filenameStegoSend.exe
size214016 (0x34400)
md5cc5bbd4dda6d03f92491df519f6292c8
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
147210224
150204135
149210229
1312102288
1235072711
10168
132210229
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x58dead7e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x28400
SizeOfInitializedData0xbc00
SizeOfUninitializedData0
AddressOfEntryPoint0x9ea8
BaseOfCode0x1000
BaseOfData0x2a000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x38000
SizeOfHeaders0x400
CheckSum0x385ad
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x282060x28400R-X CODE
.rdata0x2a0000x8ee80x9000R-- IDATA
.data0x330000x99c0x600RW- IDATA
.rsrc0x340000x2b00x400R-- IDATA
.reloc0x350000x20460x2200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x323e40x8c
RESOURCE0x340000x2b0
EXCEPTION00
SECURITY00
BASERELOC0x350000x1be0
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x322300x40
Bound_IAT00
IAT0x2a0000x27c
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#15981252
module_namehintordfunction_name
USER32.dll775wsprintfA
MSVCR90.dll316_configthreadlocale
MSVCR90.dll227__setusermatherr
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll203__p__commode
MSVCR90.dll207__p__fmode
MSVCR90.dll362_encode_pointer
MSVCR90.dll224__set_app_type
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll517_initterm_e
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll998_unlock
MSVCR90.dll150__dllonexit
MSVCR90.dll630_lock
MSVCR90.dll796_onexit
MSVCR90.dll352_decode_pointer
MSVCR90.dll371_except_handler4_common
MSVCR90.dll523_invoke_watson
MSVCR90.dll319_controlfp_s
MSVCR90.dll516_initterm
MSVCR90.dll160__initenv
MSVCR90.dll1228exit
MSVCR90.dll54public: void __thiscall type_info::_type_info_dtor_internal_method(void)

?_type_info_dtor_internal_method@type_info@@QAEXXZ

MSVCR90.dll380_exit
MSVCR90.dll300_cexit
MSVCR90.dll159__getmainargs
MSVCR90.dll277_amsg_exit
MSVCR90.dll1350sprintf
MSVCR90.dll1407vsprintf_s
MSVCR90.dll161__iob_func
MSVCR90.dll1244fprintf
MSVCR90.dll1341rewind
MSVCR90.dll1354sscanf
MSVCR90.dll1353srand
MSVCR90.dll1326printf
MSVCR90.dll970_time64
MSVCR90.dll1336rand
MSVCR90.dll1359strcmp
MSVCR90.dll1206abs
MSVCR90.dll1322memset
MSVCR90.dll1318memcpy
MSVCR90.dll1263fwrite
MSVCR90.dll1250fread
MSVCR90.dll1242fopen
MSVCR90.dll1258fseek
MSVCR90.dll1231fclose
MSVCR90.dll1260ftell
MSVCR90.dll1367strlen
MSVCR90.dll1252free
MSVCR90.dll1338realloc
MSVCR90.dll17void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR90.dll1307malloc
MSVCR90.dll1220calloc
MSVCR90.dll1371strncpy
MSVCR90.dll1375strrchr
MSVCR90.dll1364strerror
MSVCR90.dll231__sys_nerr
MSVCR90.dll679_mbschr
MSVCR90.dll713_mbsnbcpy
MSVCR90.dll1361strcpy
MSVCR90.dll368_errno
MSVCR90.dll1377strstr
MSVCR90.dll1317memcmp
MSVCR90.dll1370strncmp
MSVCR90.dll1394tolower
MSVCR90.dll1358strchr
MSVCR90.dll1381strtol
MSVCR90.dll1276isalpha
MSVCR90.dll1299isxdigit
MSVCR90.dll1382strtoul
MSVCR90.dll1320memmove
MSVCR90.dll1374strpbrk
MSVCR90.dll944_strtoi64
MSVCR90.dll1237fgets
MSVCR90.dll1247fputs
MSVCR90.dll1333qsort
MSVCR90.dll1278isdigit
MSVCR90.dll1246fputc
MSVCR90.dll753_mbspbrk
MSVCR90.dll292_beginthreadex
MSVCR90.dll1234fflush
MSVCR90.dll1284isspace
MSVCR90.dll1316memchr
MSVCR90.dll1268getenv
MSVCR90.dll501_gmtime64
MSVCR90.dll1275isalnum
MSVCR90.dll1285isupper
MSVCR90.dll911_stat64
MSVCR90.dll1233ferror
MSVCR90.dll1232feof
MSVCR90.dll918_strdup
MSVCR90.dll102_XcptFilter
KERNEL32.dll263ExpandEnvironmentStringsA
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll67CloseHandle
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll753LoadLibraryA
KERNEL32.dll581GetSystemDirectoryA
KERNEL32.dll1103VerSetConditionMask
KERNEL32.dll1106VerifyVersionInfoA
KERNEL32.dll1060SleepEx
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll692InitializeCriticalSection
KERNEL32.dll332FreeLibrary
KERNEL32.dll544GetProcAddress
KERNEL32.dll486GetLastError
KERNEL32.dll327FormatMessageA
KERNEL32.dll1004SetLastError
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1069TerminateProcess
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll1057Sleep
KERNEL32.dll701InterlockedExchange
KERNEL32.dll190DeleteCriticalSection
ADVAPI32.dll196CryptHashData
ADVAPI32.dll189CryptGenRandom
ADVAPI32.dll192CryptGetHashParam
ADVAPI32.dll178CryptDestroyHash
ADVAPI32.dll199CryptReleaseContext
ADVAPI32.dll175CryptCreateHash
ADVAPI32.dll172CryptAcquireContextA
WS2_32.dll18
WS2_32.dll16
WS2_32.dll19
WS2_32.dll54WSAIoctl
WS2_32.dll21
WS2_32.dll6
WS2_32.dll15
WS2_32.dll2
WS2_32.dll9
WS2_32.dll7
WS2_32.dll111
WS2_32.dll3
WS2_32.dll23
WS2_32.dll4
WS2_32.dll136freeaddrinfo
WS2_32.dll137getaddrinfo
WS2_32.dll10
WS2_32.dll112
WS2_32.dll115
WS2_32.dll116
WS2_32.dll5
WS2_32.dll151
CRYPT32.dll63CertFreeCertificateContext
offsetsizetypecomment
0214016EXE03/31/2017 19:26:54#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK