filenamenotepad.exe
size66560 (0x10400)
md5b27afd01e6518c779b9c49ec3ad1cd86
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
6492101
001
25921019
10194
6991111
28917819
6192101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3b7d840d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.0
SizeOfCode0x6e00
SizeOfInitializedData0xa800
SizeOfUninitializedData0
AddressOfEntryPoint0x6ae0
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x13000
SizeOfHeaders0x400
CheckSum0x1e892
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x11000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x6d720x6e00R-X CODE
.data0x80000x1ba80x600RW- IDATA
.rsrc0xa0000x8ac60x8c00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x6d200xc8
RESOURCE0xa0000x8ac6
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x13400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2580xd0
IAT0x10000x324
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#796400
ICON#842640
ICON#911280
MENU#112140
DIALOGNPENCODINGDIALOG1260
DIALOG#112140
DIALOG#1210860
DIALOG#142220
STRING#120460
STRING#217960
STRING#33040
STRING#30580
ACCELERATORSMAINACC1520
ACCELERATORSSLIPUPACC1840
GROUP_ICON#21320
VERSION#18600
MANIFEST#16700
idlangstring
11033Cannot open the %% file. Make sure a disk is in the drive you specified.
21033Cannot find the %% file. Do you want to create a new file?
31033The text in the %% file has changed. Do you want to save the changes?
41033Untitled
51033 - Notepad
61033Cannot find "%%"
71033Not enough memory available to complete this operation. Quit one or more applications to increase available memory, and then try again.
81033The %% file is too large for Notepad. Use another editor to edit the file.
91033Notepad
101033Failed to Initialize File Dialogs. Change the Filename and try again.
111033Failed to Initialize Print Dialogs. Make sure that your printer is connected properly and use Control Panel to verify that the printer is configured properly.
121033Cannot print the %% file. Be sure that your printer is connected properly and use Control Panel to verify that the printer is configured properly.
131033Not a valid file name.
141033Cannot create the %% file. Make sure that the path and filename are correct.
151033Cannot carry out the Word Wrap command because there is too much text in the file.
161033%%
171033notepad.hlp
181033&f
191033Page &p
201033Text Documents (*.txt)
211033All Files
221033Open
231033Save As
241033You cannot quit Windows because the Save As dialog box in Notepad is open. Switch to Notepad, close this dialog box, and then try quitting Windows again.
251033Cannot access your printer. Be sure that your printer is connected properly and use Control Panel to verify that the printer is configured properly.
261033%% You do not have permission to open this file. See the owner of the file or an administrator to obtain permission.
271033%% This file contains characters in Unicode format which will be lost if you save this file as an ANSI encoded text file. To keep the Unicode information, click Cancel below and then select one of the Unicode options from the Encoding drop down list. Continue?
281033Page too small to print one line. Try printing using smaller font.
291033Common Dialog error (0x%04x)
301033Notepad - Goto Line
311033Line number out of range
321033ANSI
331033Unicode
341033Unicode big endian
351033UTF-8
361033Page %d
371033 Ln %d, Col %d
381033 Compressed,
391033 Encrypted,
401033 Hidden,
411033 Offline,
421033 ReadOnly,
431033 System,
441033 File
451033fFpPtTdDcCrRlL
4691033Text Document
module_namehintordfunction_name
comdlg32.dll15PageSetupDlgW
comdlg32.dll6FindTextW
comdlg32.dll18PrintDlgExW
comdlg32.dll3ChooseFontW
comdlg32.dll12GetSaveFileNameW
comdlg32.dll10GetOpenFileNameW
comdlg32.dll21ReplaceTextW
comdlg32.dll8GetFileTitleW
comdlg32.dll4CommDlgExtendedError
SHELL32.dll21DragFinish
SHELL32.dll25DragQueryFileW
SHELL32.dll20DragAcceptFiles
SHELL32.dll148ShellAboutW
WINSPOOL.DRV120GetPrinterDriverW
WINSPOOL.DRV27ClosePrinter
WINSPOOL.DRV124OpenPrinterW
COMCTL32.dll6CreateStatusWindowW
msvcrt.dll200_cexit
msvcrt.dll78_XcptFilter
msvcrt.dll246_exit
msvcrt.dll197_c_exit
msvcrt.dll790time
msvcrt.dll655exit
msvcrt.dll815wcsncpy
msvcrt.dll709iswctype
msvcrt.dll627_wtol
msvcrt.dll814wcsncmp
msvcrt.dll483_snwprintf
msvcrt.dll168_acmdln
msvcrt.dll109__getmainargs
msvcrt.dll314_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll237_except_handler3
msvcrt.dll214_controlfp
msvcrt.dll723localtime
ADVAPI32.dll492RegQueryValueExW
ADVAPI32.dll456RegCloseKey
ADVAPI32.dll462RegCreateKeyW
ADVAPI32.dll311IsTextUnicode
ADVAPI32.dll491RegQueryValueExA
ADVAPI32.dll481RegOpenKeyExA
ADVAPI32.dll505RegSetValueExW
KERNEL32.dll489GlobalUnlock
KERNEL32.dll332GetFileInformationByHandle
KERNEL32.dll76CreateFileMappingW
KERNEL32.dll580MapViewOfFile
KERNEL32.dll593MultiByteToWideChar
KERNEL32.dll837UnmapViewOfFile
KERNEL32.dll235GetACP
KERNEL32.dll121DeleteFileW
KERNEL32.dll744SetEndOfFile
KERNEL32.dll451GetUserDefaultLangID
KERNEL32.dll225FormatMessageW
KERNEL32.dll482GlobalLock
KERNEL32.dll448GetTimeFormatW
KERNEL32.dll308GetDateFormatW
KERNEL32.dll450GetUserDefaultLCID
KERNEL32.dll348GetLocalTime
KERNEL32.dll558LoadLibraryA
KERNEL32.dll412GetStartupInfoA
KERNEL32.dll478GlobalFree
KERNEL32.dll350GetLocaleInfoW
KERNEL32.dll912lstrcatW
KERNEL32.dll193FindClose
KERNEL32.dll200FindFirstFileW
KERNEL32.dll331GetFileAttributesW
KERNEL32.dll921lstrcpyW
KERNEL32.dll915lstrcmpW
KERNEL32.dll568LocalFree
KERNEL32.dll564LocalAlloc
KERNEL32.dll927lstrlenW
KERNEL32.dll574LocalUnlock
KERNEL32.dll51CompareStringW
KERNEL32.dll570LocalLock
KERNEL32.dll223FoldStringW
KERNEL32.dll44CloseHandle
KERNEL32.dll656ReadFile
KERNEL32.dll77CreateFileW
KERNEL32.dll918lstrcmpiW
KERNEL32.dll304GetCurrentProcessId
KERNEL32.dll393GetProcAddress
KERNEL32.dll254GetCommandLineW
KERNEL32.dll592MulDiv
KERNEL32.dll924lstrcpynW
KERNEL32.dll573LocalSize
KERNEL32.dll346GetLastError
KERNEL32.dll886WriteFile
KERNEL32.dll766SetLastError
KERNEL32.dll873WideCharToMultiByte
KERNEL32.dll571LocalReAlloc
KERNEL32.dll359GetModuleHandleA
GDI32.dll152EndPage
GDI32.dllAbortDoc
GDI32.dll150EndDoc
GDI32.dll140DeleteDC
GDI32.dll582StartPage
GDI32.dll437GetTextExtentPoint32W
GDI32.dll47CreateDCW
GDI32.dll526SetAbortProc
GDI32.dll443GetTextFaceW
GDI32.dll589TextOutW
GDI32.dll580StartDocW
GDI32.dll206EnumFontsW
GDI32.dll421GetStockObject
GDI32.dll407GetObjectW
GDI32.dll363GetDeviceCaps
GDI32.dll61CreateFontIndirectW
GDI32.dll143DeleteObject
GDI32.dll445GetTextMetricsW
GDI32.dll532SetBkMode
GDI32.dll457LPtoDP
GDI32.dll576SetWindowExtEx
GDI32.dll572SetViewportExtEx
GDI32.dll553SetMapMode
GDI32.dll524SelectObject
USER32.dll554ReleaseDC
USER32.dll268GetDC
USER32.dll159DialogBoxParamW
USER32.dll579SetActiveWindow
USER32.dll290GetKeyboardLayout
USER32.dll143DefWindowProcW
USER32.dll153DestroyWindow
USER32.dll475MessageBeep
USER32.dll513PostQuitMessage
USER32.dll279GetForegroundWindow
USER32.dll422IsIconic
USER32.dll589SetCursor
USER32.dll371GetWindowPlacement
USER32.dll55CharUpperW
USER32.dll457LoadStringW
USER32.dll641SetWindowLongW
USER32.dll436LoadAcceleratorsW
USER32.dll348GetSystemMenu
USER32.dll536RegisterClassExW
USER32.dll446LoadImageW
USER32.dll442LoadCursorW
USER32.dll642SetWindowPlacement
USER32.dll97CreateWindowExW
USER32.dll552RegisterWindowMessageW
USER32.dll255GetClientRect
USER32.dll658ShowWindow
USER32.dll270GetDesktopWindow
USER32.dll278GetFocus
USER32.dll699UpdateWindow
USER32.dll623SetScrollPos
USER32.dll41CharLowerW
USER32.dll367GetWindowLongW
USER32.dll510PeekMessageW
USER32.dll196EnableWindow
USER32.dll190DrawTextExW
USER32.dll86CreateDialogParamW
USER32.dll378GetWindowTextW
USER32.dll444LoadIconW
USER32.dll489MoveWindow
USER32.dll403InvalidateRect
USER32.dll723WinHelpW
USER32.dll272GetDlgCtrlID
USER32.dll60ChildWindowFromPoint
USER32.dll561ScreenToClient
USER32.dll267GetCursorPos
USER32.dll567SendDlgItemMessageW
USER32.dll576SendMessageW
USER32.dll44CharNextW
USER32.dll647SetWindowTextW
USER32.dll57CheckMenuItem
USER32.dll66CloseClipboard
USER32.dll415IsClipboardFormatAvailable
USER32.dll499OpenClipboard
USER32.dll311GetMenuState
USER32.dll194EnableMenuItem
USER32.dll345GetSubMenu
USER32.dll300GetMenu
USER32.dll483MessageBoxW
USER32.dll598SetFocus
USER32.dll596SetDlgItemTextW
USER32.dll729wsprintfW
USER32.dll276GetDlgItemTextW
USER32.dll198EndDialog
USER32.dll325GetParent
USER32.dll684UnhookWinEvent
USER32.dll162DispatchMessageW
USER32.dll682TranslateMessage
USER32.dll680TranslateAcceleratorW
USER32.dll418IsDialogMessageW
USER32.dll512PostMessageW
USER32.dll318GetMessageW
USER32.dll638SetWinEventHook
USER32.dll349GetSystemMetrics

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNotepad
FileVersion5.1.2600.0 (xpclient.010817-1148)
InternalNameNotepad
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameNOTEPAD.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.0

VS_FIXEDFILEINFO

FileVersion5.1.2600.0
ProductVersion5.1.2600.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
066560EXE08/17/2001 20:52:29#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x258