Downloader_VS.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	Downloader_VS.exe
size	52736 (0xce00)
md5	b47ac855db1a7c633368d1f499f90849

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x130

Rich Header

lib id	version	times used
257	24225	2
199	41118	18
261	28619	1
260	28619	2
259	28619	10
261	27412	7
260	27412	6
257	27032	2
149	30729	2
260	28806	10
261	28806	90
257	27412	5
1	0	235
261	28316	2
265	29111	3
255	29111	1
258	29111	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5f5c31d0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.27
SizeOfCode	0x8600
SizeOfInitializedData	0x44c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4860
BaseOfCode	0x1000
BaseOfData	0xa000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x51000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x843a	0x8600	R-X CODE
.rdata	0xa000	0x31ae	0x3200	R-- IDATA
.data	0xe000	0x40ae4	0x400	RW- IDATA
.rsrc	0x4f000	0x1e0	0x200	R-- IDATA
.reloc	0x50000	0xa10	0xc00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xcaa0	0x3c
RESOURCE	0x4f000	0x1e0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x50000	0xa10
DEBUG	0xb9a8	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xbad0	0x18
LOAD_CONFIG	0xba18	0x40
Bound_IAT	0	0
IAT	0xa000	0x160
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x40c36c	0x40c374	0x44e780	0x40a1a8	0	0x300000

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	function_name
KERNEL32.dll	966	LoadLibraryExW
KERNEL32.dll	688	GetProcAddress
KERNEL32.dll	429	FreeLibrary
KERNEL32.dll	738	GetSystemDirectoryW
KERNEL32.dll	1407	Sleep
KERNEL32.dll	1331	SetLastError
KERNEL32.dll	1422	TerminateProcess
KERNEL32.dll	537	GetCurrentProcess
KERNEL32.dll	1236	RtlUnwind
KERNEL32.dll	274	DeleteCriticalSection
KERNEL32.dll	960	LeaveCriticalSection
KERNEL32.dll	307	EnterCriticalSection
KERNEL32.dll	634	GetModuleHandleW
KERNEL32.dll	904	IsProcessorFeaturePresent
KERNEL32.dll	1391	SetUnhandledExceptionFilter
KERNEL32.dll	1455	UnhandledExceptionFilter
KERNEL32.dll	897	IsDebuggerPresent
KERNEL32.dll	869	InitializeSListHead
KERNEL32.dll	747	GetSystemTimeAsFileTime
KERNEL32.dll	542	GetCurrentThreadId
KERNEL32.dll	538	GetCurrentProcessId
KERNEL32.dll	1102	QueryPerformanceCounter
KERNEL32.dll	865	InitializeCriticalSectionAndSpinCount
msvcrt.dll	1260	memmove
msvcrt.dll	1170	fclose
msvcrt.dll	1173	fflush
msvcrt.dll	1174	fgetc
msvcrt.dll	1175	fgetpos
msvcrt.dll	1189	fread
msvcrt.dll	1197	fsetpos
msvcrt.dll	1287	setvbuf
msvcrt.dll	1341	ungetc
msvcrt.dll	1286	setlocale
msvcrt.dll	20	__uncaught_exception
msvcrt.dll	1142	abort
msvcrt.dll	113	__CxxFrameHandler
msvcrt.dll	120	__DestructExceptionObject
msvcrt.dll	294	_control87
msvcrt.dll	106	_XcptFilter
msvcrt.dll	210	__set_app_type
msvcrt.dll	378	_fmode
msvcrt.dll	578	_lock
msvcrt.dll	934	_unlock
msvcrt.dll	141	__dllonexit
msvcrt.dll	99	_CxxThrowException
msvcrt.dll	2	fwrite
msvcrt.dll		fputc
msvcrt.dll	132	__argv
msvcrt.dll	206	__pctype_func
msvcrt.dll	587	_lseeki64
msvcrt.dll	475	_iob
msvcrt.dll	478	_isatty
msvcrt.dll	367	_fileno
msvcrt.dll	20	void __cdecl operator delete(void *) ??3@YAXPAX@Z
msvcrt.dll	55	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	131	__argc
msvcrt.dll	185	__p__commode
msvcrt.dll	272	_c_exit
msvcrt.dll	276	_cexit
msvcrt.dll	8	__p__environ
msvcrt.dll	354	_exit
msvcrt.dll	1167	exit
msvcrt.dll	469	_initterm
msvcrt.dll	212	__setusermatherr
msvcrt.dll	1150	atexit
msvcrt.dll	145	__getmainargs
msvcrt.dll	257	_amsg_exit
msvcrt.dll	1246	malloc
msvcrt.dll	1190	free
msvcrt.dll	41	void * __cdecl operator new[](unsigned int) ??_U@YAPAXI@Z
msvcrt.dll	11	public: __thiscall exception::exception(class exception const &) ??0exception@@QAE@ABV0@@Z
msvcrt.dll	9	public: __thiscall exception::exception(char const * const &) ??0exception@@QAE@ABQBD@Z
msvcrt.dll	16	public: virtual __thiscall exception::~exception(void) ??1exception@@UAE@XZ
msvcrt.dll	57	public: virtual char const * __thiscall exception::what(void)const ?what@exception@@UBEPBDXZ
msvcrt.dll	1279	realloc
msvcrt.dll	18	void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
msvcrt.dll	43	void __cdecl operator delete[](void *) ??_V@YAXPAX@Z
msvcrt.dll	1262	memset
msvcrt.dll	1258	memcpy
msvcrt.dll	125	___lc_codepage_func
msvcrt.dll	127	___lc_handle_func
msvcrt.dll	138	__crtLCMapStringA
msvcrt.dll	1157	calloc
msvcrt.dll	342	_errno
msvcrt.dll	1219	islower
msvcrt.dll	1223	isupper

show previews

offset	size	type	comment
0	52736	EXE	09/12/2020 02:26:24	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x4e780