checksum-test.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	checksum-test.exe
size	373248 (0x5b200)
md5	cddb82962e71c36580d619b8d44a96f4

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
158	40219	16
170	40219	117
147	30729	3
1	0	87
171	40219	54
157	40219	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x500a440a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x47200
SizeOfInitializedData	0x13c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0xb220
BaseOfCode	0x1000
BaseOfData	0x49000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x61000
SizeOfHeaders	0x400
CheckSum	0x66813
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig2(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x471d1	0x47200	R-X CODE
.rdata	0x49000	0xef5a	0xf000	R-- IDATA
.data	0x58000	0x30b0	0x1200	RW- IDATA
.rsrc	0x5c000	0x1b4	0x200	R-- IDATA
.reloc	0x5d000	0x3786	0x3800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x57784	0x28
RESOURCE	0x5c000	0x1b4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x5d000	0x36ec
DEBUG	0x491b0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x56218	0x40
Bound_IAT	0	0
IAT	0x49000	0x160
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	346	1252

module_name	hint	function_name
KERNEL32.dll	536	GetModuleHandleW
KERNEL32.dll	751	InterlockedIncrement
KERNEL32.dll	747	InterlockedDecrement
KERNEL32.dll	1202	Sleep
KERNEL32.dll	748	InterlockedExchange
KERNEL32.dll	738	InitializeCriticalSection
KERNEL32.dll	209	DeleteCriticalSection
KERNEL32.dll	238	EnterCriticalSection
KERNEL32.dll	825	LeaveCriticalSection
KERNEL32.dll	532	GetModuleFileNameW
KERNEL32.dll	1316	WriteConsoleW
KERNEL32.dll	499	GetFileType
KERNEL32.dll	612	GetStdHandle
KERNEL32.dll	1048	RtlUnwind
KERNEL32.dll	945	RaiseException
KERNEL32.dll	202	DecodePointer
KERNEL32.dll	1216	TerminateProcess
KERNEL32.dll	448	GetCurrentProcess
KERNEL32.dll	1235	UnhandledExceptionFilter
KERNEL32.dll	1189	SetUnhandledExceptionFilter
KERNEL32.dll	768	IsDebuggerPresent
KERNEL32.dll	234	EncodePointer
KERNEL32.dll	390	GetCommandLineA
KERNEL32.dll	723	HeapSetInformation
KERNEL32.dll	772	IsProcessorFeaturePresent
KERNEL32.dll	1297	WideCharToMultiByte
KERNEL32.dll	871	MultiByteToWideChar
KERNEL32.dll	1357	lstrlenA
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	831	LoadLibraryW
KERNEL32.dll	727	HeapValidate
KERNEL32.dll	759	IsBadReadPtr
KERNEL32.dll	514	GetLastError
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	410	GetConsoleCP
KERNEL32.dll	428	GetConsoleMode
KERNEL32.dll	739	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	281	ExitProcess
KERNEL32.dll	1069	SetConsoleCtrlHandler
KERNEL32.dll	1221	TlsAlloc
KERNEL32.dll	1223	TlsGetValue
KERNEL32.dll	1224	TlsSetValue
KERNEL32.dll	453	GetCurrentThreadId
KERNEL32.dll	1222	TlsFree
KERNEL32.dll	1139	SetLastError
KERNEL32.dll	452	GetCurrentThread
KERNEL32.dll	288	FatalAppExitA
KERNEL32.dll	905	OutputDebugStringA
KERNEL32.dll	906	OutputDebugStringW
KERNEL32.dll	935	QueryPerformanceCounter
KERNEL32.dll	659	GetTickCount
KERNEL32.dll	449	GetCurrentProcessId
KERNEL32.dll	633	GetSystemTimeAsFileTime
KERNEL32.dll	531	GetModuleFileNameA
KERNEL32.dll	353	FreeEnvironmentStringsW
KERNEL32.dll	474	GetEnvironmentStringsW
KERNEL32.dll	1135	SetHandleCount
KERNEL32.dll	611	GetStartupInfoW
KERNEL32.dll	717	HeapCreate
KERNEL32.dll	718	HeapDestroy
KERNEL32.dll	719	HeapFree
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	586	GetProcessHeap
KERNEL32.dll	1265	VirtualQuery
KERNEL32.dll	354	FreeLibrary
KERNEL32.dll	722	HeapReAlloc
KERNEL32.dll	724	HeapSize
KERNEL32.dll	721	HeapQueryInformation
KERNEL32.dll	360	GetACP
KERNEL32.dll	567	GetOEMCP
KERNEL32.dll	370	GetCPInfo
KERNEL32.dll	778	IsValidCodePage
KERNEL32.dll	1159	SetStdHandle
KERNEL32.dll	343	FlushFileBuffers
KERNEL32.dll	1126	SetFilePointer
KERNEL32.dll	136	CreateFileA
KERNEL32.dll	518	GetLocaleInfoW
KERNEL32.dll	813	LCMapStringW
KERNEL32.dll	617	GetStringTypeW
KERNEL32.dll	143	CreateFileW
KERNEL32.dll	1107	SetEndOfFile
KERNEL32.dll	960	ReadFile
KERNEL32.dll	516	GetLocaleInfoA
KERNEL32.dll	780	IsValidLocale
KERNEL32.dll	269	EnumSystemLocalesA
KERNEL32.dll	667	GetUserDefaultLCID

show previews

offset	size	type	comment
0	373248	EXE	07/21/2012 05:54:18	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK