filenameTRRX.exe
size321536 (0x4e800)
md5db85ab3feb9804aef41949bbe188b189
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
1473072916
257241232
259241231
2612412318
2602412313
203655017
1093
2602350623
26024215318
264242154
255242101
258242151

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x5d9c58f8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x3d000
SizeOfInitializedData0x15400
SizeOfUninitializedData0
AddressOfEntryPoint0x320e3
BaseOfCode0x1000
BaseOfData0x3e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x57000
SizeOfHeaders0x400
CheckSum0x5c7e2
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x3ceac0x3d000R-X CODE
.rdata0x3e0000xb7ce0xb800R-- IDATA
.data0x4a0000x51780x1200RW- IDATA
.gfids0x500000x200x200R-- IDATA
.rsrc0x510000x1e00x200R-- IDATA
.reloc0x520000x44440x4600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x48e0c0x104
RESOURCE0x510000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x520000x4444
DEBUG0x48ab00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x48ae80x40
Bound_IAT00
IAT0x3e0000x184
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
USER32.dll582MessageBoxA
USER32.dll674RegisterWindowMessageA
USER32.dll626PostThreadMessageA
USER32.dll180DispatchMessageA
USER32.dll831TranslateMessage
USER32.dll367GetMessageA
USER32.dll695SendMessageA
VERSION.dll4GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dll15VerQueryValueA
KERNEL32.dll1413UnmapViewOfFile
KERNEL32.dll843InitializeSListHead
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll1377TerminateProcess
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1362Sleep
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll1164ReleaseMutex
KERNEL32.dll1451WaitForSingleObject
KERNEL32.dll206CreateMutexA
KERNEL32.dll514GetCurrentDirectoryA
KERNEL32.dll754GetTickCount
KERNEL32.dll665GetPrivateProfileStringA
KERNEL32.dll337ExitProcess
KERNEL32.dll593GetLocalTime
KERNEL32.dll960MapViewOfFile
KERNEL32.dll997OpenFileMappingA
KERNEL32.dll592GetLastError
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll127CloseHandle
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll871IsDebuggerPresent
VCRUNTIME140.dll53_except_handler4_common
VCRUNTIME140.dll72memset
VCRUNTIME140.dll70memcpy
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll49_fsopen
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll119fflush
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll116fclose
api-ms-win-crt-stdio-l1-1-0.dll15__stdio_common_vsprintf_s
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll13__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll135fseek
api-ms-win-crt-stdio-l1-1-0.dll131fread
api-ms-win-crt-stdio-l1-1-0.dll138fwrite
api-ms-win-crt-string-l1-1-0.dll144strncpy_s
api-ms-win-crt-string-l1-1-0.dll133strcat_s
api-ms-win-crt-string-l1-1-0.dll142strncmp
api-ms-win-crt-string-l1-1-0.dll137strcpy_s
api-ms-win-crt-convert-l1-1-0.dll24_itoa_s
api-ms-win-crt-runtime-l1-1-0.dll31_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll62_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll98perror
api-ms-win-crt-runtime-l1-1-0.dll35_errno
api-ms-win-crt-runtime-l1-1-0.dll66_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll68_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll29_controlfp_s
api-ms-win-crt-runtime-l1-1-0.dll25_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll53_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll45_get_narrow_winmain_command_line
api-ms-win-crt-runtime-l1-1-0.dll56_initterm
api-ms-win-crt-runtime-l1-1-0.dll57_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll88exit
api-ms-win-crt-runtime-l1-1-0.dll54_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll23_cexit
api-ms-win-crt-runtime-l1-1-0.dll22_c_exit
api-ms-win-crt-runtime-l1-1-0.dll63_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll37_exit
api-ms-win-crt-runtime-l1-1-0.dll58_invalid_parameter_noinfo
api-ms-win-crt-runtime-l1-1-0.dll106terminate
api-ms-win-crt-time-l1-1-0.dll48_time64
api-ms-win-crt-time-l1-1-0.dll70strftime
api-ms-win-crt-time-l1-1-0.dll36_localtime64_s
api-ms-win-crt-math-l1-1-0.dll46__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll24free
offsetsizetypecomment
0321536EXE10/08/2019 09:38:00#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK