filenamePeDaten.exe
size96256 (0x17800)
md5ad6559c8099b53621e676100a444ce0e
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
239401162
257230132
259230131
2612301322
2602301313
203655015
1074
260230261
255230261
15101
258230261

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x563e746e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x5600
SizeOfInitializedData0x12200
SizeOfUninitializedData0
AddressOfEntryPoint0x11050
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x2d000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000x55720x5600R-X CODE
.rdata0x170000x21550x2200R-- IDATA
.data0x1a0000x5a40x200RW- IDATA
.idata0x1b0000xc200xe00R-- IDATA
.00cfg0x1c0000x1040x200R-- IDATA
.rsrc0x1d0000xe2160xe400R-- IDATA
.reloc0x2c0000x5fd0x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1b20c0x64
RESOURCE0x1d0000xe216
EXCEPTION00
SECURITY00
BASERELOC0x2c0000x380
DEBUG0x186500x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x186880x40
Bound_IAT00
IAT0x1b0000x20c
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#128350
ICON#237520
ICON#322160
ICON#413840
ICON#531460
ICON#6169360
ICON#796400
ICON#842640
ICON#911280
GROUP_ICON#1011320
VERSION#113040
MANIFEST#13810
module_namehintordfunction_name
PSAPI.DLL17GetModuleInformation
PSAPI.DLL4EnumProcessModules
KERNEL32.dll669GetProcAddress
KERNEL32.dll1088RaiseException
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll414FreeLibrary
KERNEL32.dll1443VirtualQuery
KERNEL32.dll674GetProcessHeap
KERNEL32.dll819HeapFree
KERNEL32.dll815HeapAlloc
KERNEL32.dll592GetLastError
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll843InitializeSListHead
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll1377TerminateProcess
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll871IsDebuggerPresent
VCRUNTIME140D.dll40__telemetry_main_invoke_trigger
VCRUNTIME140D.dll37__std_type_info_destroy_list
VCRUNTIME140D.dll72memset
VCRUNTIME140D.dll53_except_handler4_common
VCRUNTIME140D.dll46__vcrt_GetModuleFileNameW
VCRUNTIME140D.dll47__vcrt_GetModuleHandleW
VCRUNTIME140D.dll49__vcrt_LoadLibraryExW
VCRUNTIME140D.dll41__telemetry_main_return_trigger
ucrtbased.dll112__p___argv
ucrtbased.dll202_cexit
ucrtbased.dll129__setusermatherr
ucrtbased.dll738_register_thread_local_exe_atexit_callback
ucrtbased.dll219_configthreadlocale
ucrtbased.dll761_set_new_mode
ucrtbased.dll115__p__commode
ucrtbased.dll142__stdio_common_vsprintf_s
ucrtbased.dll749_seh_filter_dll
ucrtbased.dll407_initialize_onexit_table
ucrtbased.dll737_register_onexit_function
ucrtbased.dll268_execute_onexit_table
ucrtbased.dll232_crt_atexit
ucrtbased.dll231_crt_at_quick_exit
ucrtbased.dll224_controlfp_s
ucrtbased.dll111__p___argc
ucrtbased.dll968_wmakepath_s
ucrtbased.dll996_wsplitpath_s
ucrtbased.dll1406wcscpy_s
ucrtbased.dll753_set_app_type
ucrtbased.dll750_seh_filter_exe
ucrtbased.dll21_CrtDbgReportW
ucrtbased.dll20_CrtDbgReport
ucrtbased.dll545_localtime64_s
ucrtbased.dll132__stdio_common_vfprintf_s
ucrtbased.dll130__stdio_common_vfprintf
ucrtbased.dll69__acrt_iob_func
ucrtbased.dll1378system
ucrtbased.dll1190free
ucrtbased.dll1061calloc
ucrtbased.dll758_set_fmode
ucrtbased.dll273_exit
ucrtbased.dll1141exit
ucrtbased.dll410_initterm_e
ucrtbased.dll409_initterm
ucrtbased.dll354_get_initial_narrow_environment
ucrtbased.dll406_initialize_narrow_environment
ucrtbased.dll1381terminate
ucrtbased.dll220_configure_narrow_argv
ucrtbased.dll197_c_exit

StringTable 040704b0

CompanyNameTODO: <Firmenname>
FileDescriptionTODO: <Dateibeschreibung>
FileVersion1.2.4.8
InternalNamePeDaten.exe
LegalCopyrightCopyright (C) 2015
OriginalFilenamePeDaten.exe
ProductNameKKVSIII_DE
ProductVersion16.32.64.128

StringTable 040904b0

CompanyNameTODO: <Firmenname>
FileDescriptionTODO: <Dateibeschreibung>
FileVersion1.2.4.8
InternalNamePeDaten.exe
LegalCopyrightCopyright (C) 2015
OriginalFilenamePeDaten.exe
ProductNameKKVSIII_US
ProductVersion16.32.64.128

VS_FIXEDFILEINFO

FileVersion1.2.4.8
ProductVersion16.32.64.128
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
096256EXE11/07/2015 22:00:14#
15c115HTM#
97582835PNG(256 x 256)#
bf283146PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER