filenameDllTest.exe
size31744 (0x7c00)
md592b41b581983e1786adef2867d071185
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
152201151
480472
1472992
10804711
147307293
1053
170303191
171303192
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5087784a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x5000
SizeOfInitializedData0x2800
SizeOfUninitializedData0
AddressOfEntryPoint0x5d00
BaseOfCode0x1000
BaseOfData0x6000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0x10e20
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x4e8c0x5000R-X CODE
.rdata0x60000x1fc00x2000R-- IDATA
.data0x80000x600x200RW- IDATA
.rsrc0x90000x1b40x200R-- IDATA
.reloc0xa0000x2c60x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x7bbc0x3c
RESOURCE0x90000x1b4
EXCEPTION00
SECURITY00
BASERELOC0xa0000x1f8
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x60000xcc
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13461252
module_namehintordfunction_name
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll1263VirtualProtect
KERNEL32.dll1260VirtualFree
KERNEL32.dll581GetProcAddress
KERNEL32.dll828LoadLibraryA
KERNEL32.dll759IsBadReadPtr
KERNEL32.dll719HeapFree
KERNEL32.dll586GetProcessHeap
KERNEL32.dll354FreeLibrary
KERNEL32.dll715HeapAlloc
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll232DuplicateHandle
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll136CreateFileA
KERNEL32.dll82CloseHandle
KERNEL32.dll960ReadFile
KERNEL32.dll838LocalFileTimeToFileTime
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll446GetCurrentDirectoryA
KERNEL32.dll1130SetFileTime
KERNEL32.dll1317WriteFile
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll610GetStartupInfoA
MSVCRT.dll663memcpy
MSVCRT.dll657malloc
MSVCRT.dll679realloc
MSVCRT.dll360_mbsnbcpy
MSVCRT.dll380_mbsstr
MSVCRT.dll576calloc
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll690sprintf
MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll202_except_handler3
MSVCRT.dll183_controlfp
MSVCRT.dll606free
MSVCRT.dll665memset
offsetsizetypecomment
031744EXE10/24/2012 05:10:34#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK