filenameProject1.exe
size651776 (0x9f200)
md5d4fe1cc122369393bc351c2a8e0b4678
typePE32 executable (native) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
257274123
1084
2592741213
26127412145
2602741218
2612991337
2602991315
2592991319
260299151
258299151

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x643e5898
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.28
SizeOfCode0x7ac00
SizeOfInitializedData0x25400
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x7c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xa4000
SizeOfHeaders0x400
CheckSum0xac100
Subsystem1
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++

Sections

namevavsizeraw sizeflags
.text0x10000x7aa130x7ac00R-X CODE
.rdata0x7c0000x1e0b40x1e200R-- IDATA
.data0x9b0000x1d740xc00RW- IDATA
.msvcjmc0x9d0000x100x200RW- IDATA
INIT0x9e0000x7b00x800RW- IDATA DISCARDABLE
.reloc0x9f0000x49ac0x4a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x9e0000x28
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x9f0000x49ac
DEBUG0x98cdc0x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x98d300x40
Bound_IAT00
IAT0x7c0000x154
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll543GetCurrentThreadId
KERNEL32.dll1103QueryPerformanceCounter
KERNEL32.dll539GetCurrentProcessId
KERNEL32.dll748GetSystemTimeAsFileTime
KERNEL32.dll870InitializeSListHead
KERNEL32.dll898IsDebuggerPresent
KERNEL32.dll1457UnhandledExceptionFilter
KERNEL32.dll1393SetUnhandledExceptionFilter
KERNEL32.dll723GetStartupInfoW
KERNEL32.dll905IsProcessorFeaturePresent
KERNEL32.dll635GetModuleHandleW
KERNEL32.dll1124RaiseException
KERNEL32.dll1011MultiByteToWideChar
KERNEL32.dll1538WideCharToMultiByte
KERNEL32.dll612GetLastError
KERNEL32.dll840HeapAlloc
KERNEL32.dll844HeapFree
KERNEL32.dll695GetProcessHeap
KERNEL32.dll1490VirtualQuery
KERNEL32.dll430FreeLibrary
KERNEL32.dll689GetProcAddress
KERNEL32.dll538GetCurrentProcess
KERNEL32.dll1424TerminateProcess
KERNEL32.dll882InterlockedPushEntrySList
KERNEL32.dll879InterlockedFlushSList
KERNEL32.dll631GetModuleFileNameW
KERNEL32.dll967LoadLibraryExW
KERNEL32.dll1237RtlUnwind
KERNEL32.dll1332SetLastError
KERNEL32.dll308EnterCriticalSection
KERNEL32.dll961LeaveCriticalSection
KERNEL32.dll275DeleteCriticalSection
KERNEL32.dll866InitializeCriticalSectionAndSpinCount
KERNEL32.dll1442TlsAlloc
KERNEL32.dll1444TlsGetValue
KERNEL32.dll1445TlsSetValue
KERNEL32.dll1443TlsFree
KERNEL32.dll304EncodePointer
KERNEL32.dll634GetModuleHandleExW
KERNEL32.dll353ExitProcess
KERNEL32.dll852HeapValidate
KERNEL32.dll742GetSystemInfo
KERNEL32.dll725GetStdHandle
KERNEL32.dll593GetFileType
KERNEL32.dll1558WriteFile
KERNEL32.dll1051OutputDebugStringW
KERNEL32.dll1557WriteConsoleW
KERNEL32.dll1259SetConsoleCtrlHandler
KERNEL32.dll542GetCurrentThread
KERNEL32.dll376FindClose
KERNEL32.dll382FindFirstFileExW
KERNEL32.dll399FindNextFileW
KERNEL32.dll911IsValidCodePage
KERNEL32.dll437GetACP
KERNEL32.dll666GetOEMCP
KERNEL32.dll452GetCPInfo
KERNEL32.dll473GetCommandLineA
KERNEL32.dll474GetCommandLineW
KERNEL32.dll570GetEnvironmentStringsW
KERNEL32.dll429FreeEnvironmentStringsW
KERNEL32.dll1302SetEnvironmentVariableW
KERNEL32.dll548GetDateFormatW
KERNEL32.dll783GetTimeFormatW
KERNEL32.dll158CompareStringW
KERNEL32.dll949LCMapStringW
KERNEL32.dll616GetLocaleInfoW
KERNEL32.dll913IsValidLocale
KERNEL32.dll789GetUserDefaultLCID
KERNEL32.dll343EnumSystemLocalesW
KERNEL32.dll847HeapReAlloc
KERNEL32.dll849HeapSize
KERNEL32.dll846HeapQueryInformation
KERNEL32.dll730GetStringTypeW
KERNEL32.dll1358SetStdHandle
KERNEL32.dll591GetFileSizeEx
KERNEL32.dll1317SetFilePointerEx
KERNEL32.dll418FlushFileBuffers
KERNEL32.dll515GetConsoleOutputCP
KERNEL32.dll511GetConsoleMode
KERNEL32.dll1141ReadFile
KERNEL32.dll1138ReadConsoleW
KERNEL32.dll268DecodePointer
KERNEL32.dll137CloseHandle
KERNEL32.dll206CreateFileW
offsetsizetypecomment
0651776EXE04/18/2023 08:45:12#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK