filenameo.exe
size580608 (0x8dc00)
md5daaa427046a60901a82448f75dec0beb
typePE32 executable (native) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
10119
9340353
1540353
9540359
9440351
964035101
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x41107bf3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion7.10
SizeOfCode0x59a00
SizeOfInitializedData0x34000
SizeOfUninitializedData0
AddressOfEntryPoint0xc604
BaseOfCode0x1000
BaseOfData0x5b000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion5.1
Reserved10
SizeOfImage0x90000
SizeOfHeaders0x400
CheckSum0x98fc9
Subsystem1
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x598e20x59a00R-X CODE
.data0x5b0000x53c00x5200RW- IDATA
.rsrc0x610000x2cd100x2ce00R-- IDATA DISCARDABLE
.reloc0x8e0000x1dce0x1e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x59e480x28
RESOURCE0x610000x2cd10
EXCEPTION00
SECURITY00
BASERELOC0x8e0000x1790
DEBUG0x11b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xbc300x40
Bound_IAT0x2780x1c
IAT0x10000x1b0
Delay_IAT00
CLR_Header00
typenamesizecp
MESSAGETABLE#11824640
VERSION#19440
module_namehintordfunction_name
ntdll.dll1228_wcsicmp
ntdll.dll1231_wcsupr
ntdll.dll1190_allmul
ntdll.dll1188_alldiv
ntdll.dll139NtDelayExecution
ntdll.dll1216_stricmp
ntdll.dll1237atoi
ntdll.dll340NtTerminateProcess
ntdll.dll834RtlUnhandledExceptionFilter
ntdll.dll850RtlUnwind
ntdll.dll260NtQueryVirtualMemory
ntdll.dll15DbgBreakPoint
ntdll.dll398RtlAllocateHeap
ntdll.dll837RtlUnicodeStringToAnsiString
ntdll.dll715RtlNormalizeProcessParams
ntdll.dll1304wcslen
ntdll.dll1250isprint
ntdll.dll1290swprintf
ntdll.dll725RtlOemToUnicodeN
ntdll.dll708RtlMultiByteToUnicodeN
ntdll.dll845RtlUnicodeToOemN
ntdll.dll843RtlUnicodeToMultiByteN
ntdll.dll1272sprintf
ntdll.dll1267memmove
ntdll.dll1229_wcslwr
ntdll.dll1301wcscmp
ntdll.dll1200_chkstk
ntdll.dll581RtlFreeUnicodeString
ntdll.dll516RtlDosPathNameToNtPathName_U
ntdll.dll103NtClose
ntdll.dll332NtShutdownSystem
ntdll.dll89NtAdjustPrivilegesToken
ntdll.dll204NtOpenProcessToken
ntdll.dll256NtQuerySystemTime
ntdll.dll255NtQuerySystemInformation
ntdll.dll252NtQuerySymbolicLinkObject
ntdll.dll208NtOpenSymbolicLinkObject
ntdll.dll630RtlInitUnicodeString
ntdll.dll307NtSetInformationFile
ntdll.dll232NtQueryInformationFile
ntdll.dll196NtOpenFile
ntdll.dll358NtWriteFile
ntdll.dll115NtCreateFile
ntdll.dll164NtFsControlFile
ntdll.dll865RtlValidRelativeSecurityDescriptor
ntdll.dll546RtlExpandEnvironmentStrings_U
ntdll.dll326NtSetThreadExecutionState
ntdll.dll265NtReadFile
ntdll.dll146NtDeviceIoControlFile
ntdll.dll261NtQueryVolumeInformationFile
ntdll.dll147NtDisplayString
ntdll.dll354NtWaitForMultipleObjects
ntdll.dll113NtCreateEvent
ntdll.dll1196_aulldiv
ntdll.dll576RtlFreeHeap
ntdll.dll808RtlSizeHeap
ntdll.dll573RtlFormatMessage
ntdll.dll401RtlAnsiStringToUnicodeString
ntdll.dll624RtlInitAnsiString
ntdll.dll563RtlFindMessage
ntdll.dll1302wcscpy
ntdll.dll1306wcsncmp
ntdll.dll746RtlQueryRegistryValues
ntdll.dll875RtlWriteRegistryValue
ntdll.dll814RtlSubAuthoritySid
ntdll.dll644RtlInitializeSid
ntdll.dll691RtlLengthRequiredSid
ntdll.dll382RtlAddAce
ntdll.dll453RtlCopySid
ntdll.dll693RtlLengthSid
ntdll.dll738RtlQueryInformationAcl
ntdll.dll457RtlCreateAcl
ntdll.dll376RtlAddAccessAllowedAce
ntdll.dll692RtlLengthSecurityDescriptor
ntdll.dll866RtlValidSecurityDescriptor
ntdll.dll712RtlNewSecurityObject
ntdll.dll786RtlSetDaclSecurityDescriptor
ntdll.dll788RtlSetGroupSecurityDescriptor
ntdll.dll467RtlCreateSecurityDescriptor
ntdll.dll822RtlTimeToTimeFields
ntdll.dll817RtlSystemTimeToLocalTime
ntdll.dll331NtSetVolumeInformationFile
ntdll.dll731RtlPrefixUnicodeString
ntdll.dll259NtQueryValueKey
ntdll.dll199NtOpenKey
ntdll.dll1192_allrem
ntdll.dll485RtlDecompressBuffer
ntdll.dll852RtlUpcaseUnicodeString
ntdll.dll753RtlRaiseStatus
ntdll.dll341NtTerminateThread
ntdll.dll302NtSetEvent
ntdll.dll355NtWaitForSingleObject
ntdll.dll236NtQueryInformationThread
ntdll.dll476RtlCreateUserThread
ntdll.dll434RtlComputeCrc32
ntdll.dll16DbgPrint
ntdll.dll492RtlDeleteElementGenericTable
ntdll.dll567RtlFindSetBits
ntdll.dll425RtlClearBits
ntdll.dll633RtlInitializeBitMap
ntdll.dll700RtlLookupElementGenericTable
ntdll.dll722RtlNumberOfSetBits
ntdll.dll535RtlEnumerateGenericTableWithoutSplaying
ntdll.dll781RtlSetBits
ntdll.dll646RtlInsertElementGenericTable
ntdll.dll637RtlInitializeGenericTable
ntdll.dll246NtQueryPerformanceCounter

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionAuto File System Conversion Utility
FileVersion5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalNameautoconv
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameAUTOCONV.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.2180

VS_FIXEDFILEINFO

FileVersion5.1.2600.2180
ProductVersion5.1.2600.2180
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0580608EXE08/04/2004 06:02:27#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278