in_plain_sight - in-plain-sight

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	in_plain_sight
size	4782592 (0x48fa00)
md5	ddab0e61485ac6c86835861db972fc08

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
147	30729	22
257	33030	2
261	33030	21
260	33030	10
259	33030	4
257	30795	15
260	33134	868
1	0	307
0	0	118
255	33134	1
258	33134	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x670a9b8e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.38
SizeOfCode	0x34fa00
SizeOfInitializedData	0x142400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x34f1f4
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x495000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x34f84a	0x34fa00	R-X CODE
.rdata	0x351000	0xd692a	0xd6a00	R-- IDATA
.data	0x428000	0x9d80	0x7600	RW- IDATA
.pdata	0x432000	0x1fb0c	0x1fc00	R-- IDATA
.rsrc	0x452000	0x37ad8	0x37c00	R-- IDATA
.reloc	0x48a000	0xa2ac	0xa400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x425ffc	0x1b8
RESOURCE	0x452000	0x37ad8
EXCEPTION	0x432000	0x1fb0c
SECURITY	0	0
BASERELOC	0x48a000	0xa2ac
DEBUG	0x40a7f0	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x40a880	0x28
LOAD_CONFIG	0x40a6b0	0x140
Bound_IAT	0	0
IAT	0x351000	0x7a0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x14040b3f8	0x14040b448	0x140431910	0x140351820	0	0x400000

show previews

type	name	size
ICON	#1	1128
ICON	#2	2440
ICON	#3	4264
ICON	#4	9640
ICON	#5	16936
ICON	#6	21640
ICON	#7	38056
ICON	#8	67624
ICON	#9	65119
GROUP_ICON	#32512	132
VERSION	#1	448

module_name	hint	ord	function_name
kernel32.dll			GetModuleHandleA
kernel32.dll			GetProcAddress
kernel32.dll			WaitForSingleObject
kernel32.dll			GetExitCodeThread
kernel32.dll			CloseHandle
bcryptprimitives.dll			ProcessPrng
api-ms-win-core-synch-l1-2-0.dll			WakeByAddressAll
api-ms-win-core-synch-l1-2-0.dll			WakeByAddressSingle
api-ms-win-core-synch-l1-2-0.dll			WaitOnAddress
ADVAPI32.dll	210		CryptGenRandom
ADVAPI32.dll	676		RegisterEventSourceW
ADVAPI32.dll	694		ReportEventW
ADVAPI32.dll	194		CryptAcquireContextW
ADVAPI32.dll	220		CryptReleaseContext
ADVAPI32.dll	237		DeregisterEventSource
USER32.dll	474		GetUserObjectInformationW
USER32.dll	651		MessageBoxW
USER32.dll	432		GetProcessWindowStation
CRYPT32.dll	53		CertFindCertificateInStore
CRYPT32.dll	64		CertFreeCertificateContext
CRYPT32.dll	91		CertOpenSystemStoreW
CRYPT32.dll	18		CertCloseStore
WS2_32.dll		55
WS2_32.dll		56
WS2_32.dll		51
WS2_32.dll		12
WS2_32.dll		11
WS2_32.dll		9
WS2_32.dll		8
WS2_32.dll		111
WS2_32.dll		16
WS2_32.dll		52
WS2_32.dll		18
WS2_32.dll		15
WS2_32.dll		7
WS2_32.dll		6
WS2_32.dll		10
WS2_32.dll		112
WS2_32.dll		19
WS2_32.dll		5
WS2_32.dll		17
WS2_32.dll		20
WS2_32.dll		21
WS2_32.dll		3
WS2_32.dll		4
WS2_32.dll		23
WS2_32.dll		22
WS2_32.dll		115
WS2_32.dll		116
KERNEL32.dll	629		GetFullPathNameW
KERNEL32.dll	218		CreateFileW
KERNEL32.dll	259		CreateThread
KERNEL32.dll	236		CreateNamedPipeW
KERNEL32.dll	769		GetSystemDirectoryW
KERNEL32.dll	845		GetWindowsDirectoryW
KERNEL32.dll	657		GetModuleFileNameW
KERNEL32.dll	1510		UnhandledExceptionFilter
KERNEL32.dll	883		HeapReAlloc
KERNEL32.dll	880		HeapFree
KERNEL32.dll	1444		SetUnhandledExceptionFilter
KERNEL32.dll	936		IsProcessorFeaturePresent
KERNEL32.dll	906		InitializeSListHead
KERNEL32.dll	321		DuplicateHandle
KERNEL32.dll	1277		RtlLookupFunctionEntry
KERNEL32.dll	1269		RtlCaptureContext
KERNEL32.dll	1362		SetFileInformationByHandle
KERNEL32.dll	1523		UpdateProcThreadAttribute
KERNEL32.dll	905		InitializeProcThreadAttributeList
KERNEL32.dll	600		GetExitCodeProcess
KERNEL32.dll	1476		TerminateProcess
KERNEL32.dll	609		GetFileAttributesW
KERNEL32.dll	246		CreateProcessW
KERNEL32.dll	169		CompareStringOrdinal
KERNEL32.dll	595		GetEnvironmentStringsW
KERNEL32.dll	297		DeleteProcThreadAttributeList
KERNEL32.dll	452		FreeEnvironmentStringsW
KERNEL32.dll	876		HeapAlloc
KERNEL32.dll	724		GetProcessHeap
KERNEL32.dll	566		GetCurrentThread
KERNEL32.dll	1431		SetThreadStackGuarantee
KERNEL32.dll	20		AddVectoredExceptionHandler
KERNEL32.dll	928		IsDebuggerPresent
KERNEL32.dll	1177		ReadFileEx
KERNEL32.dll	1463		SleepEx
KERNEL32.dll	1612		WriteFileEx
KERNEL32.dll	637		GetLastError
KERNEL32.dll	1380		SetLastError
KERNEL32.dll	1284		RtlVirtualUnwind
KERNEL32.dll	755		GetStdHandle
KERNEL32.dll	618		GetFileType
KERNEL32.dll	1611		WriteFile
KERNEL32.dll	661		GetModuleHandleW
KERNEL32.dll	1042		MultiByteToWideChar
KERNEL32.dll	907		InitializeSRWLock
KERNEL32.dll	1240		ReleaseSRWLockExclusive
KERNEL32.dll	1241		ReleaseSRWLockShared
KERNEL32.dll			AcquireSRWLockExclusive
KERNEL32.dll	1		AcquireSRWLockShared
KERNEL32.dll	567		GetCurrentThreadId
KERNEL32.dll	1494		TlsAlloc
KERNEL32.dll	1496		TlsGetValue
KERNEL32.dll	1497		TlsSetValue
KERNEL32.dll	1495		TlsFree
KERNEL32.dll	768		GetSystemDirectoryA
KERNEL32.dll	453		FreeLibrary
KERNEL32.dll	996		LoadLibraryA
KERNEL32.dll	448		FormatMessageA
KERNEL32.dll	1538		VirtualFree
KERNEL32.dll	597		GetEnvironmentVariableW
KERNEL32.dll	1591		WideCharToMultiByte
KERNEL32.dll	460		GetACP
KERNEL32.dll	399		FindClose
KERNEL32.dll	410		FindFirstFileW
KERNEL32.dll	422		FindNextFileW
KERNEL32.dll	563		GetCurrentProcessId
KERNEL32.dll	778		GetSystemTimeAsFileTime
KERNEL32.dll	1470		SwitchToFiber
KERNEL32.dll	292		DeleteFiber
KERNEL32.dll	208		CreateFiberEx
KERNEL32.dll	776		GetSystemTime
KERNEL32.dll	1472		SystemTimeToFileTime
KERNEL32.dll	901		InitializeCriticalSection
KERNEL32.dll	329		EnterCriticalSection
KERNEL32.dll	992		LeaveCriticalSection
KERNEL32.dll	291		DeleteCriticalSection
KERNEL32.dll	1242		ReleaseSemaphore
KERNEL32.dll	250		CreateSemaphoreA
KERNEL32.dll	176		ConvertFiberToThread
KERNEL32.dll	180		ConvertThreadToFiberEx
KERNEL32.dll	534		GetConsoleMode
KERNEL32.dll	1323		SetConsoleMode
KERNEL32.dll	1163		ReadConsoleA
KERNEL32.dll	1173		ReadConsoleW
KERNEL32.dll	562		GetCurrentProcess
KERNEL32.dll	1610		WriteConsoleW
KERNEL32.dll	1136		QueryPerformanceCounter
ntdll.dll	674		NtWriteFile
ntdll.dll	1311		RtlNtStatusToDosError
ntdll.dll	532		NtReadFile
VCRUNTIME140.dll	59		memcmp
VCRUNTIME140.dll	62		memset
VCRUNTIME140.dll	61		memmove
VCRUNTIME140.dll	64		strchr
VCRUNTIME140.dll	58		memchr
VCRUNTIME140.dll	70		wcsstr
VCRUNTIME140.dll	65		strrchr
VCRUNTIME140.dll	66		strstr
VCRUNTIME140.dll	8		__C_specific_handler
VCRUNTIME140.dll	27		__current_exception
VCRUNTIME140.dll	28		__current_exception_context
VCRUNTIME140.dll	60		memcpy
api-ms-win-crt-string-l1-1-0.dll	143		strncpy
api-ms-win-crt-string-l1-1-0.dll	138		strcspn
api-ms-win-crt-string-l1-1-0.dll	110		isspace
api-ms-win-crt-string-l1-1-0.dll	147		strspn
api-ms-win-crt-string-l1-1-0.dll	142		strncmp
api-ms-win-crt-string-l1-1-0.dll	144		strncpy_s
api-ms-win-crt-string-l1-1-0.dll	133		strcat_s
api-ms-win-crt-string-l1-1-0.dll	137		strcpy_s
api-ms-win-crt-string-l1-1-0.dll	151		tolower
api-ms-win-crt-string-l1-1-0.dll	104		isdigit
api-ms-win-crt-string-l1-1-0.dll	134		strcmp
api-ms-win-crt-time-l1-1-0.dll	48		_time64
api-ms-win-crt-time-l1-1-0.dll	32		_gmtime64_s
api-ms-win-crt-stdio-l1-1-0.dll	1		__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	13		__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll	84		_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	128		fputs
api-ms-win-crt-stdio-l1-1-0.dll	125		fopen
api-ms-win-crt-stdio-l1-1-0.dll	16		__stdio_common_vsscanf
api-ms-win-crt-stdio-l1-1-0.dll	98		_wfopen
api-ms-win-crt-stdio-l1-1-0.dll	15		__stdio_common_vsprintf_s
api-ms-win-crt-stdio-l1-1-0.dll	3		__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll	116		fclose
api-ms-win-crt-stdio-l1-1-0.dll	117		feof
api-ms-win-crt-stdio-l1-1-0.dll	118		ferror
api-ms-win-crt-stdio-l1-1-0.dll	119		fflush
api-ms-win-crt-stdio-l1-1-0.dll	122		fgets
api-ms-win-crt-stdio-l1-1-0.dll	38		_fileno
api-ms-win-crt-stdio-l1-1-0.dll	131		fread
api-ms-win-crt-stdio-l1-1-0.dll	135		fseek
api-ms-win-crt-stdio-l1-1-0.dll	137		ftell
api-ms-win-crt-stdio-l1-1-0.dll	152		setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	87		_setmode
api-ms-win-crt-stdio-l1-1-0.dll			__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	138		fwrite
api-ms-win-crt-stdio-l1-1-0.dll	17		__stdio_common_vswprintf
api-ms-win-crt-heap-l1-1-0.dll	23		calloc
api-ms-win-crt-heap-l1-1-0.dll	26		realloc
api-ms-win-crt-heap-l1-1-0.dll	25		malloc
api-ms-win-crt-heap-l1-1-0.dll	22		_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	24		free
api-ms-win-crt-utility-l1-1-0.dll	25		qsort
api-ms-win-crt-runtime-l1-1-0.dll	103		terminate
api-ms-win-crt-runtime-l1-1-0.dll	20		_beginthreadex
api-ms-win-crt-runtime-l1-1-0.dll	30		_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	55		_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	85		exit
api-ms-win-crt-runtime-l1-1-0.dll	99		signal
api-ms-win-crt-runtime-l1-1-0.dll	54		_initterm
api-ms-win-crt-runtime-l1-1-0.dll	40		_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	51		_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	4		__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	5		__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	60		_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	22		_cexit
api-ms-win-crt-runtime-l1-1-0.dll	21		_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	24		_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	33		_errno
api-ms-win-crt-runtime-l1-1-0.dll	61		_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	64		_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	66		_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	52		_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	101		strerror_s
api-ms-win-crt-runtime-l1-1-0.dll	35		_exit
api-ms-win-crt-runtime-l1-1-0.dll	97		raise
api-ms-win-crt-filesystem-l1-1-0.dll	32		_stat64i32
api-ms-win-crt-convert-l1-1-0.dll	100		strtoul
api-ms-win-crt-convert-l1-1-0.dll	97		strtol
api-ms-win-crt-convert-l1-1-0.dll	80		atoi
api-ms-win-crt-environment-l1-1-0.dll	16		getenv
api-ms-win-crt-math-l1-1-0.dll	9		__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	8		_configthreadlocale

StringTable 000004b0

ProductName	in-plain-sight
FileVersion	0.1.0
FileDescription	in-plain-sight
ProductVersion	0.1.0

VS_FIXEDFILEINFO

FileVersion	0.1.0.0
ProductVersion	0.1.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
4755f0	65119	PNG	(256 x 256)	#
48544f	42417	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x431910

in_plain_sight-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

TLS

StringTable 000004b0

VS_FIXEDFILEINFO

in_plain_sight
-