filenameHunt.exe
size45056 (0xb000)
md581c473dc0d266dfe7c275af12db0327a
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1187971
14729914
10879752
1054
1990497
1087991

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x39fe22e1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x6000
SizeOfInitializedData0x5000
SizeOfUninitializedData0
AddressOfEntryPoint0x16f2
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x1000
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x565e0x6000R-X CODE
.rdata0x70000x9f20x1000R-- IDATA
.data0x80000x3e480x3000RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x74ec0x50
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x70000xe0
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
NETAPI32.dll209NetShareEnum
NETAPI32.dll217NetUseDel
NETAPI32.dll216NetUseAdd
NETAPI32.dll93NetApiBufferFree
NETAPI32.dll223NetUserEnum
ADVAPI32.dll272LookupAccountNameA
ADVAPI32.dll227GetSidSubAuthorityCount
ADVAPI32.dll226GetSidSubAuthority
KERNEL32.dll731UnhandledExceptionFilter
KERNEL32.dll265GetCurrentProcess
KERNEL32.dll364GetStringTypeW
KERNEL32.dll361GetStringTypeA
KERNEL32.dll398GetVersion
KERNEL32.dll668SetLastError
KERNEL32.dll769WideCharToMultiByte
KERNEL32.dll301GetLastError
KERNEL32.dll807lstrcatW
KERNEL32.dll822lstrlenW
KERNEL32.dll436HeapAlloc
KERNEL32.dll140ExitProcess
KERNEL32.dll314GetModuleHandleA
KERNEL32.dll312GetModuleFileNameA
KERNEL32.dll284GetEnvironmentVariableA
KERNEL32.dll399GetVersionExA
KERNEL32.dll440HeapDestroy
KERNEL32.dll438HeapCreate
KERNEL32.dll753VirtualFree
KERNEL32.dll442HeapFree
KERNEL32.dll750VirtualAlloc
KERNEL32.dll445HeapReAlloc
KERNEL32.dll664SetHandleCount
KERNEL32.dll715TerminateProcess
KERNEL32.dll477LCMapStringW
KERNEL32.dll296GetFileType
KERNEL32.dll313GetModuleFileNameW
KERNEL32.dll193FreeEnvironmentStringsA
KERNEL32.dll514MultiByteToWideChar
KERNEL32.dll194FreeEnvironmentStringsW
KERNEL32.dll283GetEnvironmentStringsW
KERNEL32.dll281GetEnvironmentStrings
KERNEL32.dll219GetCommandLineW
KERNEL32.dll218GetCommandLineA
KERNEL32.dll339GetProcAddress
KERNEL32.dll360GetStdHandle
KERNEL32.dll479LoadLibraryA
KERNEL32.dll358GetStartupInfoA
KERNEL32.dll599RtlUnwind
KERNEL32.dll782WriteFile
KERNEL32.dll30CloseHandle
KERNEL32.dll185FlushFileBuffers
KERNEL32.dll661SetFilePointer
KERNEL32.dll680SetStdHandle
KERNEL32.dll476LCMapStringA
offsetsizetypecomment
045056EXE10/31/2000 01:39:45#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK