filenameftp.exe
size46080 (0xb400)
md5cd3b8a9592a12d5b67f913f0efd573c5
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1540352
10128
93403513
9440351
95403526
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x48025814
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x6200
SizeOfInitializedData0x4e00
SizeOfUninitializedData0
AddressOfEntryPoint0x62aa
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x12000
SizeOfHeaders0x400
CheckSum0x1a286
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.1 EXE / v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x61960x6200R-X CODE
.data0x80000x4db00x400RW- IDATA
.rsrc0xd0000x48280x4a00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x68c40x8c
RESOURCE0xd0000x4828
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12100x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x15c80x40
Bound_IAT0x2500x94
IAT0x10000x210
Delay_IAT00
CLR_Header00
typenamesizecp
MESSAGETABLE#1173841252
VERSION#19281252
module_namehintordfunction_name
msvcrt.dll698isdigit
msvcrt.dll761sprintf
msvcrt.dll603_write
msvcrt.dll766strchr
msvcrt.dll476_setjmp3
msvcrt.dll320_isatty
msvcrt.dll649clearerr
msvcrt.dll743putchar
msvcrt.dll794tolower
msvcrt.dll727longjmp
msvcrt.dll656exit
msvcrt.dll701islower
msvcrt.dll795toupper
msvcrt.dll204_chdrive
msvcrt.dll671fprintf
msvcrt.dll235_errno
msvcrt.dll290_getcwd
msvcrt.dll662fflush
msvcrt.dll399_mbslen
msvcrt.dll403_mbsnbcnt
msvcrt.dll401_mbsnbcat
msvcrt.dll741printf
msvcrt.dll689getenv
msvcrt.dll522_tempnam
msvcrt.dll793tmpnam
msvcrt.dll405_mbsnbcpy
msvcrt.dll677free
msvcrt.dll670fopen
msvcrt.dll536_unlink
msvcrt.dll803vsprintf
msvcrt.dll800vfprintf
msvcrt.dll456_read
msvcrt.dll650clock
msvcrt.dll275_fstat
msvcrt.dll274_fsopen
msvcrt.dll197_c_exit
msvcrt.dll246_exit
msvcrt.dll78_XcptFilter
msvcrt.dll214_controlfp
msvcrt.dll237_except_handler3
msvcrt.dll152__set_app_type
msvcrt.dll133__p__fmode
msvcrt.dll128__p__commode
msvcrt.dll182_adjust_fdiv
msvcrt.dll154__setusermatherr
msvcrt.dll315_initterm
msvcrt.dll109__getmainargs
msvcrt.dll110__initenv
msvcrt.dll203_chdir
msvcrt.dll200_cexit
msvcrt.dll659fclose
msvcrt.dll390_mbscmp
msvcrt.dll392_mbscpy
msvcrt.dll388_mbscat
msvcrt.dll427_mbstrlen
msvcrt.dll319_iob
msvcrt.dll665fgets
msvcrt.dll389_mbschr
msvcrt.dll644atoi
ADVAPI32.dll291GetUserNameA
ADVAPI32.dll484RegOpenKeyExA
ADVAPI32.dll494RegQueryValueExA
ADVAPI32.dll458RegCloseKey
KERNEL32.dll678ReadFile
KERNEL32.dll300GetConsoleMode
KERNEL32.dll79CreateFileA
KERNEL32.dll834Sleep
KERNEL32.dll911WriteFile
KERNEL32.dll749SetConsoleMode
KERNEL32.dll523HeapFree
KERNEL32.dll374GetModuleHandleA
KERNEL32.dll822SetUnhandledExceptionFilter
KERNEL32.dll859UnhandledExceptionFilter
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll842TerminateProcess
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll468GetTickCount
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll539InterlockedCompareExchange
KERNEL32.dll517HeapAlloc
KERNEL32.dll208FindFirstFileA
KERNEL32.dll217FindNextFileA
KERNEL32.dll541InterlockedExchange
KERNEL32.dll556IsDBCSLeadByteEx
KERNEL32.dll336GetEnvironmentVariableA
KERNEL32.dll98CreateProcessA
KERNEL32.dll894WaitForSingleObject
KERNEL32.dll49CloseHandle
KERNEL32.dll581LoadLibraryExA
KERNEL32.dll360GetLastError
KERNEL32.dll313GetCurrentDirectoryA
KERNEL32.dll734SetConsoleCtrlHandler
KERNEL32.dll342GetFileAttributesA
KERNEL32.dll590LocalFree
KERNEL32.dll586LocalAlloc
KERNEL32.dll235FormatMessageA
KERNEL32.dll412GetProcessHeap
USER32.dll49CharToOemBuffA
USER32.dll495OemToCharBuffA
USER32.dll43CharNextExA
WS2_32.dll93getnameinfo
WS2_32.dll15
WS2_32.dll21
WS2_32.dll19
WS2_32.dll1
WS2_32.dll18
WS2_32.dll151
WS2_32.dll16
WS2_32.dll115
WS2_32.dll55
WS2_32.dll23
WS2_32.dll111
WS2_32.dll8
WS2_32.dll2
WS2_32.dll6
WS2_32.dll4
WS2_32.dll22
WS2_32.dll3
WS2_32.dll9
WS2_32.dll57
WS2_32.dll89getaddrinfo
WS2_32.dll88freeaddrinfo
WS2_32.dll13
MSWSOCK.dll30s_perror

StringTable 040C04B0

CompanyNameMicrosoft Corporation
FileDescriptionLogiciel de transfert de fichiers
FileVersion5.1.2600.5512 (xpsp.080413-0852)
InternalNameftp.exe
LegalCopyright© Microsoft Corporation. Tous droits réservés.
OriginalFilenameftp.exe
ProductNameSystème d'exploitation Microsoft® Windows®
ProductVersion5.1.2600.5512

VS_FIXEDFILEINFO

FileVersion5.1.2600.5512
ProductVersion5.1.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
046080EXE04/13/2008 18:59:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x250