filenameLCSSIOtech.exe
size556135 (0x87c67)
md5971bd10d64821e270f23c3ef30ee68aa
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xe
TimeDateStamp0x49df90e0
PointerToSymbolTable0x75400
NumberOfSymbols0xdb0
SizeOfOptionalHeader0xe0
Characteristics0x107
Magic0x10b
LinkerVersion2.56
SizeOfCode0x2e400
SizeOfInitializedData0x35000
SizeOfUninitializedData0x63200
AddressOfEntryPoint0x1220
BaseOfCode0x1000
BaseOfData0x30000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xe0000
SizeOfHeaders0x600
CheckSum0x8c2e2
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Dev-C++ 4.9.9.2 (Bloodshed Software)

Sections

namevavsizeraw sizeflags
.text0x10000x2e2a00x2e400R-X CODE IDATA
.data0x300000x4b00x600RW- IDATA
.rdata0x310000x56500x5800R-- IDATA
.bss0x370000x630200RW- UDATA
.idata0x9b0000xce00xe00RW- IDATA
/40x9c0000x2a00x400R-- DISCARDABLE
/190x9d0000xcb30xe00R-- DISCARDABLE
/350x9e0000x216650x21800R-- DISCARDABLE
/470xc00000x377b0x3800R-- DISCARDABLE
/610xc40000x467e0x4800R-- DISCARDABLE
/730xc90000x29380x2a00R-- DISCARDABLE
/860xcc0000x7db0x800R-- DISCARDABLE
/970xcd0000x112910x11400R-- DISCARDABLE
/1080xdf0000xdf00xe00R-- DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x9b0000xce0
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
DAQX.dll2
DAQX.dll71
DAQX.dll64
DAQX.dll72
DAQX.dll77
DAQX.dll88
DAQX.dll78
DAQX.dll75
DAQX.dll69
DAQX.dll84
WSC32.dll6
WSC32.dll34
WSC32.dll27
WSC32.dll13
WSC32.dll26
WSC32.dll17
WSC32.dll23
WSC32.dll1
WSC32.dll19
WSC32.dll12
WSC32.dll31
KERNEL32.dll1AddAtomA
KERNEL32.dll87CreateSemaphoreA
KERNEL32.dll90CreateThread
KERNEL32.dll155ExitProcess
KERNEL32.dll170FillConsoleOutputCharacterA
KERNEL32.dll175FindAtomA
KERNEL32.dll220GetAtomNameA
KERNEL32.dll271GetConsoleScreenBufferInfo
KERNEL32.dll386GetStdHandle
KERNEL32.dll399GetSystemTime
KERNEL32.dll401GetSystemTimeAsFileTime
KERNEL32.dll490InitializeCriticalSection
KERNEL32.dll493InterlockedCompareExchange
KERNEL32.dll494InterlockedDecrement
KERNEL32.dll498InterlockedIncrement
KERNEL32.dll521LeaveCriticalSection
KERNEL32.dll626ReleaseSemaphore
KERNEL32.dll663SetConsoleCursorPosition
KERNEL32.dll735SetUnhandledExceptionFilter
KERNEL32.dll747Sleep
KERNEL32.dll766TryEnterCriticalSection
KERNEL32.dll805WaitForSingleObject
msvcrt.dll_access
msvcrt.dll2_cabs
msvcrt.dll7_close
msvcrt.dll11_dup
msvcrt.dll33_fstat
msvcrt.dll38_getcwd
msvcrt.dll43_isatty
msvcrt.dll52_lseek
msvcrt.dll57_mktemp
msvcrt.dll59_open
msvcrt.dll65_read
msvcrt.dll71_setmode
msvcrt.dll82_stat
msvcrt.dll101_unlink
msvcrt.dll113_write
msvcrt.dll39__getmainargs
msvcrt.dll48__mb_cur_max
msvcrt.dll60__p__environ
msvcrt.dll62__p__fmode
msvcrt.dll80__set_app_type
msvcrt.dll111_assert
msvcrt.dll121_cexit
msvcrt.dll128_chsize
msvcrt.dll143_daylight
msvcrt.dll152_errno
msvcrt.dll233_iob
msvcrt.dll235_isctype
msvcrt.dll350_onexit
msvcrt.dll359_pctype
msvcrt.dll384_setjmp
msvcrt.dll388_setmode
msvcrt.dll411_stricmp
msvcrt.dll415_strnicmp
msvcrt.dll429_timezone
msvcrt.dll433_tzset
msvcrt.dll445_vsnprintf
msvcrt.dll533abort
msvcrt.dll535acos
msvcrt.dll539atan2
msvcrt.dll540atexit
msvcrt.dll542atoi
msvcrt.dll549cos
msvcrt.dll554exit
msvcrt.dll555exp
msvcrt.dll557fclose
msvcrt.dll560fflush
msvcrt.dll568fopen
msvcrt.dll569fprintf
msvcrt.dll575free
msvcrt.dll578fscanf
msvcrt.dll583fwrite
msvcrt.dll587getenv
msvcrt.dll623log
msvcrt.dll624log10
msvcrt.dll625longjmp
msvcrt.dll626malloc
msvcrt.dll632memcpy
msvcrt.dll633memmove
msvcrt.dll634memset
msvcrt.dll638pow
msvcrt.dll639printf
msvcrt.dll641putchar
msvcrt.dll642puts
msvcrt.dll648realloc
msvcrt.dll656signal
msvcrt.dll657sin
msvcrt.dll659sprintf
msvcrt.dll660sqrt
msvcrt.dll662sscanf
msvcrt.dll663strcat
msvcrt.dll664strchr
msvcrt.dll665strcmp
msvcrt.dll669strerror
msvcrt.dll671strlen
msvcrt.dll673strncmp
msvcrt.dll679strtod
msvcrt.dll680strtok
msvcrt.dll686system
msvcrt.dll692tolower
msvcrt.dll693toupper
WSOCK32.DLL31WSAStartup
WSOCK32.DLL36bind
WSOCK32.DLL41gethostbyname
WSOCK32.DLL42gethostname
WSOCK32.DLL52htons
WSOCK32.DLL68sendto
WSOCK32.DLL70setsockopt
WSOCK32.DLL72socket
offsetsizetypecomment
0480256EXE04/10/2009 18:33:04#
15c115HTM#
7540075879BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK