filenameapp.exe
size196608 (0x30000)
md58cf4282e439d4216e909e8d99fd430c7
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x4c7bf8a2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.20
SizeOfCode0x16a00
SizeOfInitializedData0x2fc00
SizeOfUninitializedData0x4c00
AddressOfEntryPoint0x12c0
BaseOfCode0x1000
BaseOfData0x18000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x39000
SizeOfHeaders0x400
CheckSum0x3e2b3
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MingWin32

Sections

namevavsizeraw sizeflags
.text0x10000x168300x16a00R-X CODE IDATA
.data0x180000x12a080x12c00RW- IDATA
.bss0x2b0000x4b580RW- UDATA
.idata0x300000xb5c0xc00RW- IDATA
.CRT0x310000x180x200RW- IDATA
.tls0x320000x200x200RW- IDATA
.rsrc0x330000x540c0x5600RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x300000xb5c
RESOURCE0x330000x540c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x320000x18
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4320190x43201c0x42f07c0x43100400
typenamesizecp
ICON#137520
ICON#221800
ICON#313840
ICON#496400
ICON#541320
GROUP_ICON#100760
module_namehintordfunction_name
msvcrt.dll43_itoa
msvcrt.dll55__getmainargs
msvcrt.dll61__lc_codepage
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll137_assert
msvcrt.dll147_cexit
msvcrt.dll182_errno
msvcrt.dll228_fullpath
msvcrt.dll266_iob
msvcrt.dll383_onexit
msvcrt.dll426_setmode
msvcrt.dll429_snprintf
msvcrt.dll538_winmajor
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll595calloc
msvcrt.dll607fclose
msvcrt.dll613fgets
msvcrt.dll618fopen
msvcrt.dll619fprintf
msvcrt.dll620fputc
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll671localeconv
msvcrt.dll676malloc
msvcrt.dll680memchr
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll706signal
msvcrt.dll714strchr
msvcrt.dll715strcmp
msvcrt.dll717strcpy
msvcrt.dll721strlen
msvcrt.dll722strncat
msvcrt.dll723strncmp
msvcrt.dll724strncpy
msvcrt.dll726strrchr
msvcrt.dll728strstr
msvcrt.dll732strtoul
msvcrt.dll748vfprintf
msvcrt.dll761wcslen
ADVAPI32.DLL357OpenProcessToken
ADVAPI32.DLL386RegCloseKey
ADVAPI32.DLL413RegOpenKeyExA
ADVAPI32.DLL423RegQueryValueExA
ADVAPI32.DLL481SetTokenInformation
KERNEL32.dll1AddAtomA
KERNEL32.dll9AllocConsole
KERNEL32.dll38CloseHandle
KERNEL32.dll60CreateDirectoryA
KERNEL32.dll88CreateSemaphoreA
KERNEL32.dll107DeleteCriticalSection
KERNEL32.dll109DeleteFileA
KERNEL32.dll126EnterCriticalSection
KERNEL32.dll156ExitProcess
KERNEL32.dll176FindAtomA
KERNEL32.dll178FindClose
KERNEL32.dll182FindFirstFileA
KERNEL32.dll191FindNextFileA
KERNEL32.dll209FormatMessageA
KERNEL32.dll214FreeLibrary
KERNEL32.dll221GetAtomNameA
KERNEL32.dll281GetCurrentDirectoryA
KERNEL32.dll283GetCurrentProcess
KERNEL32.dll284GetCurrentProcessId
KERNEL32.dll325GetLastError
KERNEL32.dll335GetModuleFileNameA
KERNEL32.dll337GetModuleHandleA
KERNEL32.dll364GetProcAddress
KERNEL32.dll433GetVersionExA
KERNEL32.dll460GlobalMemoryStatus
KERNEL32.dll492InitializeCriticalSection
KERNEL32.dll496InterlockedDecrement
KERNEL32.dll497InterlockedExchange
KERNEL32.dll500InterlockedIncrement
KERNEL32.dll512IsDBCSLeadByteEx
KERNEL32.dll523LeaveCriticalSection
KERNEL32.dll524LoadLibraryA
KERNEL32.dll534LocalFree
KERNEL32.dll560MultiByteToWideChar
KERNEL32.dll630ReleaseSemaphore
KERNEL32.dll688SetCurrentDirectoryA
KERNEL32.dll697SetErrorMode
KERNEL32.dll713SetLastError
KERNEL32.dll739SetUnhandledExceptionFilter
KERNEL32.dll751Sleep
KERNEL32.dll763TlsAlloc
KERNEL32.dll764TlsFree
KERNEL32.dll765TlsGetValue
KERNEL32.dll766TlsSetValue
KERNEL32.dll798VirtualProtect
KERNEL32.dll801VirtualQuery
KERNEL32.dll810WaitForSingleObject
KERNEL32.dll814WideCharToMultiByte
USER32.dll434MessageBoxA
offsetsizetypecomment
0196608EXE08/30/2010 18:29:54#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2f07c