calc.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	calc.exe
size	726528 (0xb1600)
md5	a22bba29ce3e34a43b8eb3e151026cec

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0xe400
oem_info	0xf29c
reserved2	0x9bb7ede5
reserved3	0x1584c8d5
reserved4	0xc66dad
reserved5	0
reserved6	0
lfanew	0xc0

Rich Header

lib id	version	times used
44	15570	241
29	15570	241

DOS stub

00000000: e5 5e 20 05 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |.^ .....!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x486cca37
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x30e
Magic	0x10b
LinkerVersion	4.0
SizeOfCode	0x12000
SizeOfInitializedData	0x9f800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x660d
BaseOfCode	0x1000
BaseOfData	0x13000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.1
ImageVersion	5.1
SubsystemVersion	4.1
Reserved1	0
SizeOfImage	0x101000
SizeOfHeaders	0x400
CheckSum	0xbe86f
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1185f	0x11a00	R-X CODE
.idata	0x13000	0xe07be	0x95600	R-- IDATA
.data	0xf4000	0x7c	0x200	RW- IDATA
.data	0xf5000	0x8f	0x200	RW- IDATA
.rsrc	0xf6000	0x9a04	0x9c00	R-- IDATA
.reloc	0x100000	0x17c	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x124ac	0x64
RESOURCE	0xf6000	0x9a04
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x100000	0x17c
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xa8478	0x9c
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	38056	1252
ICON	#2	1128	1252
GROUP_ICON	#1	34	1252

module_name	hint	function_name
IPHLPAPI.dll	48	GetBestInterface
IPHLPAPI.dll	117	InternalGetUdpTable
IPHLPAPI.dll	119	InternalSetIpForwardEntry
IPHLPAPI.dll	39	DeleteProxyArpEntry
IPHLPAPI.dll	71	GetIpNetTable
KERNEL32.dll	774	SetConsoleOutputCP
KERNEL32.dll	778	SetConsoleTitleA
KERNEL32.dll	281	GetCommModemStatus
KERNEL32.dll	868	TlsFree
KERNEL32.dll	285	GetCommandLineA
KERNEL32.dll	898	VirtualAlloc
KERNEL32.dll	519	GlobalFlags
KERNEL32.dll	972	lstrlenW
KERNEL32.dll	513	GlobalAlloc
KERNEL32.dll	257	FreeConsole
KERNEL32.dll	22	AddAtomW
KERNEL32.dll	647	OpenJobObjectA
KERNEL32.dll	959	lstrcmpA
KERNEL32.dll	575	IsDBCSLeadByte
TAPI32.dll	117	lineGetConfRelatedCalls
TAPI32.dll	235	lineTranslateDialogW
TAPI32.dll	121	lineGetDevCaps
TAPI32.dll	171	lineOpenA
TAPI32.dll	79	lineDrop
ADVAPI32.dll	540	RegisterTraceGuidsW
ADVAPI32.dll	545	RevertToSelf
ADVAPI32.dll	304	GetTraceEnableLevel
ADVAPI32.dll	302	GetTokenInformation
ADVAPI32.dll	524	RegSaveKeyW
ADVAPI32.dll	608	SystemFunction004
ADVAPI32.dll	593	SetTokenInformation
ADVAPI32.dll	301	GetSidSubAuthorityCount
ADVAPI32.dll	526	RegSetValueA
ADVAPI32.dll	497	RegFlushKey
ADVAPI32.dll	168	CryptEnumProvidersW

show previews

offset	size	type	comment
0	726528	EXE	07/03/2008 12:46:47	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK