filenamePEDUMP.exe
size85504 (0x14e00)
md583917bf81875ff8a15d4cf594941f91e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
147210222
150204131
149210223
1312102220
132210223
1235072717
1097
138210222
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4c7e86f4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x9000
SizeOfInitializedData0xba00
SizeOfUninitializedData0
AddressOfEntryPoint0x99d1
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x400
CheckSum0x18668
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x8f8a0x9000R-X CODE
.rdata0xa0000x6d800x6e00R-- IDATA
.data0x110000x4c00x200RW- IDATA
.rsrc0x120000x48680x4a00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x104140xc8
RESOURCE0x120000x4868
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x102580x40
Bound_IAT00
IAT0xa0000x1a8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#113841252
ICON#242641252
ICON#396401252
MENU#102961252
DIALOG#93821252
DIALOG#1002601252
GROUP_ICONIDR_MAINFRAME481252
VERSION#19161252
MANIFEST#19211252
module_namehintordfunction_name
KERNEL32.dll271FileTimeToLocalFileTime
KERNEL32.dll765LocalFree
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll67CloseHandle
KERNEL32.dll1206lstrlenW
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1069TerminateProcess
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll1191lstrcatW
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll761LocalAlloc
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll127CreateFileW
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll872ReadFile
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll1057Sleep
KERNEL32.dll701InterlockedExchange
KERNEL32.dll272FileTimeToSystemTime
KERNEL32.dll468GetFileSize
KERNEL32.dll462GetFileAttributesW
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll1165WriteFile
KERNEL32.dll1111VirtualFree
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll1205lstrlenA
KERNEL32.dll991SetFilePointer
KERNEL32.dll1193lstrcmpA
KERNEL32.dll721IsDebuggerPresent
USER32.dll166DialogBoxParamW
USER32.dll287GetDlgItem
USER32.dll601SendDlgItemMessageA
USER32.dll602SendDlgItemMessageW
USER32.dll696ShowWindow
USER32.dll511MessageBoxW
USER32.dll631SetDlgItemTextW
USER32.dll611SendMessageW
USER32.dll684SetWindowTextW
USER32.dll211EndDialog
GDI32.dll613SetBkColor
GDI32.dll653SetTextColor
GDI32.dll82CreateSolidBrush
COMDLG32.dll14GetSaveFileNameW
COMDLG32.dll12GetOpenFileNameW
SHELL32.dll28DragFinish
SHELL32.dll32DragQueryFileW
SHELL32.dll280ShellExecuteW
SHELL32.dll27DragAcceptFiles
CRYPT32.dll73CertGetNameStringA
CRYPT32.dll172CryptMsgClose
CRYPT32.dll28CertCreateCertificateContext
CRYPT32.dll183CryptMsgUpdate
CRYPT32.dll179CryptMsgGetParam
CRYPT32.dll180CryptMsgOpenToDecode
CRYPT32.dll128CryptDecodeObject
CRYPT32.dll63CertFreeCertificateContext
COMCTL32.dll122InitCommonControlsEx
SHLWAPI.dll310StrRChrW
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll1322memset
MSVCR90.dll319_controlfp_s
MSVCR90.dll523_invoke_watson
MSVCR90.dll1351sprintf_s
MSVCR90.dll33void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

MSVCR90.dll17void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR90.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR90.dll1038_vsnprintf_s
MSVCR90.dll277_amsg_exit
MSVCR90.dll159__getmainargs
MSVCR90.dll300_cexit
MSVCR90.dll380_exit
MSVCR90.dll102_XcptFilter
MSVCR90.dll549_ismbblead
MSVCR90.dll1228exit
MSVCR90.dll253_acmdln
MSVCR90.dll516_initterm
MSVCR90.dll517_initterm_e
MSVCR90.dll316_configthreadlocale
MSVCR90.dll227__setusermatherr
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll203__p__commode
MSVCR90.dll207__p__fmode
MSVCR90.dll362_encode_pointer
MSVCR90.dll224__set_app_type
MSVCR90.dll1318memcpy
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll998_unlock
MSVCR90.dll150__dllonexit
MSVCR90.dll630_lock
MSVCR90.dll796_onexit
MSVCR90.dll352_decode_pointer
MSVCR90.dll371_except_handler4_common

StringTable 041904b0

CommentsSimple PE file dumper
CompanyNamedx [visit kaimi.ru for moar content]
FileDescriptionSimple PE file dumper
FileVersion1, 0, 0, 0
InternalNameSimple PE dumper
LegalCopyright(c) 2010
LegalTrademarksdx
OriginalFilenameSimplePEDumper.exe
ProductNameSimple PE dumper
ProductVersion1, 0, 0, 0

VS_FIXEDFILEINFO

FileVersion1.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
085504EXE09/01/2010 17:01:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK