filenamepowershell.exe
size452608 (0x6e800)
md592f44e405db16ac55d97e3bfe3b132fa
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
123507272
149307298
1313072973
1323072920
1473072917
10150
138307291
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc414
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x8c00
SizeOfInitializedData0x65e00
SizeOfUninitializedData0
AddressOfEntryPoint0x7363
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x22910000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.1
Reserved10
SizeOfImage0x72000
SizeOfHeaders0x400
CheckSum0x7713c
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x8c000x8c00R-X CODE
.data0xa0000x8e00x400RW- IDATA
.rsrc0xb0000x641880x64200R-- IDATA
.reloc0x700000x11c00x1200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x93240xc8
RESOURCE0xb0000x64188
EXCEPTION00
SECURITY00
BASERELOC0x700000x9cc
DEBUG0x11d00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x4a800x40
Bound_IAT0x2880xb8
IAT0x10000x1b0
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12160
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#9764780
ICON#1096400
ICON#1142640
ICON#1224400
ICON#1311280
ICON#1416400
ICON#157440
ICON#164880
ICON#172960
ICON#1837520
ICON#1922160
ICON#2017360
ICON#2113840
ICON#222703760
ICON#2396400
ICON#2442640
ICON#2524400
ICON#2611280
GROUP_ICONMSH_MAIN1880
GROUP_ICONMSH_SECURITY1880
VERSION#19160
MANIFEST#14770
module_namehintordfunction_name
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll622RegQueryValueExW
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll1181SetThreadUILanguage
KERNEL32.dll1317WriteFile
KERNEL32.dll350FormatMessageW
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll143CreateFileW
KERNEL32.dll100CompareStringW
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll612GetStdHandle
KERNEL32.dll514GetLastError
KERNEL32.dll302FindClose
KERNEL32.dll782IsWow64Process
KERNEL32.dll499GetFileType
KERNEL32.dll82CloseHandle
KERNEL32.dll840LocalFree
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll622GetSystemDefaultUILanguage
KERNEL32.dll1238UnmapViewOfFile
KERNEL32.dll1112SetErrorMode
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll676GetVersionExW
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll855MapViewOfFile
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll1139SetLastError
KERNEL32.dll833LoadResource
KERNEL32.dll333FindResourceExW
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1216TerminateProcess
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1048RtlUnwind
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll1053SearchPathW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll354FreeLibrary
KERNEL32.dll670GetUserDefaultUILanguage
msvcrt.dll212__setusermatherr
msvcrt.dll469_initterm
msvcrt.dll1007_wcsicmp
msvcrt.dll1017_wcsnicmp
msvcrt.dll1371wcsncmp
msvcrt.dll974_vsnwprintf
msvcrt.dll1167exit
msvcrt.dll106_XcptFilter
msvcrt.dll185__p__commode
msvcrt.dll295_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll1258memcpy
msvcrt.dll257_amsg_exit
msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll225__wgetmainargs
msvcrt.dll99_CxxThrowException
msvcrt.dll1262memset
msvcrt.dll113__CxxFrameHandler
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll563_itow
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll43void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

msvcrt.dll1376wcsrchr
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll1387wcstoul
msvcrt.dll41void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

msvcrt.dll1361wcschr
msvcrt.dll1154bsearch
ATL.DLL30
ole32.dll336PropVariantClear
ole32.dll62CoInitialize
ole32.dll108CoUninitialize
ole32.dll16CoCreateInstance
ole32.dll63CoInitializeEx
OLEAUT32.dll2
OLEAUT32.dll9
OLEAUT32.dll16
OLEAUT32.dll15
OLEAUT32.dll6
OLEAUT32.dll26
OLEAUT32.dll7
mscoree.dll14CorBindToRuntimeEx
SHLWAPI.dll255SHStrDupW
USER32.dll506LoadStringW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows PowerShell
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamePOWERSHELL
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamePowerShell.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0452608EXE07/13/2009 23:32:36#
15c115HTM#
cc5076478PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x288