filenameresource.dat_189952_207360.exe
size207360 (0x32a00)
md5b841d22ffd748c54b07eda3f26449f7c
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x42baad7c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion2.55
SizeOfCode0x29e00
SizeOfInitializedData0x8800
SizeOfUninitializedData0x2400
AddressOfEntryPoint0x2aad5
BaseOfCode0x1000
BaseOfData0x2b000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion1.0
ImageVersion0.0
SubsystemVersion3.10
Reserved10
SizeOfImage0x38000
SizeOfHeaders0x400
CheckSum0x3541b
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x12000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v4.2

Sections

namevavsizeraw sizeflags
.text0x10000x29c280x29e00R-X CODE
.bss0x2b0000x225c0RW- UDATA
.rdata0x2e0000x240x200R-- IDATA
.data0x2f0000x38440x3a00RW- IDATA
.idata0x330000xbb60xc00RW- IDATA
.reloc0x340000x3f820x4000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x330000xbb6
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x340000x3e24
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
MSVCRT20.dll1049rewind
MSVCRT20.dll967fprintf
MSVCRT20.dll968fputc
MSVCRT20.dll1071strncmp
MSVCRT20.dll958fflush
MSVCRT20.dll972fread
MSVCRT20.dll1029memcmp
MSVCRT20.dll1087time
MSVCRT20.dll1090tolower
MSVCRT20.dll1072strncpy
MSVCRT20.dll940atoi
MSVCRT20.dll618_heapchk
MSVCRT20.dll1032memset
MSVCRT20.dll1030memcpy
MSVCRT20.dll979ftell
MSVCRT20.dll989gmtime
MSVCRT20.dll462__dllonexit
MSVCRT20.dll740_onexit
MSVCRT20.dll572_exit
MSVCRT20.dll456_XcptFilter
MSVCRT20.dll474__p___initenv
MSVCRT20.dll624_initterm
MSVCRT20.dll465__getmainargs
MSVCRT20.dll973free
MSVCRT20.dll480__p__commode
MSVCRT20.dll483__p__fmode
MSVCRT20.dll563_except_handler3
MSVCRT20.dll545_controlfp
MSVCRT20.dll1053setvbuf
MSVCRT20.dll1057sprintf
MSVCRT20.dll1074strrchr
MSVCRT20.dll1076strstr
MSVCRT20.dll1046realloc
MSVCRT20.dll627_isctype
MSVCRT20.dll1037printf
MSVCRT20.dll475__p___mb_cur_max
MSVCRT20.dll1096vfprintf
MSVCRT20.dll487__p__pctype
MSVCRT20.dll1099vsprintf
MSVCRT20.dll1031memmove
MSVCRT20.dll1067strerror
MSVCRT20.dll1024malloc
MSVCRT20.dll1023longjmp
MSVCRT20.dll768_setjmp3
MSVCRT20.dll943calloc
MSVCRT20.dll966fopen
MSVCRT20.dll959fgetc
MSVCRT20.dll1080strtoul
MSVCRT20.dll1079strtol
MSVCRT20.dll985getenv
MSVCRT20.dll1063strcmp
MSVCRT20.dll561_errno
MSVCRT20.dll1061strcat
MSVCRT20.dll969fputs
MSVCRT20.dll974freopen
MSVCRT20.dll977fseek
MSVCRT20.dll981fwrite
MSVCRT20.dll1044raise
MSVCRT20.dll484__p__iob
MSVCRT20.dll1084system
MSVCRT20.dll961fgets
MSVCRT20.dll1054signal
MSVCRT20.dll1091toupper
MSVCRT20.dll1073strpbrk
MSVCRT20.dll955fclose
MSVCRT20.dll1069strlen
MSVCRT20.dll1062strchr
MSVCRT20.dll1065strcpy
MSVCRT20.dll952exit
MSVCRT20.dll1048rename
MSVCRT20.dll1020localtime
MSVCRT20.dll522_adjust_fdiv
MSVCRT20.dll791_stricmp
MSVCRT20.dll663_kbhit
MSVCRT20.dll574_fcloseall
MSVCRT20.dll844_tzset
MSVCRT20.dll795_strnicmp
MSVCRT20.dll507_access
MSVCRT20.dll541_close
MSVCRT20.dll775_sopen
MSVCRT20.dll576_fdopen
MSVCRT20.dll603_getch
MSVCRT20.dll582_fileno
MSVCRT20.dll626_isatty
MSVCRT20.dll734_mkdir
MSVCRT20.dll756_rmdir
MSVCRT20.dll849_unlink
MSVCRT20.dll539_chsize
MSVCRT20.dll770_setmode
MSVCRT20.dll789_strdup
KERNEL32.dll311GetVersion
KERNEL32.dll585WriteConsoleOutputA
KERNEL32.dll113FillConsoleOutputCharacterA
KERNEL32.dll112FillConsoleOutputAttribute
KERNEL32.dll457ScrollConsoleScreenBufferA
KERNEL32.dll278GetStdHandle
KERNEL32.dll188GetConsoleScreenBufferInfo
KERNEL32.dll474SetConsoleCursorPosition
KERNEL32.dll259GetProcAddress
KERNEL32.dll141FreeLibrary
KERNEL32.dll376LoadLibraryA
KERNEL32.dll8BackupWrite
KERNEL32.dll6BackupRead
KERNEL32.dll7BackupSeek
KERNEL32.dll501SetFileApisToOEM
KERNEL32.dll531SetVolumeLabelA
KERNEL32.dll500SetFileApisToANSI
KERNEL32.dll221GetFullPathNameA
KERNEL32.dll233GetModuleFileNameA
KERNEL32.dll505SetFileTime
KERNEL32.dll43CreateFileA
KERNEL32.dll219GetFileTime
KERNEL32.dll314GetVolumeInformationA
KERNEL32.dll204GetDiskFreeSpaceA
KERNEL32.dll536Sleep
KERNEL32.dll22CloseHandle
KERNEL32.dll117FindClose
KERNEL32.dll124FindNextFileA
KERNEL32.dll312GetVersionExA
KERNEL32.dll74DosDateTimeToFileTime
KERNEL32.dll384LocalFileTimeToFileTime
KERNEL32.dll121FindFirstFileA
KERNEL32.dll109FileTimeToDosDateTime
KERNEL32.dll215GetFileAttributesA
KERNEL32.dll110FileTimeToLocalFileTime
KERNEL32.dll196GetCurrentProcess
KERNEL32.dll198GetCurrentThread
KERNEL32.dll502SetFileAttributesA
KERNEL32.dll527SetThreadPriority
KERNEL32.dll226GetLocalTime
KERNEL32.dll515SetPriorityClass
KERNEL32.dll194GetCurrentDirectoryA
KERNEL32.dll332GlobalMemoryStatus
offsetsizetypecomment
0207360EXE06/23/2005 12:39:24#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK