filenamemain.exe
size3162295 (0x3040b7)
md58c5b9b4d853dd7a4bd8edb5d338c96d1
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0x13
TimeDateStamp0x575b63ef
PointerToSymbolTable0x261e00
NumberOfSymbols0x69f6
SizeOfOptionalHeader0xf0
Characteristics0x27
Magic0x20b
LinkerVersion2.25
SizeOfCode0xbf400
SizeOfInitializedData0x105400
SizeOfUninitializedData0xd200
AddressOfEntryPoint0x1510
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x27a000
SizeOfHeaders0x600
CheckSum0x30ab6b
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x800000
SizeOfStackCommit0x800000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xbf3580xbf400R-X CODE IDATA
.data0xc10000xa2980xa400RW- IDATA
/40xcc0000x1d800x1e00RW- IDATA
.rodata0xce0000xf7380xf800RW- IDATA
.rdata0xde0000x223c00x22400R-- IDATA
.pdata0x1010000x32100x3400R-- IDATA
.xdata0x1050000x2e000x2e00R-- IDATA
.bss0x1080000xd0600RW- UDATA
.idata0x1160000x1bc80x1c00RW- IDATA
.CRT0x1180000x680x200RW- IDATA
.tls0x1190000x680x200RW- IDATA
/170x11a0000x13e00x1400R-- IDATA DISCARDABLE
/320x11c0000xb97c90xb9800R-- IDATA DISCARDABLE
/440x1d60000x106220x10800R-- IDATA DISCARDABLE
/580x1e70000x13b140x13c00R-- IDATA DISCARDABLE
/700x1fb0000x9a280x9c00R-- IDATA DISCARDABLE
/830x2050000x35770x3600R-- IDATA DISCARDABLE
/940x2090000x6353a0x63600R-- IDATA DISCARDABLE
/1050x26d0000xcad00xcc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1160000x1bc8
RESOURCE00
EXCEPTION0x1010000x3210
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x1190200x28
LOAD_CONFIG00
Bound_IAT00
IAT0x1166b80x640
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x5190000x5190600x51429c0x51804000
module_namehintordfunction_name
KERNEL32.dll85CloseHandle
KERNEL32.dll134CreateEventA
KERNEL32.dll177CreateSemaphoreA
KERNEL32.dll193CreateTimerQueue
KERNEL32.dll194CreateTimerQueueTimer
KERNEL32.dll216DeleteCriticalSection
KERNEL32.dll224DeleteTimerQueueEx
KERNEL32.dll225DeleteTimerQueueTimer
KERNEL32.dll248EnterCriticalSection
KERNEL32.dll331FindFirstVolumeW
KERNEL32.dll342FindNextVolumeW
KERNEL32.dll348FindVolumeClose
KERNEL32.dll354FlushConsoleInputBuffer
KERNEL32.dll361FormatMessageA
KERNEL32.dll362FormatMessageW
KERNEL32.dll364FreeEnvironmentStringsA
KERNEL32.dll372GetACP
KERNEL32.dll383GetCPInfo
KERNEL32.dll423GetConsoleCP
KERNEL32.dll441GetConsoleMode
KERNEL32.dll461GetCurrentProcess
KERNEL32.dll462GetCurrentProcessId
KERNEL32.dll465GetCurrentThread
KERNEL32.dll466GetCurrentThreadId
KERNEL32.dll477GetDiskFreeSpaceExW
KERNEL32.dll487GetEnvironmentStrings
KERNEL32.dll491GetEnvironmentVariableW
KERNEL32.dll500GetFileAttributesA
KERNEL32.dll507GetFileInformationByHandle
KERNEL32.dll512GetFileSizeEx
KERNEL32.dll514GetFileType
KERNEL32.dll522GetFullPathNameW
KERNEL32.dll528GetLastError
KERNEL32.dll547GetModuleFileNameW
KERNEL32.dll548GetModuleHandleA
KERNEL32.dll551GetModuleHandleW
KERNEL32.dll598GetProcAddress
KERNEL32.dll611GetProcessTimes
KERNEL32.dll627GetStartupInfoA
KERNEL32.dll629GetStdHandle
KERNEL32.dll644GetSystemInfo
KERNEL32.dll648GetSystemTime
KERNEL32.dll650GetSystemTimeAsFileTime
KERNEL32.dll675GetThreadTimes
KERNEL32.dll677GetTickCount
KERNEL32.dll698GetVolumeInformationW
KERNEL32.dll723GlobalMemoryStatusEx
KERNEL32.dll761InitializeCriticalSection
KERNEL32.dll784IsDBCSLeadByteEx
KERNEL32.dll843LeaveCriticalSection
KERNEL32.dll846LoadLibraryA
KERNEL32.dll848LoadLibraryExW
KERNEL32.dll849LoadLibraryW
KERNEL32.dll859LocalFree
KERNEL32.dll890MultiByteToWideChar
KERNEL32.dll925OutputDebugStringA
KERNEL32.dll927PeekConsoleInputA
KERNEL32.dll929PeekNamedPipe
KERNEL32.dll955QueryPerformanceCounter
KERNEL32.dll956QueryPerformanceFrequency
KERNEL32.dll970ReadConsoleInputA
KERNEL32.dll1003ReleaseSemaphore
KERNEL32.dll1020ResetEvent
KERNEL32.dll1025RtlAddFunctionTable
KERNEL32.dll1026RtlCaptureContext
KERNEL32.dll1033RtlLookupFunctionEntry
KERNEL32.dll1040RtlVirtualUnwind
KERNEL32.dll1045SearchPathW
KERNEL32.dll1063SetConsoleCtrlHandler
KERNEL32.dll1079SetConsoleMode
KERNEL32.dll1101SetEndOfFile
KERNEL32.dll1105SetEnvironmentVariableW
KERNEL32.dll1107SetEvent
KERNEL32.dll1120SetFilePointer
KERNEL32.dll1132SetLastError
KERNEL32.dll1183SetUnhandledExceptionFilter
KERNEL32.dll1196Sleep
KERNEL32.dll1207SystemTimeToFileTime
KERNEL32.dll1210TerminateProcess
KERNEL32.dll1217TlsGetValue
KERNEL32.dll1230UnhandledExceptionFilter
KERNEL32.dll1254VirtualAlloc
KERNEL32.dll1257VirtualFree
KERNEL32.dll1260VirtualProtect
KERNEL32.dll1262VirtualQuery
KERNEL32.dll1268WaitForMultipleObjects
KERNEL32.dll1270WaitForSingleObject
KERNEL32.dll1294WideCharToMultiByte
msvcrt.dll55__C_specific_handler
msvcrt.dll63___lc_codepage_func
msvcrt.dll78__dllonexit
msvcrt.dll81__getmainargs
msvcrt.dll82__initenv
msvcrt.dll83__iob_func
msvcrt.dll90__lconv_init
msvcrt.dll91__mb_cur_max
msvcrt.dll96__set_app_type
msvcrt.dll98__setusermatherr
msvcrt.dll115_acmdln
msvcrt.dll122_amsg_exit
msvcrt.dll123_assert
msvcrt.dll136_beginthreadex
msvcrt.dll140_cexit
msvcrt.dll154_close
msvcrt.dll175_ctime64
msvcrt.dll190_dup
msvcrt.dll193_dup2
msvcrt.dll199_environ
msvcrt.dll201_errno
msvcrt.dll216_exit
msvcrt.dll251_fmode
msvcrt.dll255_fpreset
msvcrt.dll268_fstat64
msvcrt.dll289_get_osfhandle
msvcrt.dll312_getpid
msvcrt.dll330_initterm
msvcrt.dll334_isatty
msvcrt.dll439_lock
msvcrt.dll450_lseeki64
msvcrt.dll601_mkdir
msvcrt.dll611_onexit
msvcrt.dll640_read
msvcrt.dll641_read
msvcrt.dll671_setmode
msvcrt.dll686_snwprintf
msvcrt.dll727_strdup
msvcrt.dll785_telli64
msvcrt.dll788_time64
msvcrt.dll819_unlock
msvcrt.dll822_utime64
msvcrt.dll856_vsnwprintf
msvcrt.dll884_wcsdup
msvcrt.dll951_wfopen
msvcrt.dll983_write
msvcrt.dll984_write
msvcrt.dll991_wsopen
msvcrt.dll1004_wstat64
msvcrt.dll1006_wstat
msvcrt.dll1030abort
msvcrt.dll1041atexit
msvcrt.dll1042atof
msvcrt.dll1043atoi
msvcrt.dll1045bsearch
msvcrt.dll1047calloc
msvcrt.dll1060exit
msvcrt.dll1064fclose
msvcrt.dll1065feof
msvcrt.dll1067fflush
msvcrt.dll1077fopen
msvcrt.dll1079fprintf
msvcrt.dll1081fputc
msvcrt.dll1085fread
msvcrt.dll1086free
msvcrt.dll1092fseek
msvcrt.dll1094ftell
msvcrt.dll1095fwprintf
msvcrt.dll1097fwrite
msvcrt.dll1100getc
msvcrt.dll1102getenv
msvcrt.dll1118isspace
msvcrt.dll1136ldexp
msvcrt.dll1138localeconv
msvcrt.dll1145malloc
msvcrt.dll1148mbstowcs
msvcrt.dll1153memcpy
msvcrt.dll1154memmove
msvcrt.dll1155memset
msvcrt.dll1171raise
msvcrt.dll1173realloc
msvcrt.dll1181setlocale
msvcrt.dll1183signal
msvcrt.dll1188sprintf
msvcrt.dll1197strcmp
msvcrt.dll1199strcpy
msvcrt.dll1202strerror
msvcrt.dll1204strlen
msvcrt.dll1207strncmp
msvcrt.dll1208strncpy
msvcrt.dll1211strrchr
msvcrt.dll1218strtol
msvcrt.dll1239vfprintf
msvcrt.dll1251wcscat
msvcrt.dll1254wcscmp
msvcrt.dll1256wcscpy
msvcrt.dll1260wcslen
USER32.dll489MessageBoxA
USER32.dll496MessageBoxW
WINMM.dll149timeBeginPeriod
WINMM.dll150timeEndPeriod
WINMM.dll151timeGetDevCaps
WSOCK32.dll26WSAGetLastError
WSOCK32.dll37closesocket
WSOCK32.dll61recv
WSOCK32.dll66select
WSOCK32.dll67send
offsetsizetypecomment
15c115HTM#
15d03156711BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x11429c