filenameChikenZOMBI.exe
size251392 (0x3d600)
md581de9998255de1d1bf550228f262a6a2
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
203603153
2075062868
2055062836
20650628201
10119
185307164
2115072710
201507271
204507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x533f90a9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x26c00
SizeOfInitializedData0x18800
SizeOfUninitializedData0
AddressOfEntryPoint0xd652
BaseOfCode0x1000
BaseOfData0x28000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x43000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 2005

Sections

namevavsizeraw sizeflags
.text0x10000x26bad0x26c00R-X CODE
.rdata0x280000xc4340xc600R-- IDATA
.data0x350000x3c400x1c00RW- IDATA
.rsrc0x390000x1e00x200R-- IDATA
.reloc0x3a0000x81620x8200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x33a3c0x50
RESOURCE0x390000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x3a0000x1cb4
DEBUG0x282300x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x31b700x40
Bound_IAT00
IAT0x280000x1c0
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
freeglut.dll63glutLeaveFullScreen
freeglut.dll24glutDisplayFunc
freeglut.dll58glutInitWindowSize
freeglut.dll66glutMainLoop
freeglut.dll60glutKeyboardFunc
freeglut.dll47glutIdleFunc
freeglut.dll79glutPassiveMotionFunc
freeglut.dll72glutMouseFunc
freeglut.dll53glutInitDisplayMode
freeglut.dll128glutSwapBuffers
freeglut.dll31glutFullScreen
freeglut.dll57glutInitWindowPosition
freeglut.dll2__glutInitWithExit
freeglut.dll1__glutCreateWindowWithExit
freeglut.dll6glutBitmapCharacter
freeglut.dll131glutTimerFunc
freeglut.dll83glutPostRedisplay
freeglut.dll65glutLeaveMainLoop
OPENGL32.dll206glPointSize
OPENGL32.dll164glLoadIdentity
OPENGL32.dll135glHint
OPENGL32.dll79glEnable
OPENGL32.dll181glMatrixMode
OPENGL32.dll13glBlendFunc
OPENGL32.dll260glShadeModel
OPENGL32.dll70glDisable
OPENGL32.dll196glOrtho
OPENGL32.dll18glClearColor
OPENGL32.dll16glClear
OPENGL32.dll229glRasterPos3f
OPENGL32.dll27glColor3f
OPENGL32.dll327glVertex3f
OPENGL32.dll10glBegin
OPENGL32.dll81glEnd
KERNEL32.dll865InitOnceExecuteOnce
KERNEL32.dll1270SetEndOfFile
KERNEL32.dll1288SetFilePointer
KERNEL32.dll871InitializeCriticalSectionEx
KERNEL32.dll214CreateFileW
KERNEL32.dll738GetStringTypeW
KERNEL32.dll1520WriteConsoleW
KERNEL32.dll1327SetStdHandle
KERNEL32.dll1110ReadConsoleW
KERNEL32.dll352EnumSystemLocalesEx
KERNEL32.dll912IsValidLocaleName
KERNEL32.dll944LCMapStringEx
KERNEL32.dll796GetUserDefaultLocaleName
KERNEL32.dll621GetLocaleInfoEx
KERNEL32.dll963LoadLibraryW
KERNEL32.dll1045OutputDebugStringW
KERNEL32.dll852HeapReAlloc
KERNEL32.dll1210RtlUnwind
KERNEL32.dll439FreeEnvironmentStringsW
KERNEL32.dll576GetEnvironmentStringsW
KERNEL32.dll785GetTickCount64
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll636GetModuleFileNameA
KERNEL32.dll461GetCPInfo
KERNEL32.dll672GetOEMCP
KERNEL32.dll446GetACP
KERNEL32.dll909IsValidCodePage
KERNEL32.dll962LoadLibraryExW
KERNEL32.dll316EncodePointer
KERNEL32.dll279DecodePointer
KERNEL32.dll618GetLastError
KERNEL32.dll849HeapFree
KERNEL32.dll320EnterCriticalSection
KERNEL32.dll957LeaveCriticalSection
KERNEL32.dll877InterlockedDecrement
KERNEL32.dll365ExitProcess
KERNEL32.dll640GetModuleHandleExW
KERNEL32.dll693GetProcAddress
KERNEL32.dll44AreFileApisANSI
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll482GetCommandLineA
KERNEL32.dll899IsDebuggerPresent
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll854HeapSize
KERNEL32.dll1375Sleep
KERNEL32.dll733GetStdHandle
KERNEL32.dll1521WriteFile
KERNEL32.dll637GetModuleFileNameW
KERNEL32.dll845HeapAlloc
KERNEL32.dll1096RaiseException
KERNEL32.dll599GetFileType
KERNEL32.dll870InitializeCriticalSectionAndSpinCount
KERNEL32.dll286DeleteCriticalSection
KERNEL32.dll727GetStartupInfoW
KERNEL32.dll698GetProcessHeap
KERNEL32.dll1112ReadFile
KERNEL32.dll1289SetFilePointerEx
KERNEL32.dll429FlushFileBuffers
KERNEL32.dll1501WideCharToMultiByte
KERNEL32.dll502GetConsoleCP
KERNEL32.dll520GetConsoleMode
KERNEL32.dll881InterlockedIncrement
KERNEL32.dll1303SetLastError
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll142CloseHandle
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll424FlsAlloc
KERNEL32.dll426FlsGetValue
KERNEL32.dll427FlsSetValue
KERNEL32.dll425FlsFree
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll1391TerminateProcess
KERNEL32.dll641GetModuleHandleW
offsetsizetypecomment
0251392EXE04/05/2014 05:12:09#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK