filenamebootsect.exe
size112640 (0x1b800)
md5db94ece57be4a2722d2f439bb71e65d4
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
149307291
1323072916
147307299
10155
1313072964
137307299
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4ce793fb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x11000
SizeOfInitializedData0xba00
SizeOfUninitializedData0
AddressOfEntryPoint0xbd14
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.2
Reserved10
SizeOfImage0x1f000
SizeOfHeaders0x400
CheckSum0x2894b
Subsystem3
DllCharacteristics0x8040
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x10e520x11000R-X CODE
.data0x120000x6f980x5a00RW- IDATA
.pdata0x190000x4c80x600R-- IDATA
.rsrc0x1a0000x3ad00x3c00R-- IDATA
.reloc0x1e0000x7700x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x113200x64
RESOURCE0x1a0000x3ad0
EXCEPTION0x190000x4c8
SECURITY00
BASERELOC0x1e0000x668
DEBUG0x13e00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x3a0
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
MESSAGETABLE#1136720
VERSION#19440
module_namehintordfunction_name
KERNEL32.dll930QueryDosDeviceW
KERNEL32.dll356FormatMessageW
KERNEL32.dll536GetModuleFileNameW
KERNEL32.dll843LocalFree
KERNEL32.dll1217Sleep
KERNEL32.dll518GetLastError
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll665GetTickCount
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll540GetModuleHandleW
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll907OutputDebugStringA
KERNEL32.dll963ReadFile
KERNEL32.dll1333WriteFile
KERNEL32.dll1139SetFilePointer
KERNEL32.dll1231TerminateProcess
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1251UnhandledExceptionFilter
KERNEL32.dll1067SearchPathW
KERNEL32.dll857MapViewOfFile
KERNEL32.dll1254UnmapViewOfFile
KERNEL32.dll628GetSystemDefaultUILanguage
KERNEL32.dll339FindResourceExW
KERNEL32.dll360FreeLibrary
KERNEL32.dll836LoadResource
KERNEL32.dll833LoadLibraryExW
KERNEL32.dll522GetLocaleInfoW
KERNEL32.dll684GetVersionExW
KERNEL32.dll143CreateFileW
KERNEL32.dll1151SetLastError
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll678GetUserDefaultUILanguage
KERNEL32.dll82CloseHandle
KERNEL32.dll639GetSystemTimeAsFileTime
msvcrt.dll1152memcpy
msvcrt.dll1156memset
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1082free
msvcrt.dll1108isdigit
msvcrt.dll1149mbtowc
msvcrt.dll123__mb_cur_max
msvcrt.dll1110isleadbyte
msvcrt.dll1129isxdigit
msvcrt.dll1133localeconv
msvcrt.dll367_iob
msvcrt.dll698_snprintf
msvcrt.dll454_itoa
msvcrt.dll1292wctomb
msvcrt.dll1140malloc
msvcrt.dll1062ferror
msvcrt.dll1120iswctype
msvcrt.dll1287wcstombs
msvcrt.dll1175realloc
msvcrt.dll101__badioinfo
msvcrt.dll125__pioinfo
msvcrt.dll661_read
msvcrt.dll268_fileno
msvcrt.dll478_lseeki64
msvcrt.dll978_write
msvcrt.dll370_isatty
msvcrt.dll1243ungetc
msvcrt.dll1282wcsstr
msvcrt.dll1040bsearch
msvcrt.dll1273wcsncmp
msvcrt.dll128__set_app_type
msvcrt.dll280_fmode
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll160_amsg_exit
msvcrt.dll364_initterm
msvcrt.dll1056exit
msvcrt.dll179_cexit
msvcrt.dll255_exit
msvcrt.dll82_XcptFilter
msvcrt.dll83__C_specific_handler
msvcrt.dll113__getmainargs
msvcrt.dll893_wcslwr
msvcrt.dll246_errno
msvcrt.dll1128iswxdigit
msvcrt.dll856_vsnwprintf
msvcrt.dll1163printf
msvcrt.dll1106isalpha
msvcrt.dll899_wcsnicmp
msvcrt.dll889_wcsicmp
msvcrt.dll745_stricmp
msvcrt.dll1043calloc
ntdll.dll635RtlCaptureContext
ntdll.dll1026RtlLookupFunctionEntry
ntdll.dll1265RtlVirtualUnwind
ntdll.dll465NtResetEvent
ntdll.dll228NtCreateEvent
ntdll.dll340NtOpenDirectoryObject
ntdll.dll613RtlAllocateHeap
ntdll.dll389NtQueryDirectoryObject
ntdll.dll556NtWaitForSingleObject
ntdll.dll423NtQuerySymbolicLinkObject
ntdll.dll362NtOpenSymbolicLinkObject
ntdll.dll843RtlFreeHeap
ntdll.dll271NtDeviceIoControlFile
ntdll.dll344NtOpenFile
ntdll.dll214NtClose
ntdll.dll1045RtlNtStatusToDosError
ntdll.dll433NtQueryVolumeInformationFile
ntdll.dll298NtFsControlFile
ntdll.dll931RtlInitUnicodeString
ntdll.dll426NtQuerySystemInformation
ntdll.dll347NtOpenKey
ntdll.dll431NtQueryValueKey
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionBoot Sector Manipulation Tool
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamebootsect.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamebootsect.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0107056BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK