filenamecmd.exe
size306688 (0x4ae00)
md5944e3677dcc4dcf016b6a18480aed532
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20x3462616c
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
132307292
149307296
10253
147307299
1313072957
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce78e2b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x22e00
SizeOfInitializedData0x26c00
SizeOfUninitializedData0
AddressOfEntryPoint0x4bc00
BaseOfCode0x1000
BaseOfData0x22000
ImageBase0x4ad00000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x4c000
SizeOfHeaders0x400
CheckSum0x57b3d
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0xfd000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x22c200x22e00R-X CODE
.data0x240000x1c9300x1ca00RW- IDATA
.rsrc0x410000x84500x8600R-- IDATA
.reloc0x4a0000x259a0x2600-WX CODE DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x227d00x64
RESOURCE0x410000x8450
EXCEPTION00
SECURITY00
BASERELOC0x4a0000x1b30
DEBUG0x23bc40x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1bda00x40
Bound_IAT0x2800x94
IAT0x10000x3a4
Delay_IAT0x224fc0xa0
CLR_Header00
typenamesizecp
MUI#12160
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#757900
ICON#896400
ICON#942640
ICON#1011280
GROUP_ICONIDI_APPICON1460
VERSION#19040
MANIFEST#18960
module_namehintordfunction_name
msvcrt.dll1167exit
msvcrt.dll437_getch
msvcrt.dll1229iswdigit
msvcrt.dll1384wcstol
msvcrt.dll974_vsnwprintf
msvcrt.dll1007_wcsicmp
msvcrt.dll295_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll345_except_handler4_common
msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll145__getmainargs
msvcrt.dll1157calloc
msvcrt.dll1190free
msvcrt.dll1011_wcslwr
msvcrt.dll1274qsort
msvcrt.dll335_dup2
msvcrt.dll334_dup
msvcrt.dll749_open_osfhandle
msvcrt.dll291_close
msvcrt.dll1327swscanf
msvcrt.dll924_ultoa
msvcrt.dll758_pipe
msvcrt.dll812_setmode
msvcrt.dll1371wcsncmp
msvcrt.dll1236iswxdigit
msvcrt.dll1133_wtol
msvcrt.dll1332time
msvcrt.dll1294srand
msvcrt.dll1173fflush
msvcrt.dll426_get_osfhandle
msvcrt.dll809_setjmp3
msvcrt.dll1380wcsstr
msvcrt.dll573_local_unwind4
msvcrt.dll342_errno
msvcrt.dll1387wcstoul
msvcrt.dll1225iswalpha
msvcrt.dll1277rand
msvcrt.dll1376wcsrchr
msvcrt.dll1258memcpy
msvcrt.dll1267printf
msvcrt.dll475_iob
msvcrt.dll1183fprintf
msvcrt.dll1339towlower
msvcrt.dll1279realloc
msvcrt.dll1286setlocale
msvcrt.dll1034_wcsupr
msvcrt.dll1087_wpopen
msvcrt.dll1172ferror
msvcrt.dll1176fgets
msvcrt.dll1171feof
msvcrt.dll755_pclose
msvcrt.dll1260memmove
msvcrt.dll1361wcschr
msvcrt.dll905_tell
msvcrt.dll1234iswspace
msvcrt.dll1262memset
msvcrt.dll1379wcsspn
msvcrt.dll1340towupper
msvcrt.dll1245longjmp
msvcrt.dll1017_wcsnicmp
ntdll.dll1044RtlNtStatusToDosError
ntdll.dll497NtSetInformationProcess
ntdll.dll398NtQueryInformationProcess
ntdll.dll822RtlFindLeastSignificantBit
ntdll.dll840RtlFreeHeap
ntdll.dll297NtFsControlFile
ntdll.dll759RtlDosPathNameToNtPathName_U
ntdll.dll401NtQueryInformationToken
ntdll.dll212NtClose
ntdll.dll355NtOpenProcessToken
ntdll.dll363NtOpenThreadToken
KERNEL32.dll455GetDateFormatW
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll447GetCurrentProcess
KERNEL32.dll631GetSystemTimeAsFileTime
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll657GetTickCount
KERNEL32.dll931QueryPerformanceCounter
KERNEL32.dll530GetModuleHandleA
KERNEL32.dll1184SetUnhandledExceptionFilter
KERNEL32.dll1198Sleep
KERNEL32.dll747InterlockedExchange
KERNEL32.dll828LoadLibraryExA
KERNEL32.dll744InterlockedCompareExchange
KERNEL32.dll353FreeLibrary
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll147CreateHardLinkW
KERNEL32.dll178CreateSymbolicLinkW
KERNEL32.dll681GetVolumePathNameW
KERNEL32.dll650GetThreadLocale
KERNEL32.dll646GetThreadGroupAffinity
KERNEL32.dll553GetNumaNodeProcessorMaskEx
KERNEL32.dll1145SetProcessAffinityMask
KERNEL32.dll1039ResumeThread
KERNEL32.dll307FindFirstFileExW
KERNEL32.dll220DeviceIoControl
KERNEL32.dll314FindFirstStreamW
KERNEL32.dll325FindNextStreamW
KERNEL32.dll461GetDiskFreeSpaceExW
KERNEL32.dll96CompareFileTime
KERNEL32.dll1023RemoveDirectoryW
KERNEL32.dll446GetCurrentDirectoryW
KERNEL32.dll1097SetCurrentDirectoryW
KERNEL32.dll1212TerminateProcess
KERNEL32.dll1269WaitForSingleObject
KERNEL32.dll478GetExitCodeProcess
KERNEL32.dll117CopyFileW
KERNEL32.dll1116SetFileAttributesW
KERNEL32.dll1103SetEndOfFile
KERNEL32.dll213DeleteFileW
KERNEL32.dll1125SetFileTime
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll293FillConsoleOutputAttribute
KERNEL32.dll1090SetConsoleTextAttribute
KERNEL32.dll1047ScrollConsoleScreenBufferW
KERNEL32.dll349FormatMessageW
KERNEL32.dll359GetACP
KERNEL32.dll231DuplicateHandle
KERNEL32.dll342FlushFileBuffers
KERNEL32.dll721HeapReAlloc
KERNEL32.dll723HeapSize
KERNEL32.dll1253VirtualAlloc
KERNEL32.dll1256VirtualFree
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll898OpenThread
KERNEL32.dll722HeapSetInformation
KERNEL32.dll484GetFileAttributesExW
KERNEL32.dll466GetDriveTypeW
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll1065SetConsoleCtrlHandler
KERNEL32.dll685GetWindowsDirectoryW
KERNEL32.dll672GetVersion
KERNEL32.dll529GetModuleFileNameW
KERNEL32.dll284ExpandEnvironmentStringsW
KERNEL32.dll68CancelSynchronousIo
KERNEL32.dll237EnterCriticalSection
KERNEL32.dll824LeaveCriticalSection
KERNEL32.dll677GetVolumeInformationW
KERNEL32.dll1049SearchPathW
KERNEL32.dll1313WriteFile
KERNEL32.dll1122SetFilePointerEx
KERNEL32.dll690GlobalAlloc
KERNEL32.dll697GlobalFree
KERNEL32.dll865MoveFileW
KERNEL32.dll1092SetConsoleTitleW
KERNEL32.dll839LocalFree
KERNEL32.dll862MoveFileExW
KERNEL32.dll437GetConsoleTitleW
KERNEL32.dll487GetFileAttributesW
KERNEL32.dll871NeedCurrentDirectoryForExePathW
KERNEL32.dll368GetBinaryTypeW
KERNEL32.dll1121SetFilePointer
KERNEL32.dll1342lstrcmpW
KERNEL32.dll1345lstrcmpiW
KERNEL32.dll718HeapFree
KERNEL32.dll583GetProcessHeap
KERNEL32.dll1171SetThreadLocale
KERNEL32.dll578GetProcAddress
KERNEL32.dll533GetModuleHandleW
KERNEL32.dll1261VirtualQuery
KERNEL32.dll714HeapAlloc
KERNEL32.dll82CloseHandle
KERNEL32.dll869MultiByteToWideChar
KERNEL32.dll956ReadFile
KERNEL32.dll1312WriteConsoleW
KERNEL32.dll295FillConsoleOutputCharacterW
KERNEL32.dll1069SetConsoleCursorPosition
KERNEL32.dll954ReadConsoleW
KERNEL32.dll433GetConsoleScreenBufferInfo
KERNEL32.dll610GetStdHandle
KERNEL32.dll496GetFileType
KERNEL32.dll511GetLastError
KERNEL32.dll1293WideCharToMultiByte
KERNEL32.dll493GetFileSize
KERNEL32.dll341FlushConsoleInputBuffer
KERNEL32.dll369GetCPInfo
KERNEL32.dll431GetConsoleOutputCP
KERNEL32.dll92CmdBatNotification
KERNEL32.dll143CreateFileW
KERNEL32.dll301FindClose
KERNEL32.dll324FindNextFileW
KERNEL32.dll312FindFirstFileW
KERNEL32.dll504GetFullPathNameW
KERNEL32.dll665GetUserDefaultLCID
KERNEL32.dll1137SetLocalTime
KERNEL32.dll1209SystemTimeToFileTime
KERNEL32.dll629GetSystemTime
KERNEL32.dll292FileTimeToSystemTime
KERNEL32.dll515GetLocaleInfoW
KERNEL32.dll291FileTimeToLocalFileTime
KERNEL32.dll661GetTimeFormatW
KERNEL32.dll512GetLocalTime
KERNEL32.dll352FreeEnvironmentStringsW
KERNEL32.dll473GetEnvironmentStringsW
KERNEL32.dll1107SetEnvironmentVariableW
KERNEL32.dll1105SetEnvironmentStringsW
KERNEL32.dll1081SetConsoleMode
KERNEL32.dll427GetConsoleMode
KERNEL32.dll550GetNumaHighestNodeNumber
KERNEL32.dll390GetCommandLineW
KERNEL32.dll475GetEnvironmentVariableW
KERNEL32.dll1108SetErrorMode
KERNEL32.dll671GetVDMCurrentDirectories
KERNEL32.dll961RegCloseKey
KERNEL32.dll1134SetLastError
KERNEL32.dll993RegQueryValueExW
KERNEL32.dll988RegOpenKeyExW
KERNEL32.dll969RegDeleteValueW
KERNEL32.dll965RegDeleteKeyExW
KERNEL32.dll959ReadProcessMemory
KERNEL32.dll830LoadLibraryW
KERNEL32.dll926QueryFullProcessImageNameW
KERNEL32.dll438GetConsoleWindow
KERNEL32.dll167CreateProcessW
KERNEL32.dll609GetStartupInfoW
KERNEL32.dll214DeleteProcThreadAttributeList
KERNEL32.dll1241UpdateProcThreadAttribute
KERNEL32.dll741InitializeProcThreadAttributeList
KERNEL32.dll1000RegSetValueExW
KERNEL32.dll963RegCreateKeyExW
WINBRAND.dllBrandingFormatString

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Command Processor
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamecmd
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCmd.Exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0305152EXE11/20/2010 09:00:27#
15c115HTM#
42a005790PNG(256 x 256)#
4a8001536BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 306688 bytes (300 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x280