filenameGHO.exe
size32259 (0x7e03)
md5e1b41b896cd39f933255c78bf7591524
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
147210222
156303194
152201151
158303193
1703031920
171303194
1473072911
10135
1753031910
157303191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x51d554c6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x5200
SizeOfInitializedData0x2800
SizeOfUninitializedData0
AddressOfEntryPoint0x5726
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x400
CheckSum0x171bc
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x50750x5200R-X CODE
.rdata0x70000x19e60x1a00R-- IDATA
.data0x90000x5840x200RW- IDATA
.rsrc0xa0000x1b40x200R-- IDATA
.reloc0xb0000x8920xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x7be80xb4
RESOURCE0xa0000x1b4
EXCEPTION00
SECURITY00
BASERELOC0xb0000x69c
DEBUG0x72300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x76a00x40
Bound_IAT00
IAT0x70000x20c
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13461252
module_namehintordfunction_name
KERNEL32.dll963ReadProcessMemory
KERNEL32.dll1326WriteProcessMemory
KERNEL32.dll1202Sleep
KERNEL32.dll82CloseHandle
KERNEL32.dll181CreateThread
KERNEL32.dll158CreateMutexW
KERNEL32.dll1094SetConsoleTextAttribute
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll896OpenProcess
KERNEL32.dll612GetStdHandle
KERNEL32.dll514GetLastError
KERNEL32.dll859Module32FirstW
KERNEL32.dll190CreateToolhelp32Snapshot
KERNEL32.dll861Module32NextW
KERNEL32.dll1139SetLastError
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll202DecodePointer
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll234EncodePointer
KERNEL32.dll723HeapSetInformation
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll748InterlockedExchange
KERNEL32.dll772IsProcessorFeaturePresent
USER32.dll301GetForegroundWindow
USER32.dll491LoadCursorW
USER32.dll567PostQuitMessage
USER32.dll588RegisterClassExA
USER32.dll493LoadIconW
USER32.dll710SetWindowPos
USER32.dll288GetCursorPos
USER32.dll708SetWindowLongW
USER32.dll412GetWindowRect
USER32.dll247FindWindowA
USER32.dll664SetLayeredWindowAttributes
USER32.dll735ShowWindow
USER32.dll156DefWindowProcW
USER32.dll349GetMessageW
USER32.dll764TranslateMessage
USER32.dll526MessageBoxA
USER32.dll109CreateWindowExA
USER32.dll817mouse_event
USER32.dll420GetWindowThreadProcessId
USER32.dll175DispatchMessageW
USER32.dll621ScreenToClient
USER32.dll263GetAsyncKeyState
USER32.dll406GetWindowLongW
MSVCR100.dll355__getmainargs
MSVCR100.dll476_cexit
MSVCR100.dll554_exit
MSVCR100.dll301_XcptFilter
MSVCR100.dll356__initenv
MSVCR100.dll688_initterm
MSVCR100.dll689_initterm_e
MSVCR100.dll492_configthreadlocale
MSVCR100.dll418__setusermatherr
MSVCR100.dll491_commode
MSVCR100.dll581_fmode
MSVCR100.dll453_amsg_exit
MSVCR100.dll507_crt_debugger_hook
MSVCR100.dll258void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR100.dll314__CxxFrameHandler3
MSVCR100.dll1165_unlock
MSVCR100.dll347__dllonexit
MSVCR100.dll803_lock
MSVCR100.dll969_onexit
MSVCR100.dll545_except_handler4_common
MSVCR100.dll696_invoke_watson
MSVCR100.dll495_controlfp_s
MSVCR100.dll1609wcstombs_s
MSVCR100.dll120void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

MSVCR100.dll1395exit
MSVCR100.dll1577vswprintf_s
MSVCR100.dll1576vsprintf_s
MSVCR100.dll99void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR100.dll101void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR100.dll1489memmove
MSVCR100.dll238public: void __thiscall type_info::_type_info_dtor_internal_method(void)

?_type_info_dtor_internal_method@type_info@@QAEXXZ

MSVCR100.dll36public: __thiscall std::exception::exception(class std::exception const &)

??0exception@std@@QAE@ABV01@@Z

MSVCR100.dll34public: __thiscall std::exception::exception(char const * const &)

??0exception@std@@QAE@ABQBD@Z

MSVCR100.dll93public: virtual __thiscall std::exception::~exception(void)

??1exception@std@@UAE@XZ

MSVCR100.dll269public: virtual char const * __thiscall std::exception::what(void)const

?what@exception@std@@UBEPBDXZ

MSVCR100.dll284_CItan
MSVCR100.dll283_CIsqrt
MSVCR100.dll281_CIsin
MSVCR100.dll274_CIcos
MSVCR100.dll273_CIatan2
MSVCR100.dll270_CIacos
MSVCR100.dll1487memcpy
MSVCR100.dll289_CxxThrowException
MSVCR100.dll415__set_app_type
MSVCR100.dll1491memset
MSVCP100.dll875class std::basic_ostream<char, struct std::char_traits<char> > & __cdecl std::endl(class std::basic_ostream<char, struct std::char_traits<char> > &)

?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

MSVCP100.dll1436public: void __thiscall std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool)

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

MSVCP100.dll271public: class std::basic_ostream<char, struct std::char_traits<char> > & __thiscall std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > &))

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

MSVCP100.dll913public: class std::basic_ostream<char, struct std::char_traits<char> > & __thiscall std::basic_ostream<char, struct std::char_traits<char> >::flush(void)

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

MSVCP100.dll931public: int __thiscall std::basic_istream<char, struct std::char_traits<char> >::get(void)

?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ

MSVCP100.dll1477public: int __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char)

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

MSVCP100.dll595public: void __thiscall std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void)

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

MSVCP100.dll1480public: __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const *, __int64)

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

MSVCP100.dll1549bool __cdecl std::uncaught_exception(void)

?uncaught_exception@std@@YA_NXZ

MSVCP100.dll662class std::basic_istream<char, struct std::char_traits<char> > std::cin

?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

MSVCP100.dll679class std::basic_ostream<char, struct std::char_traits<char> > std::cout

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP100.dll652void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP100.dll654void __cdecl std::_Xout_of_range(char const *)

?_Xout_of_range@std@@YAXPBD@Z

dwmapi.dll6DwmExtendFrameIntoClientArea
d3d9.dll9Direct3DCreate9
d3dx9_40.dll211D3DXMatrixPerspectiveFovLH
d3dx9_40.dll205D3DXMatrixMultiply
d3dx9_40.dll320D3DXVec3Transform
d3dx9_40.dll317D3DXVec3Normalize
d3dx9_40.dll203D3DXMatrixLookAtLH
d3dx9_40.dll90D3DXCreateSprite
d3dx9_40.dll71D3DXCreateLine
d3dx9_40.dll67D3DXCreateFontW
PSAPI.DLL17GetModuleInformation
offsetsizetypecomment
032256EXE07/04/2013 10:56:06#
15c115HTM#
7e003BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 32259 bytes (32 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK