filenameebCTF-Teaser-BIN100-Dice.exe
size510774 (0x7cb36)
md58cc2391a7a4d2f86355a10a1abdafbba
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5194d2a4
PointerToSymbolTable0x45600
NumberOfSymbols0x15d2
SizeOfOptionalHeader0xe0
Characteristics0x307
Magic0x10b
LinkerVersion2.56
SizeOfCode0x41800
SizeOfInitializedData0x45200
SizeOfUninitializedData0x4e00
AddressOfEntryPoint0x1220
BaseOfCode0x1000
BaseOfData0x43000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x4d000
SizeOfHeaders0x400
CheckSum0x8576a
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Dev-C++ v4.9.9 / MingWin32 - Dev C++ v4.9.9.1

Sections

namevavsizeraw sizeflags
.text0x10000x416f00x41800R-X CODE IDATA
.data0x430000x2300x400RW- IDATA
.rdata0x440000x2c000x2c00R-- IDATA
.bss0x470000x4c600RW- UDATA
.idata0x4c0000x8ac0xa00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x4c0000x8ac
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll1AddAtomA
KERNEL32.dll87CreateSemaphoreA
KERNEL32.dll155ExitProcess
KERNEL32.dll175FindAtomA
KERNEL32.dll213FreeLibrary
KERNEL32.dll220GetAtomNameA
KERNEL32.dll236GetCommandLineA
KERNEL32.dll323GetLastError
KERNEL32.dll335GetModuleHandleA
KERNEL32.dll362GetProcAddress
KERNEL32.dll384GetStartupInfoA
KERNEL32.dll494InterlockedDecrement
KERNEL32.dll498InterlockedIncrement
KERNEL32.dll523LoadLibraryExA
KERNEL32.dll626ReleaseSemaphore
KERNEL32.dll709SetLastError
KERNEL32.dll735SetUnhandledExceptionFilter
KERNEL32.dll747Sleep
KERNEL32.dll759TlsAlloc
KERNEL32.dll760TlsFree
KERNEL32.dll761TlsGetValue
KERNEL32.dll762TlsSetValue
KERNEL32.dll805WaitForSingleObject
msvcrt.dll24_fdopen
msvcrt.dll65_read
msvcrt.dll84_strdup
msvcrt.dll113_write
msvcrt.dll39__getmainargs
msvcrt.dll48__mb_cur_max
msvcrt.dll60__p__environ
msvcrt.dll62__p__fmode
msvcrt.dll80__set_app_type
msvcrt.dll111_assert
msvcrt.dll121_cexit
msvcrt.dll141_ctype
msvcrt.dll152_errno
msvcrt.dll173_filelengthi64
msvcrt.dll194_fstati64
msvcrt.dll233_iob
msvcrt.dll235_isctype
msvcrt.dll284_lseeki64
msvcrt.dll350_onexit
msvcrt.dll359_pctype
msvcrt.dll388_setmode
msvcrt.dll415_strnicmp
msvcrt.dll445_vsnprintf
msvcrt.dll533abort
msvcrt.dll540atexit
msvcrt.dll557fclose
msvcrt.dll560fflush
msvcrt.dll562fgetpos
msvcrt.dll568fopen
msvcrt.dll569fprintf
msvcrt.dll574fread
msvcrt.dll575free
msvcrt.dll580fsetpos
msvcrt.dll583fwrite
msvcrt.dll585getc
msvcrt.dll587getenv
msvcrt.dll621localeconv
msvcrt.dll626malloc
msvcrt.dll630memchr
msvcrt.dll632memcpy
msvcrt.dll633memmove
msvcrt.dll634memset
msvcrt.dll640putc
msvcrt.dll647rand
msvcrt.dll654setlocale
msvcrt.dll655setvbuf
msvcrt.dll656signal
msvcrt.dll661srand
msvcrt.dll665strcmp
msvcrt.dll666strcoll
msvcrt.dll667strcpy
msvcrt.dll670strftime
msvcrt.dll671strlen
msvcrt.dll679strtod
msvcrt.dll683strxfrm
msvcrt.dll689time
msvcrt.dll696ungetc
offsetsizetypecomment
0284160EXE05/16/2013 12:35:48#
15c115HTM#
45600226614BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK