filenameX.exe
size575488 (0x8c800)
md5ba23db0fa3b1c2608d34d1d91f26ee64
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
2232080629
2252080679
22420806214
2036550113
10175
2292100548
219210051
15101
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5418cc2f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion12.0
SizeOfCode0x5a400
SizeOfInitializedData0x34a00
SizeOfUninitializedData0
AddressOfEntryPoint0x4218f
BaseOfCode0x1000
BaseOfData0x5c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x92000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x5a2a30x5a400R-X CODE
.rdata0x5c0000x1e3b80x1e400R-- IDATA
.data0x7b0000x4d280x2400RW- IDATA
.rsrc0x800000x116600x11800R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x795780x8c
RESOURCE0x800000x11660
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x730c00x40
Bound_IAT00
IAT0x5c0000x27c
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#1676240
MENU#138540
DIALOG#12915620
DIALOG#1372360
GROUP_ICON#135200
VERSION#16160
MANIFEST#16380
module_namehintordfunction_name
KERNEL32.dll1191ResumeThread
KERNEL32.dll1391Thread32First
KERNEL32.dll1392Thread32Next
KERNEL32.dll1037Process32FirstW
KERNEL32.dll1039Process32NextW
KERNEL32.dll241CreateToolhelp32Snapshot
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1483WideCharToMultiByte
KERNEL32.dll410FormatMessageW
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll946LocalFree
KERNEL32.dll1428VerSetConditionMask
KERNEL32.dll930LeaveCriticalSection
KERNEL32.dll194CreateFileW
KERNEL32.dll1432VerifyVersionInfoW
KERNEL32.dll293EnterCriticalSection
KERNEL32.dll274DeviceIoControl
KERNEL32.dll525GetCurrentThread
KERNEL32.dll556GetExitCodeProcess
KERNEL32.dll414FreeLibrary
KERNEL32.dll936LoadLibraryW
KERNEL32.dll669GetProcAddress
KERNEL32.dll754GetTickCount
KERNEL32.dll1077QueueUserAPC
KERNEL32.dll1185ResetEvent
KERNEL32.dll737GetTempFileNameW
KERNEL32.dll960MapViewOfFile
KERNEL32.dll1411UnmapViewOfFile
KERNEL32.dll1503WriteFile
KERNEL32.dll168CreateActCtxW
KERNEL32.dll739GetTempPathW
KERNEL32.dll1161ReleaseActCtx
KERNEL32.dll191CreateFileMappingW
KERNEL32.dll266DeleteFileW
KERNEL32.dll839InitializeCriticalSection
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll211CreateNamedPipeW
KERNEL32.dll1376TerminateThread
KERNEL32.dll1103ReadFile
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll628GetNativeSystemInfo
KERNEL32.dll1006OpenProcess
KERNEL32.dll887IsWow64Process
KERNEL32.dll127CloseHandle
KERNEL32.dll1013OpenThread
KERNEL32.dll557GetExitCodeThread
KERNEL32.dll744GetThreadId
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll1368SuspendThread
KERNEL32.dll553GetEnvironmentVariableW
KERNEL32.dll2ActivateActCtx
KERNEL32.dll717GetSystemDirectoryW
KERNEL32.dll247DeactivateActCtx
KERNEL32.dll515GetCurrentDirectoryW
KERNEL32.dll965Module32FirstW
KERNEL32.dll784GetWindowsDirectoryW
KERNEL32.dll740GetThreadContext
KERNEL32.dll1322SetThreadContext
KERNEL32.dll220CreateRemoteThread
KERNEL32.dll1442VirtualQueryEx
KERNEL32.dll1437VirtualFreeEx
KERNEL32.dll1106ReadProcessMemory
KERNEL32.dll1440VirtualProtectEx
KERNEL32.dll1434VirtualAllocEx
KERNEL32.dll1512WriteProcessMemory
KERNEL32.dll255DecodeSystemPointer
KERNEL32.dll720GetSystemInfo
KERNEL32.dll1257SetEndOfFile
KERNEL32.dll1018OutputDebugStringW
KERNEL32.dll1502WriteConsoleW
KERNEL32.dll1312SetStdHandle
KERNEL32.dll1101ReadConsoleW
KERNEL32.dll413FreeEnvironmentStringsW
KERNEL32.dll551GetEnvironmentStringsW
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll646GetOEMCP
KERNEL32.dll420GetACP
KERNEL32.dll882IsValidCodePage
KERNEL32.dll824HeapSize
KERNEL32.dll1360Sleep
KERNEL32.dll1375TerminateProcess
KERNEL32.dll219CreateProcessW
KERNEL32.dll565GetFileAttributesW
KERNEL32.dll232CreateThread
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll254DecodePointer
KERNEL32.dll592GetLastError
KERNEL32.dll1087RaiseException
KERNEL32.dll841InitializeCriticalSectionEx
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll1449WaitForSingleObject
KERNEL32.dll494GetConsoleMode
KERNEL32.dll476GetConsoleCP
KERNEL32.dll402FlushFileBuffers
KERNEL32.dll1276SetFilePointerEx
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll709GetStringTypeW
KERNEL32.dll289EncodePointer
KERNEL32.dll819HeapFree
KERNEL32.dll435GetCPInfo
KERNEL32.dll457GetCommandLineW
KERNEL32.dll815HeapAlloc
KERNEL32.dll822HeapReAlloc
KERNEL32.dll1196RtlUnwind
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll1408UnhandledExceptionFilter
KERNEL32.dll1345SetUnhandledExceptionFilter
KERNEL32.dll1290SetLastError
KERNEL32.dll840InitializeCriticalSectionAndSpinCount
KERNEL32.dll1393TlsAlloc
KERNEL32.dll1395TlsGetValue
KERNEL32.dll1396TlsSetValue
KERNEL32.dll1394TlsFree
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll918LCMapStringW
KERNEL32.dll596GetLocaleInfoW
KERNEL32.dll884IsValidLocale
KERNEL32.dll764GetUserDefaultLCID
KERNEL32.dll327EnumSystemLocalesW
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll704GetStdHandle
KERNEL32.dll574GetFileType
KERNEL32.dll674GetProcessHeap
KERNEL32.dll337ExitProcess
USER32.dll700SendMessageW
USER32.dll788SetWindowTextW
USER32.dll170DestroyIcon
USER32.dll695SendMessageA
USER32.dll466GetWindowTextW
USER32.dll228EnableWindow
USER32.dll891wsprintfW
USER32.dll178DialogBoxParamW
USER32.dll547LoadIconW
USER32.dll316GetDlgItem
USER32.dll231EndDialog
USER32.dll589MessageBoxW
COMDLG32.dll12GetOpenFileNameW
ADVAPI32.dll634RegGetValueW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll429LookupPrivilegeValueW
ADVAPI32.dll535OpenThreadToken
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll674RegSetValueExW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll648RegOpenKeyW
ADVAPI32.dll608RegCreateKeyW
ADVAPI32.dll630RegEnumValueW
SHELL32.dll36DragQueryFileW
ole32.dll127CoUninitialize
ole32.dll79CoInitialize
ole32.dll26CoCreateInstance

StringTable 040004b0

FileDescriptionPE injector
FileVersion1.2.1.0
InternalNameXenos.exe
LegalCopyrightCopyright (C) 2014
OriginalFilenameXenos.exe
ProductNameXenos
ProductVersion1.2.1.0

VS_FIXEDFILEINFO

FileVersion1.2.1.0
ProductVersion1.2.1.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0575488EXE09/16/2014 23:47:59#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK