filenamea.exe
size60912 (0xedf0)
md5ad456c794129edb86645394730d91c4a
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xf
TimeDateStamp0x565431a6
PointerToSymbolTable0xb800
NumberOfSymbols0x25f
SizeOfOptionalHeader0xe0
Characteristics0x127
Magic0x10b
LinkerVersion2.25
SizeOfCode0x800
SizeOfInitializedData0x1c00
SizeOfUninitializedData0x200
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x400
CheckSum0x161db
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x7640x800R-X CODE IDATA
.data0x20000x440x200RW- IDATA
.rdata0x30000x2ec0x400R-- IDATA
.buildid0x40000x350x200R-- IDATA
/40x50000x36c0x400R-- IDATA
.bss0x60000x1100RW- UDATA
.idata0x70000x1ec0x200RW- IDATA
.rsrc0x80000x4e80x600RW- IDATA
/140x90000x1780x200R-- IDATA DISCARDABLE
/290xa0000x711c0x7200R-- IDATA DISCARDABLE
/410x120000xcb90xe00R-- IDATA DISCARDABLE
/550x130000xe4d0x1000R-- IDATA DISCARDABLE
/670x140000x310x200R-- IDATA DISCARDABLE
/780x150000x1a60x200R-- IDATA DISCARDABLE
/890x160000x300x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x70000x1ec
RESOURCE0x80000x4e8
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x40000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x707c0x40
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#111670
module_namehintordfunction_name
cygwin1.dll25__cxa_atexit
cygwin1.dll77__main
cygwin1.dll200_dll_crt0@0
cygwin1.dll385_impure_ptr
cygwin1.dll758calloc
cygwin1.dll863cygwin_detach_dll
cygwin1.dll865cygwin_internal
cygwin1.dll886dll_dllcrt0
cygwin1.dll1044free
cygwin1.dll1333malloc
cygwin1.dll1431posix_memalign
cygwin1.dll1598realloc
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll581GetProcAddress
offsetsizetypecomment
047104EXE11/24/2015 09:45:10#
15c115HTM#
b80013808BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK