filenamemergesuif.x86-mingw32.exe
size1281268 (0x138cf4)
md59a164c81e0393488f3d1bf1f7895314b
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xf
TimeDateStamp0x4f1831cf
PointerToSymbolTable0xec600
NumberOfSymbols0x21ef
SizeOfOptionalHeader0xe0
Characteristics0x107
Magic0x10b
LinkerVersion2.21
SizeOfCode0xc3000
SizeOfInitializedData0xcc800
SizeOfUninitializedData0x2c00
AddressOfEntryPoint0x1550
BaseOfCode0x1000
BaseOfData0xc4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xf7000
SizeOfHeaders0x400
CheckSum0x13ca39
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x4000000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xc2f5c0xc3000R-X CODE IDATA
.data0xc40000x1400x200RW- IDATA
.rdata0xc50000x816c0x8200R-- IDATA
.bss0xce0000x2ac00RW- UDATA
.idata0xd10000xe180x1000RW- IDATA
.CRT0xd20000x340x200RW- IDATA
.tls0xd30000x200x200RW- IDATA
/40xd40000x4400x600R-- IDATA DISCARDABLE
/190xd50000xf91d0xfa00R-- IDATA DISCARDABLE
/310xe50000x2a520x2c00R-- IDATA DISCARDABLE
/450xe80000x34490x3600R-- IDATA DISCARDABLE
/570xec0000xe8c0x1000R-- IDATA DISCARDABLE
/700xed0000x6c60x800R-- IDATA DISCARDABLE
/810xee0000x7ae50x7c00R-- IDATA DISCARDABLE
/920xf60000x3b80x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xd10000xe18
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xd30000x18
LOAD_CONFIG00
Bound_IAT00
IAT0xd12980x20c
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4d30190x4d301c0x4cfc2c0x4d202000
module_namehintordfunction_name
ADVAPI32.dll344GetSidSubAuthority
ADVAPI32.dll345GetSidSubAuthorityCount
ADVAPI32.dll352GetTokenInformation
ADVAPI32.dll510OpenProcessToken
libgcc_s_sjlj-1.dll16_Unwind_SjLj_Register
libgcc_s_sjlj-1.dll17_Unwind_SjLj_Resume
libgcc_s_sjlj-1.dll19_Unwind_SjLj_Unregister
libgcc_s_sjlj-1.dll39__divdi3
libgcc_s_sjlj-1.dll82__moddi3
libgcc_s_sjlj-1.dll117__udivdi3
libgcc_s_sjlj-1.dll119__umoddi3
KERNEL32.dll100CopyFileA
KERNEL32.dll196DeleteCriticalSection
KERNEL32.dll223EnterCriticalSection
KERNEL32.dll339FreeLibrary
KERNEL32.dll433GetCurrentProcess
KERNEL32.dll434GetCurrentProcessId
KERNEL32.dll437GetCurrentThreadId
KERNEL32.dll491GetHandleInformation
KERNEL32.dll494GetLastError
KERNEL32.dll510GetModuleHandleA
KERNEL32.dll553GetProcAddress
KERNEL32.dll580GetStartupInfoA
KERNEL32.dll603GetSystemTimeAsFileTime
KERNEL32.dll627GetTickCount
KERNEL32.dll710InitializeCriticalSection
KERNEL32.dll769LeaveCriticalSection
KERNEL32.dll771LoadLibraryA
KERNEL32.dll871QueryPerformanceCounter
KERNEL32.dll1073SetUnhandledExceptionFilter
KERNEL32.dll1085Sleep
KERNEL32.dll1097TerminateProcess
KERNEL32.dll1104TlsGetValue
KERNEL32.dll1117UnhandledExceptionFilter
KERNEL32.dll1149VirtualProtect
KERNEL32.dll1152VirtualQuery
msvcrt.dll26_fileno
msvcrt.dll75_strdup
msvcrt.dll56__dllonexit
msvcrt.dll59__getmainargs
msvcrt.dll60__initenv
msvcrt.dll69__lconv_init
msvcrt.dll105__set_app_type
msvcrt.dll108__setusermatherr
msvcrt.dll122_acmdln
msvcrt.dll143_amsg_exit
msvcrt.dll160_cexit
msvcrt.dll218_errno
msvcrt.dll252_fmode
msvcrt.dll263_fstat
msvcrt.dll271_fullpath
msvcrt.dll283_get_osfhandle
msvcrt.dll317_initterm
msvcrt.dll321_iob
msvcrt.dll421_lock
msvcrt.dll583_onexit
msvcrt.dll584_open
msvcrt.dll594_pipe
msvcrt.dll679_stat
msvcrt.dll690_stricmp
msvcrt.dll700_strnicmp
msvcrt.dll758_unlock
msvcrt.dll892_winmajor
msvcrt.dll958abort
msvcrt.dll967atof
msvcrt.dll968atoi
msvcrt.dll972calloc
msvcrt.dll982exit
msvcrt.dll985fclose
msvcrt.dll988fflush
msvcrt.dll991fgets
msvcrt.dll996fopen
msvcrt.dll998fprintf
msvcrt.dll1000fputc
msvcrt.dll1001fputs
msvcrt.dll1004fread
msvcrt.dll1005free
msvcrt.dll1011fseek
msvcrt.dll1013ftell
msvcrt.dll1016fwrite
msvcrt.dll1021getenv
msvcrt.dll1037isspace
msvcrt.dll1056localeconv
msvcrt.dll1060longjmp
msvcrt.dll1061malloc
msvcrt.dll1069memcpy
msvcrt.dll1071memmove
msvcrt.dll1073memset
msvcrt.dll1079putc
msvcrt.dll1084qsort
msvcrt.dll1087rand
msvcrt.dll1098signal
msvcrt.dll1101sprintf
msvcrt.dll1104srand
msvcrt.dll1105sscanf
msvcrt.dll1107strcat
msvcrt.dll1109strchr
msvcrt.dll1110strcmp
msvcrt.dll1112strcpy
msvcrt.dll1115strerror
msvcrt.dll1118strlen
msvcrt.dll1121strncmp
msvcrt.dll1122strncpy
msvcrt.dll1126strrchr
msvcrt.dll1128strstr
msvcrt.dll1130strtok
msvcrt.dll1132strtol
msvcrt.dll1133strtoul
msvcrt.dll1142time
msvcrt.dll1147tolower
msvcrt.dll1153vfprintf
libstdc++-6.dll2726_ZSt15set_new_handlerPFvvE
libstdc++-6.dll2813_ZSt9terminatev
libstdc++-6.dll3291_ZTVN10__cxxabiv117__class_type_infoE
libstdc++-6.dll3295_ZTVN10__cxxabiv120__si_class_type_infoE
libstdc++-6.dll3296_ZTVN10__cxxabiv121__vmi_class_type_infoE
libstdc++-6.dll3460_ZdaPv
libstdc++-6.dll3462_ZdlPv
libstdc++-6.dll3464_Znaj
libstdc++-6.dll3466_Znwj
libstdc++-6.dll3482__cxa_guard_abort
libstdc++-6.dll3483__cxa_guard_acquire
libstdc++-6.dll3484__cxa_guard_release
libstdc++-6.dll3485__cxa_pure_virtual
libstdc++-6.dll3499__gxx_personality_sj0
offsetsizetypecomment
0968192EXE01/19/2012 15:07:59#
15c115HTM#
ec600313076BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xcfc2c