filenameTest.exe
size223232 (0x36800)
md5d44ed284ad486317a37bba16368ca2cd
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
9340356
107
147307293
1754021914
155402191
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xa
TimeDateStamp0x4dfe6df3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0xda00
SizeOfInitializedData0x28a00
SizeOfUninitializedData0
AddressOfEntryPoint0xc214
BaseOfCode0x1000
BaseOfData0xf000
ImageBase0x30670000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x52000
SizeOfHeaders0x400
CheckSum0x3f069
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xd8950xda00R-X CODE
.idata0xf0000x79e0x800R-- IDATA
.bld_10x100000x1400x200RW- IDATA
.bld_20x110000x1400x200R-- IDATA
.bld_30x120000x2b60x400R-- IDATA
.data0x130000x14f350x600RW- IDATA
.rdata0x280000x34810x3600R-- IDATA
.debug0x2c0000x680x200R-- IDATA
.rsrc0x2d0000x232410x23400R-- IDATA
.reloc0x510000x66c0x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x2b3e00xa1
IMPORT0xf0000x8c
RESOURCE0x2d0000x23241
EXCEPTION00
SECURITY00
BASERELOC0x510000x66c
DEBUG0x2c0000x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x280000x154
Delay_IAT00
CLR_Header00
typenamesizecp
GWZ7_M2IMW_QO1P_R0GZ2H286721252
GWZ7_M2IMW_QT7S_P75I286721252
GWZ7_M2IMW_Q#5439286721252
N6D_0J8NRE#4334331252
W9W_4S7W5_AWWUH3F1_85N6D286721252
W9W_4S7W5_AWWUHAC_LOBS7_S7I286721252
module_namehintordfunction_name
VERSION.dll10VerQueryValueA
GDI32.dll421PathToRegion
GDI32.dll136CreateBitmapIndirect
GDI32.dll191EndPage
GDI32.dll172CreateRectRgnIndirect
GDI32.dll292GetBkMode
GDI32.dll512SetWindowExtEx
GDI32.dll407LineTo
GDI32.dll192EndPath
GDI32.dll442RectVisible
GDI32.dll500SetRectRgn
GDI32.dll387GetTextExtentPoint32A
GDI32.dll190EndDoc
GDI32.dll460SelectClipRgn
GDI32.dll379GetTextAlign
GDI32.dll205Escape
GDI32.dll117BeginPath
GDI32.dll140CreateCompatibleBitmap
KERNEL32.dll1165WaitForMultipleObjectsEx
KERNEL32.dll257DeleteCriticalSection
KERNEL32.dll1122TransactNamedPipe
KERNEL32.dll226CreateNamedPipeW
KERNEL32.dll211CreateFileW
KERNEL32.dll761LCMapStringA
KERNEL32.dll380FormatMessageA
KERNEL32.dll789LocalUnlock
KERNEL32.dll651GlobalDeleteAtom
KERNEL32.dll219CreateMailslotW
KERNEL32.dll490GetFileAttributesExA
KERNEL32.dll1080SetThreadExecutionState
KERNEL32.dll601GetSystemWindowsDirectoryW
KERNEL32.dll125AddAtomW
KERNEL32.dll1058SetLocalTime
KERNEL32.dll418GetComputerNameW
KERNEL32.dll396GetAtomNameW
KERNEL32.dll1131UnhandledExceptionFilter
msvcrt.dll1258memcpy
comdlg32.dll23PrintDlgW
comdlg32.dll16GetSaveFileNameW
comdlg32.dll2ChooseColorW
comdlg32.dll14GetOpenFileNameW
comdlg32.dll5CommDlgExtendedError
USER32.dll557SendNotifyMessageW
USER32.dll226FindWindowExA
USER32.dll88CreateDialogParamA
USER32.dll26CallWindowProcA
USER32.dll137DefFrameProcA
USER32.dll195EndDialog
USER32.dll247GetClassInfoW
USER32.dll29CascadeWindows
USER32.dll380GrayStringW
USER32.dll274GetDlgItemTextW
USER32.dll443LoadStringA
USER32.dll425IsRectEmpty
USER32.dll265GetCursorPos
USER32.dll408IsDialogMessageW
USER32.dll501PostThreadMessageW
USER32.dll600SetRect
USER32.dll590SetMenuItemInfoW
USER32.dll449LookupIconIdFromDirectory
USER32.dll346GetSysColorBrush
USER32.dll438LoadMenuA
USER32.dll457MapWindowPoints
USER32.dll362GetWindowDC
USER32.dll254GetClipCursor
USER32.dll223ExitWindowsEx
USER32.dll634ShowCaret
USER32.dll637ShowScrollBar
USER32.dll87CreateDialogIndirectParamW
USER32.dll628SetWindowTextW
USER32.dll151DestroyMenu
USER32.dll677UpdateWindow
USER32.dll148DestroyCaret
USER32.dll271GetDialogBaseUnits
USER32.dll386InflateRect
USER32.dll382HiliteMenuItem
USER32.dll225FindWindowA
USER32.dll238GetAltTabInfoW
USER32.dll91CreateIconFromResource
ordentry_vafunction_name
10x242acAlphaBlend
20x242d5GradientFill
30x24302TransparentBlt
40x9963?IDdkJjkdID7@@YGKEPA_WG@Z
module_namePanhcWh_qAy.cgi
flags0
timestamp2011-06-19 21:45:23
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x2b418
Functions(4)0x2b408
NameOrdinals(4)0x2b428
offsetsizetypecomment
0223232EXE06/19/2011 21:45:23#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK