filenamerun_calc.exe
size99912 (0x18648)
md58e233fbae5dda076e6f358e158fa4d8a
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0x11
TimeDateStamp0x64b3f16b
PointerToSymbolTable0x12000
NumberOfSymbols0x4b6
SizeOfOptionalHeader0xe0
Characteristics0x106
Magic0x10b
LinkerVersion2.38
SizeOfCode0x1800
SizeOfInitializedData0x3600
SizeOfUninitializedData0x200
AddressOfEntryPoint0x14b0
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1d000
SizeOfHeaders0x600
CheckSum0x208e2
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x16a40x1800R-X CODE IDATA
.data0x30000x280x200RW- IDATA
.rdata0x40000x5740x600R-- IDATA
/40x50000x7c00x800R-- IDATA
.bss0x60000xc00RW- UDATA
.idata0x70000x4a40x600RW- IDATA
.CRT0x80000x300x200RW- IDATA
.tls0x900080x200RW- IDATA
.reloc0xa0000x24c0x400R-- IDATA DISCARDABLE
/140xb0000x2900x400R-- IDATA DISCARDABLE
/290xc0000x88d60x8a00R-- IDATA DISCARDABLE
/410x150000x1a2d0x1c00R-- IDATA DISCARDABLE
/550x170000x19590x1a00R-- IDATA DISCARDABLE
/670x190000x2c30x400R-- IDATA DISCARDABLE
/780x1a0000xd5e0xe00R-- IDATA DISCARDABLE
/940x1b0000xb220xc00R-- IDATA DISCARDABLE
/1100x1c0000x1800x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x70000x4a4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0xa0000x24c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x40540x18
LOAD_CONFIG00
Bound_IAT00
IAT0x70e80xac
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4090000x4090040x4060640x40801c00
module_namehintordfunction_name
KERNEL32.dll277DeleteCriticalSection
KERNEL32.dll310EnterCriticalSection
KERNEL32.dll355ExitProcess
KERNEL32.dll433FreeLibrary
KERNEL32.dll617GetLastError
KERNEL32.dll637GetModuleHandleA
KERNEL32.dll694GetProcAddress
KERNEL32.dll729GetStartupInfoA
KERNEL32.dll877InitializeCriticalSection
KERNEL32.dll973LeaveCriticalSection
KERNEL32.dll977LoadLibraryA
KERNEL32.dll1370SetUnhandledExceptionFilter
KERNEL32.dll1386Sleep
KERNEL32.dll1421TlsGetValue
KERNEL32.dll1469VirtualProtect
KERNEL32.dll1472VirtualQuery
KERNEL32.dll1523WinExec
msvcrt.dll58__getmainargs
msvcrt.dll59__initenv
msvcrt.dll76__p__acmdln
msvcrt.dll78__p__commode
msvcrt.dll83__p__fmode
msvcrt.dll104__set_app_type
msvcrt.dll107__setusermatherr
msvcrt.dll142_amsg_exit
msvcrt.dll159_cexit
msvcrt.dll338_initterm
msvcrt.dll342_iob
msvcrt.dll570_onexit
msvcrt.dll922abort
msvcrt.dll935calloc
msvcrt.dll945exit
msvcrt.dll962fprintf
msvcrt.dll969free
msvcrt.dll982fwrite
msvcrt.dll1027malloc
msvcrt.dll1035memcpy
msvcrt.dll1064signal
msvcrt.dll1084strlen
msvcrt.dll1087strncmp
msvcrt.dll1121vfprintf
offsetsizetypecomment
073728EXE07/16/2023 13:32:27#
15c115HTM#
1200026184BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x6064