filenameChromePass.exe
size3736787 (0x3904d3)
md58a58a3a06351b92768f266b27da46e0e
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x32f
Magic0x10b
LinkerVersion2.25
SizeOfCode0x9e00
SizeOfInitializedData0x1ec00
SizeOfUninitializedData0xc800
AddressOfEntryPoint0x1500
BaseOfCode0x1000
BaseOfData0xb000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x30000
SizeOfHeaders0x400
CheckSum0x2637a
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x9ca40x9e00R-X CODE IDATA
.data0xb0000x340x200RW- IDATA
.rdata0xc0000x4f080x5000R-- IDATA
.bss0x110000xc6080RW- UDATA
.idata0x1e0000xbdc0xc00RW- IDATA
.CRT0x1f0000x340x200RW- IDATA
.tls0x200000x200x200RW- IDATA
.rsrc0x210000xea380xec00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1e0000xbdc
RESOURCE0x210000xea38
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x200040x18
LOAD_CONFIG00
Bound_IAT00
IAT0x1e2140x1c4
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4200000x42001c0x41d5900x41f02000
typenamesizecp
ICON#137520
ICON#222160
ICON#313840
ICON#4370190
ICON#596400
ICON#642640
ICON#711280
GROUP_ICON#1011040
module_namehintordfunction_name
KERNEL32.dll171CreateProcessW
KERNEL32.dll212DeleteCriticalSection
KERNEL32.dll240EnterCriticalSection
KERNEL32.dll287ExpandEnvironmentStringsW
KERNEL32.dll352FormatMessageA
KERNEL32.dll396GetCommandLineW
KERNEL32.dll453GetCurrentProcess
KERNEL32.dll454GetCurrentProcessId
KERNEL32.dll458GetCurrentThreadId
KERNEL32.dll481GetEnvironmentVariableW
KERNEL32.dll483GetExitCodeProcess
KERNEL32.dll516GetLastError
KERNEL32.dll533GetModuleFileNameW
KERNEL32.dll534GetModuleHandleA
KERNEL32.dll582GetProcAddress
KERNEL32.dll612GetShortPathNameW
KERNEL32.dll614GetStartupInfoW
KERNEL32.dll636GetSystemTimeAsFileTime
KERNEL32.dll649GetTempPathW
KERNEL32.dll664GetTickCount
KERNEL32.dll748InitializeCriticalSection
KERNEL32.dll807LeaveCriticalSection
KERNEL32.dll810LoadLibraryA
KERNEL32.dll812LoadLibraryExW
KERNEL32.dll854MultiByteToWideChar
KERNEL32.dll919QueryPerformanceCounter
KERNEL32.dll1050SetDllDirectoryW
KERNEL32.dll1056SetEnvironmentVariableW
KERNEL32.dll1132SetUnhandledExceptionFilter
KERNEL32.dll1145Sleep
KERNEL32.dll1159TerminateProcess
KERNEL32.dll1166TlsGetValue
KERNEL32.dll1179UnhandledExceptionFilter
KERNEL32.dll1211VirtualProtect
KERNEL32.dll1214VirtualQuery
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1247WideCharToMultiByte
msvcrt.dll45__argc
msvcrt.dll55__dllonexit
msvcrt.dll68__lconv_init
msvcrt.dll104__set_app_type
msvcrt.dll107__setusermatherr
msvcrt.dll116__wargv
msvcrt.dll118__wgetmainargs
msvcrt.dll119__winitenv
msvcrt.dll144_amsg_exit
msvcrt.dll161_cexit
msvcrt.dll254_findclose
msvcrt.dll259_fileno
msvcrt.dll274_fmode
msvcrt.dll298_fullpath
msvcrt.dll311_get_osfhandle
msvcrt.dll328_getpid
msvcrt.dll350_initterm
msvcrt.dll354_iob
msvcrt.dll457_lock
msvcrt.dll623_onexit
msvcrt.dll693_setmode
msvcrt.dll742_stat
msvcrt.dll757_strdup
msvcrt.dll839_unlock
msvcrt.dll869_vsnprintf
msvcrt.dll877_vsnwprintf
msvcrt.dll900_wcmdln
msvcrt.dll967_wfindfirst
msvcrt.dll970_wfindnext
msvcrt.dll974_wfopen
msvcrt.dll991_wmkdir
msvcrt.dll1005_wremove
msvcrt.dll1009_wrmdir
msvcrt.dll1028_wstat
msvcrt.dll1034_wtempnam
msvcrt.dll1054abort
msvcrt.dll1067calloc
msvcrt.dll1069clearerr
msvcrt.dll1078exit
msvcrt.dll1081fclose
msvcrt.dll1082feof
msvcrt.dll1083ferror
msvcrt.dll1084fflush
msvcrt.dll1094fprintf
msvcrt.dll1100fread
msvcrt.dll1101free
msvcrt.dll1107fseek
msvcrt.dll1110ftell
msvcrt.dll1115fwrite
msvcrt.dll1120getenv
msvcrt.dll1160malloc
msvcrt.dll1163mbstowcs
msvcrt.dll1168memcpy
msvcrt.dll1193setbuf
msvcrt.dll1194setlocale
msvcrt.dll1196signal
msvcrt.dll1199sprintf
msvcrt.dll1204strcat
msvcrt.dll1206strchr
msvcrt.dll1207strcmp
msvcrt.dll1209strcpy
msvcrt.dll1214strlen
msvcrt.dll1215strncat
msvcrt.dll1217strncmp
msvcrt.dll1218strncpy
msvcrt.dll1221strrchr
msvcrt.dll1225strtok
msvcrt.dll1250vfprintf
msvcrt.dll1263wcscat
msvcrt.dll1266wcscmp
msvcrt.dll1268wcscpy
msvcrt.dll1272wcslen
WS2_32.dll157ntohl
offsetsizetypecomment
0126976EXE01/01/1970 00:00:00#
15c115HTM#
1227837019PNG(256 x 256)#
1f0003609811BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 3736787 bytes (3650 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x1d590