filenamefls.exe
size450560 (0x6e000)
md5cdc565b4c0dc44281e61f9541884cb4e
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
150204132
149307299
1313072921
132307292
147307299
10105
1383072952
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4e8f51b2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x5d000
SizeOfInitializedData0x10c00
SizeOfUninitializedData0
AddressOfEntryPoint0x12b1
BaseOfCode0x1000
BaseOfData0x5e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x72000
SizeOfHeaders0x400
CheckSum0x71317
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x5cecf0x5d000R-X CODE
.rdata0x5e0000x13a00x1400R-- IDATA
.data0x600000x103e40xf400RW- IDATA
.rsrc0x710000x2b00x400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x5eb740x64
RESOURCE0x710000x2b0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x5e1d00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x5ea480x40
Bound_IAT00
IAT0x5e0000x1b0
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#15981252
module_namehintordfunction_name
KERNEL32.dll391GetCommandLineW
KERNEL32.dll496GetFileSize
KERNEL32.dll1126SetFilePointer
KERNEL32.dll960ReadFile
KERNEL32.dll143CreateFileW
KERNEL32.dll514GetLastError
KERNEL32.dll221DeviceIoControl
KERNEL32.dll82CloseHandle
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll659GetTickCount
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1216TerminateProcess
SHELL32.dll6CommandLineToArgvW
MSVCR90.dll979_tzset
MSVCR90.dll1416wcscmp
MSVCR90.dll1345setlocale
MSVCR90.dll1228exit
MSVCR90.dll1415wcschr
MSVCR90.dll1252free
MSVCR90.dll1367strlen
MSVCR90.dll1446wprintf
MSVCR90.dll1322memset
MSVCR90.dll873_snprintf
MSVCR90.dll1098_wcstoui64
MSVCR90.dll1364strerror
MSVCR90.dll368_errno
MSVCR90.dll1338realloc
MSVCR90.dll1359strcmp
MSVCR90.dll1182_wstat64i32
MSVCR90.dll1425wcsncmp
MSVCR90.dll1073_wcsicmp
MSVCR90.dll1368strncat
MSVCR90.dll1371strncpy
MSVCR90.dll1361strcpy
MSVCR90.dll628_localtime64
MSVCR90.dll1318memcpy
MSVCR90.dll793_mktime64
MSVCR90.dll338_ctime64
MSVCR90.dll1370strncmp
MSVCR90.dll1284isspace
MSVCR90.dll1244fprintf
MSVCR90.dll1215atoi
MSVCR90.dll1282isprint
MSVCR90.dll1329putchar
MSVCR90.dll1328putc
MSVCR90.dll1208asctime
MSVCR90.dll501_gmtime64
MSVCR90.dll1350sprintf
MSVCR90.dll1317memcmp
MSVCR90.dll922_stricmp
MSVCR90.dll1263fwrite
MSVCR90.dll277_amsg_exit
MSVCR90.dll159__getmainargs
MSVCR90.dll300_cexit
MSVCR90.dll380_exit
MSVCR90.dll102_XcptFilter
MSVCR90.dll160__initenv
MSVCR90.dll516_initterm
MSVCR90.dll517_initterm_e
MSVCR90.dll316_configthreadlocale
MSVCR90.dll227__setusermatherr
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll203__p__commode
MSVCR90.dll207__p__fmode
MSVCR90.dll362_encode_pointer
MSVCR90.dll224__set_app_type
MSVCR90.dll1038_vsnprintf_s
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll998_unlock
MSVCR90.dll150__dllonexit
MSVCR90.dll630_lock
MSVCR90.dll796_onexit
MSVCR90.dll352_decode_pointer
MSVCR90.dll371_except_handler4_common
MSVCR90.dll523_invoke_watson
MSVCR90.dll319_controlfp_s
MSVCR90.dll1156_wputenv
MSVCR90.dll1422wcslen
MSVCR90.dll1423wcsncat
MSVCR90.dll1426wcsncpy
MSVCR90.dll161__iob_func
MSVCR90.dll1307malloc
MSVCR90.dll883_snwprintf
MSVCR90.dll1193_wtoi
MSVCR90.dll1261fwprintf
MSVCR90.dll1441wcstoul
MSVCR90.dll1358strchr
MSVCR90.dll978_tzname
libewf.dll6libewf_close
libewf.dll157libewf_open_wide
libewf.dll46libewf_get_media_size
libewf.dll5libewf_check_file_signature_wide
libewf.dll44libewf_get_md5_hash
libewf.dll165libewf_read_random
offsetsizetypecomment
0450560EXE10/07/2011 19:23:30#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK