filenamegnugo.exe
size9816593 (0x95ca11)
md5a47547081288f58dc892fb6f6a7f66a2
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x49a3e445
PointerToSymbolTable0x91c400
NumberOfSymbols0x23f2
SizeOfOptionalHeader0xe0
Characteristics0x107
Magic0x10b
LinkerVersion2.56
SizeOfCode0xbfa00
SizeOfInitializedData0x543600
SizeOfUninitializedData0x2ca600
AddressOfEntryPoint0x1280
BaseOfCode0x1000
BaseOfData0xc1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xbeb000
SizeOfHeaders0x400
CheckSum0x95cf12
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MingWin32 - Dev C++ v4.x

Sections

namevavsizeraw sizeflags
.text0x10000xbf8340xbfa00R-X CODE
.data0xc10000x16c11c0x16c200RW- IDATA
.rdata0x22e0000x3d67e00x3d6800R-- IDATA
.bss0x6050000x2ca4800RW- UDATA
.idata0x8d00000xad40xc00RW- IDATA
.stab0x8d10000x17a4a40x17a600--- DISCARDABLE
.stabstr0xa4c0000x19e8290x19ea00--- DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x8d00000xad4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
msvcrt.dll42_isatty
msvcrt.dll64_read
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll61__lc_codepage
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll137_assert
msvcrt.dll147_cexit
msvcrt.dll182_errno
msvcrt.dll200_filbuf
msvcrt.dll213_flsbuf
msvcrt.dll266_iob
msvcrt.dll268_isctype
msvcrt.dll383_onexit
msvcrt.dll392_pctype
msvcrt.dll426_setmode
msvcrt.dll490_vsnprintf
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll591atof
msvcrt.dll592atoi
msvcrt.dll595calloc
msvcrt.dll596ceil
msvcrt.dll604exit
msvcrt.dll607fclose
msvcrt.dll610fflush
msvcrt.dll613fgets
msvcrt.dll616floor
msvcrt.dll618fopen
msvcrt.dll619fprintf
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll624fread
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll671localeconv
msvcrt.dll672localtime
msvcrt.dll673log
msvcrt.dll676malloc
msvcrt.dll682memcpy
msvcrt.dll684memset
msvcrt.dll687perror
msvcrt.dll688pow
msvcrt.dll689printf
msvcrt.dll691putchar
msvcrt.dll692puts
msvcrt.dll698realloc
msvcrt.dll703setbuf
msvcrt.dll705setvbuf
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll710sqrt
msvcrt.dll712sscanf
msvcrt.dll713strcat
msvcrt.dll714strchr
msvcrt.dll715strcmp
msvcrt.dll717strcpy
msvcrt.dll721strlen
msvcrt.dll723strncmp
msvcrt.dll728strstr
msvcrt.dll730strtok
msvcrt.dll731strtol
msvcrt.dll739time
msvcrt.dll742tolower
msvcrt.dll743toupper
msvcrt.dll748vfprintf
msvcrt.dll761wcslen
KERNEL32.dll107DeleteCriticalSection
KERNEL32.dll126EnterCriticalSection
KERNEL32.dll156ExitProcess
KERNEL32.dll273GetConsoleScreenBufferInfo
KERNEL32.dll283GetCurrentProcess
KERNEL32.dll325GetLastError
KERNEL32.dll373GetProcessTimes
KERNEL32.dll388GetStdHandle
KERNEL32.dll403GetSystemTimeAsFileTime
KERNEL32.dll492InitializeCriticalSection
KERNEL32.dll497InterlockedExchange
KERNEL32.dll512IsDBCSLeadByteEx
KERNEL32.dll523LeaveCriticalSection
KERNEL32.dll560MultiByteToWideChar
KERNEL32.dll683SetConsoleTextAttribute
KERNEL32.dll739SetUnhandledExceptionFilter
KERNEL32.dll751Sleep
KERNEL32.dll814WideCharToMultiByte
KERNEL32.dll816WriteConsoleA
WSOCK32.DLL26WSAGetLastError
WSOCK32.DLL31WSAStartup
WSOCK32.DLL34__WSAFDIsSet
WSOCK32.DLL35accept
WSOCK32.DLL36bind
WSOCK32.DLL37closesocket
WSOCK32.DLL38connect
WSOCK32.DLL41gethostbyname
WSOCK32.DLL51htonl
WSOCK32.DLL52htons
WSOCK32.DLL57listen
WSOCK32.DLL61recv
WSOCK32.DLL66select
WSOCK32.DLL67send
WSOCK32.DLL72socket
offsetsizetypecomment
15c115HTM#
15d09811009BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK