PEFile.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	PEFile.exe
size	122880 (0x1e000)
md5	9982f51144a83a26e4c6bf535ac02a27

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
14	7299	18
10	9782	82
77	2144	2
93	4035	11
1	0	87
11	9782	26

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x5005d7d9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x10000
SizeOfInitializedData	0x30000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x8f0e
BaseOfCode	0x1000
BaseOfData	0x11000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x41000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Armadillo v4.x

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xf82e	0x10000	R-X CODE
.rdata	0x11000	0x14de	0x2000	R-- IDATA
.data	0x13000	0x2cd5c	0xa000	RW- IDATA
.sxdata	0x40000	0x18	0x1000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x11d00	0x78
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x11000	0x15c
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	356	GetFileSizeEx
KERNEL32.dll	197	FileTimeToSystemTime
KERNEL32.dll	369	GetLastError
KERNEL32.dll	352	GetFileAttributesExW
KERNEL32.dll	916	WideCharToMultiByte
KERNEL32.dll	881	UnmapViewOfFile
KERNEL32.dll	616	MapViewOfFile
KERNEL32.dll	85	CreateFileMappingW
KERNEL32.dll	16	BackupSeek
KERNEL32.dll	15	BackupRead
KERNEL32.dll	322	GetCurrentProcess
KERNEL32.dll	132	DeleteFileW
KERNEL32.dll	629	MultiByteToWideChar
KERNEL32.dll	853	SizeofResource
KERNEL32.dll	248	FreeLibrary
KERNEL32.dll	168	EnumResourceTypesW
KERNEL32.dll	597	LoadLibraryW
KERNEL32.dll	166	EnumResourceNamesW
KERNEL32.dll	164	EnumResourceLanguagesW
KERNEL32.dll	229	FindResourceExW
KERNEL32.dll	442	GetStringTypeA
KERNEL32.dll	581	LCMapStringW
KERNEL32.dll	86	CreateFileW
KERNEL32.dll	932	WriteFile
KERNEL32.dll	52	CloseHandle
KERNEL32.dll	580	LCMapStringA
KERNEL32.dll	594	LoadLibraryA
KERNEL32.dll	416	GetProcAddress
KERNEL32.dll	403	GetOEMCP
KERNEL32.dll	253	GetACP
KERNEL32.dll	260	GetCPInfo
KERNEL32.dll	784	SetEndOfFile
KERNEL32.dll	727	RtlUnwind
KERNEL32.dll	185	ExitProcess
KERNEL32.dll	862	TerminateProcess
KERNEL32.dll	488	GetVersion
KERNEL32.dll	679	RaiseException
KERNEL32.dll	534	HeapFree
KERNEL32.dll	538	HeapReAlloc
KERNEL32.dll	528	HeapAlloc
KERNEL32.dll	540	HeapSize
KERNEL32.dll	795	SetFilePointer
KERNEL32.dll	358	GetFileType
KERNEL32.dll	83	CreateFileA
KERNEL32.dll	323	GetCurrentProcessId
KERNEL32.dll	693	ReadFile
KERNEL32.dll	878	UnhandledExceptionFilter
KERNEL32.dll	382	GetModuleFileNameW
KERNEL32.dll	246	FreeEnvironmentStringsA
KERNEL32.dll	247	FreeEnvironmentStringsW
KERNEL32.dll	343	GetEnvironmentStringsW
KERNEL32.dll	341	GetEnvironmentStrings
KERNEL32.dll	273	GetCommandLineW
KERNEL32.dll	272	GetCommandLineA
KERNEL32.dll	804	SetHandleCount
KERNEL32.dll	441	GetStdHandle
KERNEL32.dll	439	GetStartupInfoA
KERNEL32.dll	383	GetModuleHandleA
KERNEL32.dll	381	GetModuleFileNameA
KERNEL32.dll	344	GetEnvironmentVariableA
KERNEL32.dll	489	GetVersionExA
KERNEL32.dll	532	HeapDestroy
KERNEL32.dll	530	HeapCreate
KERNEL32.dll	899	VirtualFree
KERNEL32.dll	842	SetUnhandledExceptionFilter
KERNEL32.dll	897	VirtualAlloc
KERNEL32.dll	566	IsBadWritePtr
KERNEL32.dll	563	IsBadReadPtr
KERNEL32.dll	560	IsBadCodePtr
KERNEL32.dll	823	SetStdHandle
KERNEL32.dll	238	FlushFileBuffers
KERNEL32.dll	445	GetStringTypeW
USER32.dll	486	MessageBoxW
ADVAPI32.dll	336	LookupPrivilegeValueW
ADVAPI32.dll	28	AdjustTokenPrivileges
ADVAPI32.dll	428	OpenProcessToken
imagehlp.dll	31	MapAndLoad
imagehlp.dll	12	GetImageConfigInformation
imagehlp.dll	105	UnMapAndLoad
VERSION.dll	13	VerQueryValueW
VERSION.dll	3	GetFileVersionInfoW
VERSION.dll	2	GetFileVersionInfoSizeW

show previews

offset	size	type	comment
0	122880	EXE	07/17/2012 21:23:37	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK