file1.exe

info
MZ
PE
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	file1.exe
size	6767 (0x1a6f)
md5	d66e7a660a3e8d1dce767d29a1ade7c1

type	PE Unknown PE signature 0x0, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: c3 be e9 b6 87 df 87 e5  87 df 87 e5 87 df 87 e5  |................|
00000050: 99 8d 14 e5 85 df 87 e5  99 8d 12 e5 85 df 87 e5  |................|
00000060: 99 8d 04 e5 92 df 87 e5  99 8d 03 e5 85 df 87 e5  |................|
00000070: a0 19 fc e5 82 df 87 e5  87 df 86 e5 bb df 87 e5  |................|
00000080: 99 8d 0d e5 85 df 87 e5  99 8d 16 e5 86 df 87 e5  |................|
00000090: 52 69 63 68 87 df 87 e5  00 00 00 00 00 00 00 00  |Rich............|
000000a0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 20  |............... |

PE Header

Signature	PE
Machine	0x6334
NumberOfSections	0x3130
TimeDateStamp	0x88010001
PointerToSymbolTable	0x510c
NumberOfSymbols	0
SizeOfOptionalHeader	0
Characteristics	0x24

Sections

name	va	vsize	raw size	flags
1020	0	0x30	0	---
.text	0x100000	0x200	0x6400	--- CODE IDATA
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
	0	0	0	---
ntdll.dl	0x72734300	0x100006c	0x50746547	R-X CODE IDATA DISCARDABLE
ormation	0x1737365	0x636f7250	0x53775a00	--- CODE IDATA
kernel32	0x10000	0x6c6c642e	0x65447349	R-X CODE IDATA SHARED
alAlloc	0x6c617574	0x72695600	0x746f7250	R-- CODE IDATA
xitProce	0x736f6c43	0x17373	0x6e614865	R-X CODE IDATA
AGetPr	0x73657264	0x6441636f	0x4f000173	R-X CODE IDATA DISCARDABLE SHARED
formance	0x636e6575	0x71657246	0x51000179	R-X CODE IDATA SHARED
erSlee	0x69547465	0x47000170	0x6f436b63	R-X IDATA DISCARDABLE
essSet	0x6f727245	0x7473614c	0x4f000172	R-- IDATA DISCARDABLE SHARED
etUnhand	0x70656378	0x4564656c	0x6e6f6974	R-- CODE IDATA
xception	0x172656c	0x646e6148	0x74655300	--- CODE IDATA
Generate	0x43656c6f	0x736e6f43	0x456c7274	--- CODE IDATA
GetCurr	0x65636f72	0x50746e65	0x17373	--- CODE IDATA
GetCurr	0x61657268	0x54746e65	0x1644964	R-- CODE IDATA DISCARDABLE
ilterT	0x6574616e	0x696d7265	0x636f7250	R-X IDATA SHARED
areExcha	0x74654700	0x165676e	0x74737953	R-X DISCARDABLE
terlocke	0x676e6168	0x63784564	0x53550065	R-X IDATA
owWMSVC	0x6c6c64	0x2e303952	0x5f000100	R-- CODE IDATA DISCARDABLE SHARED
_initenv	0x7474696e	0x695f0001	0x16d7265	R-X CODE IDATA
gthreadl	0x5f000165	0x6c61636f	0x7465735f	R-X CODE IDATA SHARED
_fdiv_	0x6d6d6f63	0x5f5f705f	0x165646f	R-X CODE IDATA
_pointer	0x5f746573	0x5f5f0001	0x5f707061	R-- CODE IDATA DISCARDABLE SHARED
hook?t	0x6574616e	0x696d7265	0x41594040	R-X CODE IDATA DISCARDABLE
nexit_	0x6f5f0001	0x6b636f6c	0x6978656e	--- CODE IDATA
_except_	0x3472656c	0x646e6168	0x6d6f635f	--- CODE IDATA
_contro	0x5f000173	0x5f70666c	0x69786563	--- CODE IDATA
printf	0x616d7465	0x675f5f00	0x72616e69	RWX DISCARDABLE
G[	0x1dffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
W[	0x1fffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
=[	0x21ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
<[	0x23ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
B[	0x25ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
B[	0x27ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
[[	0x29ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
>[	0x2bffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
M[	0x2dffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
^[	0x2fffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
c[	0x31ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
Q[	0x33ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
O[	0x35ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
^[	0x37ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
c[	0x39ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
n[	0x3bffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
][	0x3cffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
Q[	0x3fffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
U[	0x41ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
c[	0x43ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
c[	0x45ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
_[	0x47ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
h[	0x49ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
p[	0x4bffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
a[	0x4dffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
][	0x4fffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
y[	0x51ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
o[	0x53ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
g[	0x55ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
c[	0x57ffffff	0xff2c51b7	0xea000005	RWX DISCARDABLE
	0	0	0	---

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	1183	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 6767 bytes (7 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] non-zero dos stub after rich_hdr: "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 "