filenamebot.exe
size338367 (0x529bf)
md5bc41e18c937b0e52e040e133a138d1e9
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xa
TimeDateStamp0x2e98788
PointerToSymbolTable0x40000
NumberOfSymbols0xcbc
SizeOfOptionalHeader0xe0
Characteristics0x306
Magic0x10b
LinkerVersion2.24
SizeOfCode0x2e000
SizeOfInitializedData0x3fc00
SizeOfUninitializedData0xc00
AddressOfEntryPoint0x12a0
BaseOfCode0x1000
BaseOfData0x2f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x46000
SizeOfHeaders0x400
CheckSum0x628ee
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2de140x2e000R-X CODE IDATA
.data0x2f0000x3c0x200RW- IDATA
.rdata0x300000x68200x6a00R-- IDATA
.eh_fram0x370000x7a5c0x7c00R-- IDATA
.bss0x3f0000xa700RW- UDATA
.edata0x400000x62c0x800R-- IDATA
.idata0x410000xe180x1000RW- IDATA
.CRT0x420000x180x200RW- IDATA
.tls0x430000x200x200RW- IDATA
.reloc0x440000x17440x1800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x400000x62c
IMPORT0x410000xe18
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x440000x1744
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x430040x18
LOAD_CONFIG00
Bound_IAT00
IAT0x412b40x228
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4430010x44301c0x43f0600x44200400
module_namehintordfunction_name
ADVAPI32.DLL93CryptAcquireContextA
ADVAPI32.DLL96CryptCreateHash
ADVAPI32.DLL99CryptDestroyHash
ADVAPI32.DLL100CryptDestroyKey
ADVAPI32.DLL103CryptEncrypt
ADVAPI32.DLL113CryptGetHashParam
ADVAPI32.DLL117CryptHashData
ADVAPI32.DLL119CryptImportKey
ADVAPI32.DLL120CryptReleaseContext
KERNEL32.dll82CloseHandle
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll282ExpandEnvironmentStringsA
KERNEL32.dll300FindClose
KERNEL32.dll304FindFirstFileA
KERNEL32.dll321FindNextFileA
KERNEL32.dll347FormatMessageA
KERNEL32.dll388GetCommandLineA
KERNEL32.dll510GetLastError
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll656GetTickCount
KERNEL32.dll671GetVersionExA
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll744InterlockedExchange
KERNEL32.dll763IsDBCSLeadByteEx
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll860MultiByteToWideChar
KERNEL32.dll1091SetLastError
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1155SleepEx
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1247WideCharToMultiByte
msvcrt.dll64_read
msvcrt.dll80_strdup
msvcrt.dll81_stricmp
msvcrt.dll82_stricoll
msvcrt.dll84_strnicmp
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll65__mb_cur_max
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll143_beginthreadex
msvcrt.dll147_cexit
msvcrt.dll182_errno
msvcrt.dll228_fullpath
msvcrt.dll266_iob
msvcrt.dll268_isctype
msvcrt.dll383_onexit
msvcrt.dll392_pctype
msvcrt.dll426_setmode
msvcrt.dll445_stati64
msvcrt.dll466_sys_nerr
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll592atoi
msvcrt.dll595calloc
msvcrt.dll604exit
msvcrt.dll607fclose
msvcrt.dll610fflush
msvcrt.dll613fgets
msvcrt.dll618fopen
msvcrt.dll620fputc
msvcrt.dll624fread
msvcrt.dll625free
msvcrt.dll629fseek
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll641gmtime
msvcrt.dll652isspace
msvcrt.dll671localeconv
msvcrt.dll676malloc
msvcrt.dll678mbstowcs
msvcrt.dll680memchr
msvcrt.dll681memcmp
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll695qsort
msvcrt.dll698realloc
msvcrt.dll704setlocale
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll712sscanf
msvcrt.dll714strchr
msvcrt.dll715strcmp
msvcrt.dll716strcoll
msvcrt.dll719strerror
msvcrt.dll721strlen
msvcrt.dll723strncmp
msvcrt.dll724strncpy
msvcrt.dll725strpbrk
msvcrt.dll726strrchr
msvcrt.dll728strstr
msvcrt.dll731strtol
msvcrt.dll732strtoul
msvcrt.dll736system
msvcrt.dll739time
msvcrt.dll742tolower
msvcrt.dll743toupper
msvcrt.dll748vfprintf
msvcrt.dll761wcslen
msvcrt.dll772wcstombs
WS2_32.dll54WSAIoctl
WSOCK32.DLL25WSACleanup
WSOCK32.DLL26WSAGetLastError
WSOCK32.DLL30WSASetLastError
WSOCK32.DLL31WSAStartup
WSOCK32.DLL34__WSAFDIsSet
WSOCK32.DLL36bind
WSOCK32.DLL37closesocket
WSOCK32.DLL38connect
WSOCK32.DLL41gethostbyname
WSOCK32.DLL42gethostname
WSOCK32.DLL44getpeername
WSOCK32.DLL49getsockname
WSOCK32.DLL50getsockopt
WSOCK32.DLL52htons
WSOCK32.DLL56ioctlsocket
WSOCK32.DLL59ntohs
WSOCK32.DLL61recv
WSOCK32.DLL66select
WSOCK32.DLL67send
WSOCK32.DLL70setsockopt
WSOCK32.DLL72socket
ordentry_vafunction_name
10x1c70curl_easy_cleanup
20x1cc0curl_easy_duphandle
30x1b2a0curl_easy_escape
40x1c90curl_easy_getinfo
50x1a00curl_easy_init
60x2000curl_easy_pause
70x1a70curl_easy_perform
80x20b0curl_easy_recv
90x1ea0curl_easy_reset
100x2120curl_easy_send
110x1a40curl_easy_setopt
120x119e0curl_easy_strerror
130x1b5b0curl_easy_unescape
140x1b3c0curl_escape
150x21c30curl_formadd
160x22640curl_formfree
170x22c60curl_formget
180x1b650curl_free
190x20e70curl_getdate
200x1e720curl_getenv
210x19b0curl_global_cleanup
220x1880curl_global_init
230x1920curl_global_init_mem
240x14e90curl_maprintf
250x15030curl_mfprintf
260x15000curl_mprintf
270x13aa0curl_msnprintf
280x14fd0curl_msprintf
290xd9f0curl_multi_add_handle
300xdc00curl_multi_assign
310xd3c0curl_multi_cleanup
320xcfd0curl_multi_fdset
330xd510curl_multi_info_read
340xcf80curl_multi_init
350xf1f0curl_multi_perform
360xdd70curl_multi_remove_handle
370xd600curl_multi_setopt
380xf550curl_multi_socket
390xf590curl_multi_socket_action
400xf5d0curl_multi_socket_all
410x11a00curl_multi_strerror
420xd7b0curl_multi_timeout
430xd110curl_multi_wait
440x14f30curl_mvaprintf
450x150a0curl_mvfprintf
460x15080curl_mvprintf
470x14e30curl_mvsnprintf
480x15050curl_mvsprintf
490x15e10curl_share_cleanup
500x15c70curl_share_init
510x15ca0curl_share_setopt
520x11a20curl_share_strerror
530x11830curl_slist_append
540x11880curl_slist_free_all
550x1e310curl_strequal
560x1e340curl_strnequal
570x1b620curl_unescape
module_namebot.exe
flags0
timestamp0
version0.0
ordinal_base1
nFunctions57
nNames57
Names(57)0x4010c
Functions(57)0x40028
NameOrdinals(57)0x401f0
offsetsizetypecomment
0262144EXE07/20/1971 11:56:56#
15c115HTM#
4000076223BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x3f060