filenameepvp 4D1 Hack.exe
size69120 (0x10e00)
md5b4eca5d8a94a7d7552eee6cd9c2543d0
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
156303192
158303192
1703031919
156212022
123507272
147307299
10101
171303198
154303191
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x503c9c4b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0xac00
SizeOfInitializedData0x142e00
SizeOfUninitializedData0
AddressOfEntryPoint0x11299
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x161000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000xaa190xac00R-X CODE
.rdata0x1c0000x24d90x2600R-- IDATA
.data0x1f0000x13d6280x800RW- IDATA
.idata0x15d0000xf420x1000RW- IDATA
.rsrc0x15e0000x4590x600R-- IDATA
.reloc0x15f0000x19a80x1a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x15d0000xa0
RESOURCE0x15e0000x459
EXCEPTION00
SECURITY00
BASERELOC0x15f0000x9bc
DEBUG0x1c9400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x15d3b00x310
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#14060
module_namehintordfunction_name
KERNEL32.dll896OpenProcess
KERNEL32.dll514GetLastError
KERNEL32.dll158CreateMutexW
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll1357lstrlenA
KERNEL32.dll963ReadProcessMemory
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll202DecodePointer
KERNEL32.dll354FreeLibrary
KERNEL32.dll1265VirtualQuery
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll586GetProcessHeap
KERNEL32.dll715HeapAlloc
KERNEL32.dll719HeapFree
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll723HeapSetInformation
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll234EncodePointer
KERNEL32.dll831LoadLibraryW
KERNEL32.dll581GetProcAddress
KERNEL32.dll945RaiseException
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll633GetSystemTimeAsFileTime
USER32.dll110CreateWindowExW
USER32.dll156DefWindowProcW
USER32.dll636SendMessageW
USER32.dll567PostQuitMessage
USER32.dll533MessageBoxW
USER32.dll539MoveWindow
USER32.dll382GetSystemMetrics
USER32.dll317GetKeyState
USER32.dll630SendInput
USER32.dll801VkKeyScanW
USER32.dll816keybd_event
USER32.dll263GetAsyncKeyState
USER32.dll686SetRect
USER32.dll493LoadIconW
USER32.dll412GetWindowRect
USER32.dll589RegisterClassExW
USER32.dll491LoadCursorW
USER32.dll735ShowWindow
USER32.dll785UpdateWindow
USER32.dll563PeekMessageW
USER32.dll764TranslateMessage
USER32.dll175DispatchMessageW
USER32.dll250FindWindowW
USER32.dll420GetWindowThreadProcessId
USER32.dll276GetClientRect
OLEAUT32.dll4
OLEAUT32.dll6
d3d9.dll10Direct3DCreate9Ex
d3dx9_43.dll67D3DXCreateFontW
d3dx9_43.dll69D3DXCreateLine
dwmapi.dll6DwmExtendFrameIntoClientArea
dwmapi.dll15DwmIsCompositionEnabled
MSVCR100D.dll1026_onexit
MSVCR100D.dll858_lock
MSVCR100D.dll381__dllonexit
MSVCR100D.dll1224_unlock
MSVCR100D.dll751_invoke_watson
MSVCR100D.dll542_controlfp_s
MSVCR100D.dll260void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR100D.dll596_except_handler4_common
MSVCR100D.dll1457cos
MSVCR100D.dll1582sin
MSVCR100D.dll1556memset
MSVCR100D.dll1656wcslen
MSVCR100D.dll1586sqrt
MSVCR100D.dll1462fabs
MSVCR100D.dll1642vswprintf_s
MSVCR100D.dll1641vsprintf_s
MSVCR100D.dll289_CRT_RTC_INITW
MSVCR100D.dll539_configthreadlocale
MSVCR100D.dll455__setusermatherr
MSVCR100D.dll538_commode
MSVCR100D.dll633_fmode
MSVCR100D.dll452__set_app_type
MSVCR100D.dll498_amsg_exit
MSVCR100D.dll389__getmainargs
MSVCR100D.dll605_exit
MSVCR100D.dll335_XcptFilter
MSVCR100D.dll521_cexit
MSVCR100D.dll1460exit
MSVCR100D.dll777_ismbblead
MSVCR100D.dll481_acmdln
MSVCR100D.dll311_CrtSetCheckCount
MSVCR100D.dll294_CrtDbgReportW
MSVCR100D.dll745_initterm
MSVCR100D.dll746_initterm_e
MSVCR100D.dll557_crt_debugger_hook
offsetsizetypecomment
069120EXE08/28/2012 10:24:11#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK