filenameoutbash.exe
size366080 (0x59600)
md5da055ec4d95db2aedd0ba264fc8034b3
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
259241237
26124123104
2602412322
1473072914
239401165
10186
261242107
255242101
15101
258242101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections8
TimeDateStamp0x5772e579
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.0
SizeOfCode0x31000
SizeOfInitializedData0x29200
SizeOfUninitializedData0
AddressOfEntryPoint0xdf84
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x5e000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x30ed20x31000R-X CODE
.rdata0x320000x107240x10800R-- IDATA
.data0x430000x2b680x1c00RW- IDATA
.pdata0x460000x38ac0x3a00R-- IDATA
.gfids0x4a0000x9140xa00R-- IDATA
.tls0x4b00090x200RW- IDATA
.rsrc0x4c0000x10ed80x11000R-- IDATA
.reloc0x5d0000x7900x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x414b40xc8
RESOURCE0x4c0000x10ed8
EXCEPTION0x460000x38ac
SECURITY00
BASERELOC0x5d0000x790
DEBUG0x387500x1c
ARCHITECTURE00
GLOBALPTR00
TLS0x388080x28
LOAD_CONFIG0x387700x94
Bound_IAT00
IAT0x320000x568
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x14004b0000x14004b0080x1400451500x14003261800x300000
typenamesizecp
ICON#17440
ICON#22960
ICON#337520
ICON#422160
ICON#513840
ICON#6166480
ICON#7169360
ICON#896400
ICON#967600
ICON#1042640
ICON#1124400
ICON#1217200
ICON#1311280
GROUP_ICONIDI_ICON11880
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll987MultiByteToWideChar
KERNEL32.dll1519WideCharToMultiByte
KERNEL32.dll559GetEnvironmentStringsW
KERNEL32.dll419FreeEnvironmentStringsW
KERNEL32.dll713GetStdHandle
KERNEL32.dll184CreateFileA
KERNEL32.dll124CloseHandle
KERNEL32.dll599GetLastError
KERNEL32.dll1318SetLastError
KERNEL32.dll856InitializeProcThreadAttributeList
KERNEL32.dll267DeleteProcThreadAttributeList
KERNEL32.dll1454UpdateProcThreadAttribute
KERNEL32.dll956LocalFree
KERNEL32.dll416FormatMessageW
KERNEL32.dll619GetModuleHandleA
KERNEL32.dll677GetProcAddress
KERNEL32.dll1017OpenProcess
KERNEL32.dll1315SetInformationJobObject
KERNEL32.dll1078QueryInformationJobObject
KERNEL32.dll464GetCommandLineW
KERNEL32.dll561GetEnvironmentVariableW
KERNEL32.dll180CreateEventW
KERNEL32.dll1481WaitForMultipleObjects
KERNEL32.dll1407TerminateProcess
KERNEL32.dll564GetExitCodeProcess
KERNEL32.dll565GetExitCodeThread
KERNEL32.dll1208ResumeThread
KERNEL32.dll218CreateProcessW
KERNEL32.dll727GetSystemDirectoryW
KERNEL32.dll199CreateJobObjectW
KERNEL32.dll28AssignProcessToJobObject
KERNEL32.dll505GetConsoleOutputCP
KERNEL32.dll1223RtlUnwindEx
KERNEL32.dll1103RaiseException
KERNEL32.dll1219RtlPcToFileHeader
KERNEL32.dll946LoadLibraryW
KERNEL32.dll1451UnregisterWaitEx
KERNEL32.dll1071QueryDepthSList
KERNEL32.dll861InterlockedFlushSList
KERNEL32.dll863InterlockedPushEntrySList
KERNEL32.dll862InterlockedPopEntrySList
KERNEL32.dll1184ReleaseSemaphore
KERNEL32.dll1472VirtualProtect
KERNEL32.dll1469VirtualFree
KERNEL32.dll1466VirtualAlloc
KERNEL32.dll786GetVersionExW
KERNEL32.dll945LoadLibraryExW
KERNEL32.dll618GetModuleFileNameW
KERNEL32.dll421FreeLibraryAndExitThread
KERNEL32.dll420FreeLibrary
KERNEL32.dll763GetThreadTimes
KERNEL32.dll293EncodePointer
KERNEL32.dll1450UnregisterWait
KERNEL32.dll1173RegisterWaitForSingleObject
KERNEL32.dll1351SetThreadAffinityMask
KERNEL32.dll678GetProcessAffinityMask
KERNEL32.dll640GetNumaHighestNodeNumber
KERNEL32.dll271DeleteTimerQueueTimer
KERNEL32.dll110ChangeTimerQueueTimer
KERNEL32.dll238CreateTimerQueueTimer
KERNEL32.dll607GetLogicalProcessorInformation
KERNEL32.dll759GetThreadPriority
KERNEL32.dll1361SetThreadPriority
KERNEL32.dll230CreateThread
KERNEL32.dll1402SwitchToThread
KERNEL32.dll1390SignalObjectAndWait
KERNEL32.dll237CreateTimerQueue
KERNEL32.dll857InitializeSListHead
KERNEL32.dll529GetCurrentProcessId
KERNEL32.dll879IsDebuggerPresent
KERNEL32.dll291DuplicateHandle
KERNEL32.dll1484WaitForSingleObjectEx
KERNEL32.dll1392Sleep
KERNEL32.dll528GetCurrentProcess
KERNEL32.dll532GetCurrentThread
KERNEL32.dll533GetCurrentThreadId
KERNEL32.dll297EnterCriticalSection
KERNEL32.dll939LeaveCriticalSection
KERNEL32.dll1434TryEnterCriticalSection
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll1081QueryPerformanceCounter
KERNEL32.dll853InitializeCriticalSectionAndSpinCount
KERNEL32.dll1425TlsAlloc
KERNEL32.dll1427TlsGetValue
KERNEL32.dll1428TlsSetValue
KERNEL32.dll1426TlsFree
KERNEL32.dll736GetSystemTimeAsFileTime
KERNEL32.dll765GetTickCount
KERNEL32.dll622GetModuleHandleW
KERNEL32.dll1291SetEvent
KERNEL32.dll1202ResetEvent
KERNEL32.dll1210RtlCaptureContext
KERNEL32.dll1217RtlLookupFunctionEntry
KERNEL32.dll1224RtlVirtualUnwind
KERNEL32.dll1441UnhandledExceptionFilter
KERNEL32.dll1377SetUnhandledExceptionFilter
KERNEL32.dll886IsProcessorFeaturePresent
KERNEL32.dll254DecodePointer
api-ms-win-crt-runtime-l1-1-0.dll85exit
api-ms-win-crt-runtime-l1-1-0.dll20_beginthreadex
api-ms-win-crt-runtime-l1-1-0.dll96quick_exit
api-ms-win-crt-runtime-l1-1-0.dll84abort
api-ms-win-crt-runtime-l1-1-0.dll103terminate
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll79_wassert
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll60_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll30_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll64_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll66_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll57_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll40_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll35_exit
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll4__p___argc
api-ms-win-crt-runtime-l1-1-0.dll5__p___argv
api-ms-win-crt-string-l1-1-0.dll142strncmp
api-ms-win-crt-string-l1-1-0.dll131memset
api-ms-win-crt-string-l1-1-0.dll137strcpy_s
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll13__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-heap-l1-1-0.dll9_calloc_base
api-ms-win-crt-heap-l1-1-0.dll23calloc
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll11_free_base
api-ms-win-crt-convert-l1-1-0.dll81atol
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
api-ms-win-crt-locale-l1-1-0.dll14_setmbcp
api-ms-win-crt-locale-l1-1-0.dll19setlocale
WS2_32.dll87WSASocketW
WS2_32.dll46WSAEventSelect
WS2_32.dll43WSAEnumNetworkEvents
WS2_32.dll36WSACreateEvent
WS2_32.dll111
WS2_32.dll112
WS2_32.dll115
WS2_32.dll22
WS2_32.dll19
WS2_32.dll16
WS2_32.dll15
WS2_32.dll13
WS2_32.dll9
WS2_32.dll8
WS2_32.dll6
WS2_32.dll5
WS2_32.dll10
WS2_32.dll4
WS2_32.dll3
WS2_32.dll2
WS2_32.dll1
api-ms-win-crt-math-l1-1-0.dll178exp
api-ms-win-crt-math-l1-1-0.dll9__setusermatherr
api-ms-win-crt-math-l1-1-0.dll278sqrt
offsetsizetypecomment
15c115HTM#
4a20816648PNG(256 x 256)#
4e31045808BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x45150