filenametea_client.exe
size738969 (0xb4699)
md5e36e4ebcf1e8a6d58ced34fe80a6dd50
typeZip archive data, made by v2.0, extract using at least v2.0, last modified Tue Jul 10 11:14:02 2007, uncompressed size 7126, method=deflate
mimetypeapplication/zip
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
123507272
147210222
149210221
132210222
147307293
1062
1312102221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x549deba4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x1000
SizeOfInitializedData0xb2200
SizeOfUninitializedData0
AddressOfEntryPoint0x19c4
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0xb6000
SizeOfHeaders0x400
CheckSum0xb8d53
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xf240x1000R-X CODE
.rdata0x20000x7ce0x800R-- IDATA
.data0x30000xb18440xb1600RW- IDATA
.rsrc0xb50000x2b00x400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x21e40x50
RESOURCE0xb50000x2b0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x21280x40
Bound_IAT00
IAT0x20000x104
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#15981252
module_namehintordfunction_name
python27.dll863Py_NoSiteFlag
python27.dll838Py_FrozenFlag
python27.dll852Py_IgnoreEnvironmentFlag
python27.dll317PyImport_FrozenModules
python27.dll870Py_SetPythonHome
python27.dll869Py_SetProgramName
python27.dll846Py_GetProgramFullPath
python27.dll855Py_Initialize
python27.dll660PySys_SetArgv
python27.dll834Py_Finalize
python27.dll131PyDict_New
python27.dll184PyEval_EvalCode
python27.dll188PyEval_GetBuiltins
python27.dll134PyDict_SetItemString
python27.dll323PyImport_ImportModule
python27.dll503PyObject_CallMethod
python27.dll144PyErr_Clear
python27.dll657PySys_GetObject
python27.dll356PyList_Insert
python27.dll641PyString_FromString
python27.dll642PyString_FromStringAndSize
python27.dll155PyErr_Print
python27.dll831Py_FatalError
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll319_controlfp_s
MSVCR90.dll523_invoke_watson
MSVCR90.dll371_except_handler4_common
MSVCR90.dll352_decode_pointer
MSVCR90.dll796_onexit
MSVCR90.dll630_lock
MSVCR90.dll150__dllonexit
MSVCR90.dll998_unlock
MSVCR90.dll277_amsg_exit
MSVCR90.dll159__getmainargs
MSVCR90.dll300_cexit
MSVCR90.dll380_exit
MSVCR90.dll102_XcptFilter
MSVCR90.dll1228exit
MSVCR90.dll160__initenv
MSVCR90.dll516_initterm
MSVCR90.dll517_initterm_e
MSVCR90.dll316_configthreadlocale
MSVCR90.dll227__setusermatherr
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll203__p__commode
MSVCR90.dll207__p__fmode
MSVCR90.dll362_encode_pointer
MSVCR90.dll224__set_app_type
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

KERNEL32.dll726IsDebuggerPresent
KERNEL32.dll1096UnhandledExceptionFilter
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1079TerminateProcess
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll618GetTickCount
KERNEL32.dll857QueryPerformanceCounter
KERNEL32.dll1055SetUnhandledExceptionFilter
KERNEL32.dll703InterlockedCompareExchange
KERNEL32.dll1067Sleep
KERNEL32.dll706InterlockedExchange
offsetsizetypecomment
0734720EXE12/26/2014 23:13:40#
15c115HTM#
b36004249ZIP#
Scanning the drive for archives:
1 file, 738969 bytes (722 KiB)


--
Type = zip
Physical Size = 738969
Embedded Stub Size = 734720

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2015-04-19 13:15:52 .....         7126         3364  __main__.pyc
2014-12-26 20:04:44 .....         1107          645  cx_Freeze__init__.pyc
------------------- ----- ------------ ------------  ------------------------
2015-04-19 13:15:52               8233         4009  2 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK