minitd.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	minitd.exe
size	415232 (0x65600)
md5	b0b746b23de7f5c384f66fcf8b16ac9f

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
147	30729	24
257	26706	2
199	41118	6
261	26706	22
260	26706	10
259	26706	3
262	25203	3
257	25203	23
1	0	345
260	27031	192
261	27031	6
0	0	1
255	27031	1
258	27031	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	3
TimeDateStamp	0x5d1bbe18
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.16
SizeOfCode	0x65000
SizeOfInitializedData	0x1000
SizeOfUninitializedData	0x9f000
AddressOfEntryPoint	0x104540
BaseOfCode	0xa0000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x106000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX?

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x9f000	0	RWX UDATA
UPX1	0xa0000	0x65000	0x64a00	RWX IDATA
.rsrc	0x105000	0x1000	0x800	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x105058	0x6d0
RESOURCE	0x105000	0x58
EXCEPTION	0xf0000	0x83f4
SECURITY	0	0
BASERELOC	0x105728	0x10
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x1047b8	0x100
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
RCDATA	#42	18173	0

module_name	ord	function_name
ADVAPI32.dll		CryptHashData
api-ms-win-crt-convert-l1-1-0.dll		strtol
api-ms-win-crt-environment-l1-1-0.dll		getenv
api-ms-win-crt-filesystem-l1-1-0.dll		_access
api-ms-win-crt-heap-l1-1-0.dll		free
api-ms-win-crt-locale-l1-1-0.dll		_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll		cos
api-ms-win-crt-multibyte-l1-1-0.dll		_mbschr
api-ms-win-crt-runtime-l1-1-0.dll		exit
api-ms-win-crt-stdio-l1-1-0.dll		ftell
api-ms-win-crt-string-l1-1-0.dll		strspn
api-ms-win-crt-time-l1-1-0.dll		_time64
api-ms-win-crt-utility-l1-1-0.dll		qsort
CRYPT32.dll		CertOpenStore
GDI32.dll		BitBlt
IMM32.dll		ImmNotifyIME
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		ExitProcess
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
ole32.dll		CoInitializeEx
OLEAUT32.dll	6
SHELL32.dll		DragFinish
USER32.dll		GetDC
VCRUNTIME140.dll		memchr
VERSION.dll		VerQueryValueA
WS2_32.dll	115

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	409648	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK