filenamesr.dll
size107520 (0x1a400)
md5cb2b15f4e7773c91daf1ef603bafdd3c
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4e1c87d8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x32f
Magic0x10b
LinkerVersion2.56
SizeOfCode0x17600
SizeOfInitializedData0x1a000
SizeOfUninitializedData0x24400
AddressOfEntryPoint0x1280
BaseOfCode0x1000
BaseOfData0x19000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x42000
SizeOfHeaders0x400
CheckSum0x1b47a
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MingWin32 - Dev C++ v4.x

Sections

namevavsizeraw sizeflags
.text0x10000x174900x17600R-X CODE IDATA
.data0x190000x800x200RW- IDATA
.rdata0x1a0000x188c0x1a00R-- IDATA
.bss0x1c0000x243800RW- UDATA
.idata0x410000xcbc0xe00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x410000xcbc
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll1AddAtomA
KERNEL32.dll38CloseHandle
KERNEL32.dll65CreateEventW
KERNEL32.dll70CreateFileMappingW
KERNEL32.dll71CreateFileW
KERNEL32.dll86CreateProcessW
KERNEL32.dll88CreateSemaphoreA
KERNEL32.dll89CreateSemaphoreW
KERNEL32.dll156ExitProcess
KERNEL32.dll176FindAtomA
KERNEL32.dll221GetAtomNameA
KERNEL32.dll275GetConsoleTitleW
KERNEL32.dll285GetCurrentThread
KERNEL32.dll306GetExitCodeProcess
KERNEL32.dll325GetLastError
KERNEL32.dll340GetModuleHandleW
KERNEL32.dll364GetProcAddress
KERNEL32.dll415GetTempPathW
KERNEL32.dll419GetThreadPriority
KERNEL32.dll422GetThreadTimes
KERNEL32.dll423GetTickCount
KERNEL32.dll434GetVersionExW
KERNEL32.dll460GlobalMemoryStatus
KERNEL32.dll492InitializeCriticalSection
KERNEL32.dll496InterlockedDecrement
KERNEL32.dll500InterlockedIncrement
KERNEL32.dll546MapViewOfFile
KERNEL32.dll597QueryPerformanceCounter
KERNEL32.dll598QueryPerformanceFrequency
KERNEL32.dll630ReleaseSemaphore
KERNEL32.dll638ResetEvent
KERNEL32.dll685SetConsoleTitleW
KERNEL32.dll698SetEvent
KERNEL32.dll707SetFileTime
KERNEL32.dll713SetLastError
KERNEL32.dll735SetThreadPriority
KERNEL32.dll739SetUnhandledExceptionFilter
KERNEL32.dll751Sleep
KERNEL32.dll756SystemTimeToFileTime
KERNEL32.dll763TlsAlloc
KERNEL32.dll764TlsFree
KERNEL32.dll765TlsGetValue
KERNEL32.dll766TlsSetValue
KERNEL32.dll776UnmapViewOfFile
KERNEL32.dll790VirtualAlloc
KERNEL32.dll794VirtualFree
KERNEL32.dll810WaitForSingleObject
msvcrt.dll6_close
msvcrt.dll42_isatty
msvcrt.dll69_setmode
msvcrt.dll82_stricmp
msvcrt.dll110_write
msvcrt.dll39__getmainargs
msvcrt.dll48__mb_cur_max
msvcrt.dll60__p__environ
msvcrt.dll62__p__fmode
msvcrt.dll80__set_app_type
msvcrt.dll111_assert
msvcrt.dll117_beginthreadex
msvcrt.dll121_cexit
msvcrt.dll152_errno
msvcrt.dll173_filelengthi64
msvcrt.dll202_get_osfhandle
msvcrt.dll233_iob
msvcrt.dll235_isctype
msvcrt.dll350_onexit
msvcrt.dll359_pctype
msvcrt.dll388_setmode
msvcrt.dll447_waccess
msvcrt.dll493_wmkdir
msvcrt.dll533abort
msvcrt.dll540atexit
msvcrt.dll554exit
msvcrt.dll557fclose
msvcrt.dll560fflush
msvcrt.dll562fgetpos
msvcrt.dll568fopen
msvcrt.dll569fprintf
msvcrt.dll574fread
msvcrt.dll575free
msvcrt.dll580fsetpos
msvcrt.dll583fwrite
msvcrt.dll591gmtime
msvcrt.dll625longjmp
msvcrt.dll626malloc
msvcrt.dll632memcpy
msvcrt.dll633memmove
msvcrt.dll634memset
msvcrt.dll639printf
msvcrt.dll646raise
msvcrt.dll648realloc
msvcrt.dll649remove
msvcrt.dll653setbuf
msvcrt.dll656signal
msvcrt.dll659sprintf
msvcrt.dll663strcat
msvcrt.dll664strchr
msvcrt.dll665strcmp
msvcrt.dll667strcpy
msvcrt.dll671strlen
msvcrt.dll673strncmp
msvcrt.dll678strstr
msvcrt.dll692tolower
msvcrt.dll698vfprintf
msvcrt.dll705wcschr
msvcrt.dll706wcscmp
msvcrt.dll708wcscpy
msvcrt.dll711wcslen
OLE32.dll38CoInitializeEx
SHELL32.DLL146ShellExecuteExW
USER32.dll48CharToOemW
USER32.dll217GetActiveWindow
USER32.dll450OemToCharW
offsetsizetypecomment
0107520EXE07/12/2011 17:43:52#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK