filenamecns.exe
size15872 (0x3e00)
md58399618baafa1dd31abcd7fdf1de35d8
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
9321792
10520672
9330772
9630771
1530771
9320673
1068
95307718
9430521
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x441e9a56
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x1a00
SizeOfInitializedData0x2000
SizeOfUninitializedData0
AddressOfEntryPoint0x267a
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x7000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x19c20x1a00R-X CODE
.rdata0x30000x6f60x800R-- IDATA
.data0x40000x127c0xa00RW- IDATA
.rsrc0x60000xcc40xe00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x31b40x50
RESOURCE0x60000xcc4
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x31500x48
Bound_IAT00
IAT0x30000x11c
Delay_IAT00
CLR_Header00
typenamesizecp
PYTHONSCRIPT#125821252
VERSION#14961252
module_namehintordfunction_name
USER32.dll278GetFocus
USER32.dll478MessageBoxA
MSVCR71.dll187_adjust_fdiv
MSVCR71.dll130__p__commode
MSVCR71.dll135__p__fmode
MSVCR71.dll159__setusermatherr
MSVCR71.dll241_except_handler3
MSVCR71.dll508_strdup
MSVCR71.dll107__dllonexit
MSVCR71.dll440_onexit
MSVCR71.dll219_controlfp
MSVCR71.dll319_initterm
MSVCR71.dll110__getmainargs
MSVCR71.dll194_amsg_exit
MSVCR71.dll173_acmdln
MSVCR71.dll663exit
MSVCR71.dll205_cexit
MSVCR71.dll333_ismbblead
MSVCR71.dll75_XcptFilter
MSVCR71.dll250_exit
MSVCR71.dll202_c_exit
MSVCR71.dll757realloc
MSVCR71.dll653bsearch
MSVCR71.dll735malloc
MSVCR71.dll754qsort
MSVCR71.dll684free
MSVCR71.dll762setbuf
MSVCR71.dll696getenv
MSVCR71.dll651atoi
MSVCR71.dll323_iob
MSVCR71.dll678fprintf
MSVCR71.dll782strncmp
MSVCR71.dll785strrchr
MSVCR71.dll123__p___argv
MSVCR71.dll122__p___argc
MSVCR71.dll783strncpy
MSVCR71.dll488_snprintf
MSVCR71.dll510_stricmp
MSVCR71.dll156__set_app_type
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll553IsBadReadPtr
KERNEL32.dll795SetLastError
KERNEL32.dll411GetProcessHeap
KERNEL32.dll524HeapFree
KERNEL32.dll886VirtualFree
KERNEL32.dll889VirtualProtect
KERNEL32.dll883VirtualAlloc
KERNEL32.dll239FreeLibrary
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll584LoadLibraryA
KERNEL32.dll408GetProcAddress
KERNEL32.dll641OutputDebugStringA
KERNEL32.dll353GetFullPathNameA
KERNEL32.dll867UnmapViewOfFile
KERNEL32.dll77CreateFileA
KERNEL32.dll347GetFileSize
KERNEL32.dll78CreateFileMappingA
KERNEL32.dll46CloseHandle
KERNEL32.dll606MapViewOfFile
KERNEL32.dll218FindResourceA
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll589LoadResource
KERNEL32.dll603LockResource
KERNEL32.dll361GetLastError
KERNEL32.dll234FormatMessageA
KERNEL32.dll594LocalFree
KERNEL32.dll956lstrlenA
KERNEL32.dll518HeapAlloc

StringTable 040904B0

FileDescriptionSourceManager
FileVersion1.1.0
OriginalFilenamecns.exe
ProductNameSourceManager
ProductVersion1.1.0

VS_FIXEDFILEINFO

FileVersion1.1.0.0
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
015872EXE03/20/2006 12:04:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK