0x10000x13edc0x14000R-X CODE
.data0x150000x49640xe00RW- IDATA
.rsrc0x1a0000x4100x600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x147600x3c
RESOURCE0x1a0000x410
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x11500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x2ed00x40
Bound_IAT0x2500x44
IAT0x10000x14c
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19440
module_namehintordfunction_name
KERNEL32.dll331GetDriveTypeA
KERNEL32.dll360GetLastError
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll193FileTimeToDosDateTime
KERNEL32.dll194FileTimeToLocalFileTime
KERNEL32.dll343GetFileAttributesExA
KERNEL32.dll772SetFileAttributesA
KERNEL32.dll49CloseHandle
KERNEL32.dll778SetFileTime
KERNEL32.dll585LocalFileTimeToFileTime
KERNEL32.dll141DosDateTimeToFileTime
KERNEL32.dll830Sleep
KERNEL32.dll79CreateFileA
KERNEL32.dll371GetModuleFileNameA
KERNEL32.dll657QueryPerformanceCounter
KERNEL32.dll465GetTickCount
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll445GetSystemTimeAsFileTime
KERNEL32.dll838TerminateProcess
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll855UnhandledExceptionFilter
KERNEL32.dll818SetUnhandledExceptionFilter
KERNEL32.dll265GetCommandLineA
KERNEL32.dll475GetVersionExA
KERNEL32.dll520HeapFree
KERNEL32.dll514HeapAlloc
KERNEL32.dll129DeleteFileA
KERNEL32.dll204FindClose
KERNEL32.dll195FileTimeToSystemTime
KERNEL32.dll208FindFirstFileA
KERNEL32.dll313GetCurrentDirectoryA
KERNEL32.dll182ExitProcess
KERNEL32.dll407GetProcAddress
KERNEL32.dll373GetModuleHandleA
KERNEL32.dll350GetFileType
KERNEL32.dll71CreateDirectoryA
KERNEL32.dll907WriteFile
KERNEL32.dll675ReadFile
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll664ReadConsoleInputA
KERNEL32.dll746SetConsoleMode
KERNEL32.dll300GetConsoleMode
KERNEL32.dll774SetFilePointer
KERNEL32.dll765SetEndOfFile
KERNEL32.dll410GetProcessHeap
KERNEL32.dll430GetStdHandle
KERNEL32.dll238FreeEnvironmentStringsA
KERNEL32.dll333GetEnvironmentStrings
KERNEL32.dll239FreeEnvironmentStringsW
KERNEL32.dll894WideCharToMultiByte
KERNEL32.dll335GetEnvironmentStringsW
KERNEL32.dll783SetHandleCount
KERNEL32.dll428GetStartupInfoA
KERNEL32.dll518HeapDestroy
KERNEL32.dll516HeapCreate
KERNEL32.dll877VirtualFree
KERNEL32.dll874VirtualAlloc
KERNEL32.dll524HeapReAlloc
KERNEL32.dll353GetFullPathNameA
KERNEL32.dll563LCMapStringA
KERNEL32.dll612MultiByteToWideChar
KERNEL32.dll564LCMapStringW
KERNEL32.dll431GetStringTypeA
KERNEL32.dll434GetStringTypeW
KERNEL32.dll801SetStdHandle
KERNEL32.dll880VirtualProtect
KERNEL32.dll440GetSystemInfo
KERNEL32.dll882VirtualQuery
KERNEL32.dll577LoadLibraryA
KERNEL32.dll246GetACP
KERNEL32.dll394GetOEMCP
KERNEL32.dll253GetCPInfo
KERNEL32.dll708RtlUnwind
KERNEL32.dll538InterlockedExchange
KERNEL32.dll230FlushFileBuffers
KERNEL32.dll468GetTimeZoneInformation
KERNEL32.dll363GetLocaleInfoA
KERNEL32.dll55CompareStringA
KERNEL32.dll56CompareStringW
KERNEL32.dll766SetEnvironmentVariableA
USER32.dll43CharNextExA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft® Cabinet Extraction Tool
FileVersion5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalNameextract.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameextract.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.2180

VS_FIXEDFILEINFO

FileVersion5.1.2600.2180
ProductVersion5.1.2600.2180
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
088064EXE08/04/2004 06:07:21#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x250