filenamesource.exe
size607232 (0x94400)
md59c000a868c256c6f9d096226865312bd
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
239401162
257267062
2612670635
2602670613
259267062
147307297
10124
260270341
2612703463
255270341
258270341

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xa
TimeDateStamp0x5f576056
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.16
SizeOfCode0x7c800
SizeOfInitializedData0x77e00
SizeOfUninitializedData0
AddressOfEntryPoint0x3c0b8
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x135000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x39ced0RWX CODE UDATA
.text0x3b0000x7c64c0x7c800R-X CODE
.rdata0xb80000x8d250x8e00R-- IDATA
.data0xc10000x651780x4c00RW- IDATA
.idata0x1270000x11b30x1200R-- IDATA
.msvcjmc0x1290000x36b0x400RW- IDATA
.tls0x12a0000x3090x400RW- IDATA
.00cfg0x12b0000x1040x200R-- IDATA
.rsrc0x12c0000x43c0x600R-- IDATA
.reloc0x12d0000x7ba10x7c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1273240x78
RESOURCE0x12c0000x43c
EXCEPTION00
SECURITY00
BASERELOC0x12d0000x68bc
DEBUG0xbe3800x38
ARCHITECTURE00
GLOBALPTR00
TLS0xbe8640x18
LOAD_CONFIG0xbe3b80x40
Bound_IAT00
IAT0x1270000x324
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x52a0000x52a2080x525d440x4b8b1000x300000
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll136CreateFileA
KERNEL32.dll211DeleteFileA
KERNEL32.dll302FindClose
KERNEL32.dll306FindFirstFileA
KERNEL32.dll323FindNextFileA
KERNEL32.dll446GetCurrentDirectoryA
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll960ReadFile
KERNEL32.dll1100SetCurrentDirectoryA
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1317WriteFile
KERNEL32.dll1202Sleep
KERNEL32.dll1265VirtualQuery
KERNEL32.dll586GetProcessHeap
KERNEL32.dll112CopyFileA
KERNEL32.dll715HeapAlloc
KERNEL32.dll514GetLastError
KERNEL32.dll743InitializeSListHead
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll945RaiseException
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll581GetProcAddress
KERNEL32.dll82CloseHandle
KERNEL32.dll719HeapFree
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll133CreateEventW
KERNEL32.dll1274WaitForSingleObjectEx
KERNEL32.dll1039ResetEvent
KERNEL32.dll1113SetEvent
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll354FreeLibrary
USER32.dll764TranslateMessage
USER32.dll714SetWindowTextA
USER32.dll109CreateWindowExA
USER32.dll155DefWindowProcA
USER32.dll174DispatchMessageA
USER32.dll267GetClassInfoA
USER32.dll276GetClientRect
USER32.dll317GetKeyState
USER32.dll345GetMessageA
USER32.dll446InvalidateRect
USER32.dll483KillTimer
USER32.dll488LoadCursorA
USER32.dll699SetTimer
USER32.dll492LoadIconA
USER32.dll562PeekMessageA
USER32.dll567PostQuitMessage
USER32.dll587RegisterClassA
USER32.dll3AdjustWindowRectEx
GDI32.dll692StretchDIBits
GDI32.dll649SetDIBitsToDevice
VCRUNTIME140D.dll47__vcrt_GetModuleHandleW
VCRUNTIME140D.dll49__vcrt_LoadLibraryExW
VCRUNTIME140D.dll16__CxxFrameHandler3
VCRUNTIME140D.dll72memset
VCRUNTIME140D.dll69memcmp
VCRUNTIME140D.dll71memmove
VCRUNTIME140D.dll70memcpy
VCRUNTIME140D.dll61_purecall
VCRUNTIME140D.dll53_except_handler4_common
VCRUNTIME140D.dll33__std_exception_copy
VCRUNTIME140D.dll34__std_exception_destroy
VCRUNTIME140D.dll1_CxxThrowException
VCRUNTIME140D.dll37__std_type_info_destroy_list
VCRUNTIME140D.dll46__vcrt_GetModuleFileNameW
ucrtbased.dll761_set_new_mode
ucrtbased.dll115__p__commode
ucrtbased.dll1381terminate
ucrtbased.dll738_register_thread_local_exe_atexit_callback
ucrtbased.dll1348strcat_s
ucrtbased.dll142__stdio_common_vsprintf_s
ucrtbased.dll322_free_dbg
ucrtbased.dll224_controlfp_s
ucrtbased.dll968_wmakepath_s
ucrtbased.dll996_wsplitpath_s
ucrtbased.dll1406wcscpy_s
ucrtbased.dll197_c_exit
ucrtbased.dll758_set_fmode
ucrtbased.dll273_exit
ucrtbased.dll410_initterm_e
ucrtbased.dll409_initterm
ucrtbased.dll357_get_narrow_winmain_command_line
ucrtbased.dll129__setusermatherr
ucrtbased.dll753_set_app_type
ucrtbased.dll750_seh_filter_exe
ucrtbased.dll199_callnewh
ucrtbased.dll21_CrtDbgReportW
ucrtbased.dll20_CrtDbgReport
ucrtbased.dll202_cexit
ucrtbased.dll231_crt_at_quick_exit
ucrtbased.dll232_crt_atexit
ucrtbased.dll268_execute_onexit_table
ucrtbased.dll737_register_onexit_function
ucrtbased.dll407_initialize_onexit_table
ucrtbased.dll406_initialize_narrow_environment
ucrtbased.dll749_seh_filter_dll
ucrtbased.dll1346srand
ucrtbased.dll1141exit
ucrtbased.dll1095clock
ucrtbased.dll1316realloc
ucrtbased.dll1272malloc
ucrtbased.dll1349strcmp
ucrtbased.dll1314rand
ucrtbased.dll1310qsort
ucrtbased.dll219_configthreadlocale
ucrtbased.dll1352strcpy_s
ucrtbased.dll220_configure_narrow_argv
offsetsizetypecomment
0607232EXE09/08/2020 10:43:34#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x125d44