parentffmpeg.exe
filenameffmpeg.unpacked.exe
size6696960 (0x663000)
md5ec4d845a481da5fcfff7e541f28b443d
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x496367e8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.56
SizeOfCode0x53d800
SizeOfInitializedData0x125400
SizeOfUninitializedData0x322a00
AddressOfEntryPoint0x1130
BaseOfCode0x1000
BaseOfData0x53f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x98a000
SizeOfHeaders0x1000
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MingWin32

Sections

namevavsizeraw sizeflags
.text0x10000x53d7100x53d800R-X CODE
.data0x53f0000x134940x13600RW- IDATA
.rdata0x5530000x1102a40x110400R-- IDATA
.rodata0x6640000x5a00x600R-- IDATA
.bss0x6650000x3229e00RW- UDATA
.idata0x9880000x12340x1400RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x9880000x1234
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.DLLCloseHandle
KERNEL32.DLLCreateEventA
KERNEL32.DLLCreateMutexA
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLExitProcess
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLGetProcessTimes
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLInterlockedExchange
KERNEL32.DLLIsDBCSLeadByteEx
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLReleaseMutex
KERNEL32.DLLResetEvent
KERNEL32.DLLSetEvent
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLSleep
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLWideCharToMultiByte
AVICAP32.DLLcapCreateCaptureWindowA
libmp3lame-0.dlllame_close
libmp3lame-0.dlllame_encode_buffer
libmp3lame-0.dlllame_encode_buffer_interleaved
libmp3lame-0.dlllame_encode_flush
libmp3lame-0.dlllame_get_framesize
libmp3lame-0.dlllame_init
libmp3lame-0.dlllame_init_params
libmp3lame-0.dlllame_set_VBR
libmp3lame-0.dlllame_set_VBR_q
libmp3lame-0.dlllame_set_bWriteVbrTag
libmp3lame-0.dlllame_set_brate
libmp3lame-0.dlllame_set_disable_reservoir
libmp3lame-0.dlllame_set_in_samplerate
libmp3lame-0.dlllame_set_mode
libmp3lame-0.dlllame_set_num_channels
libmp3lame-0.dlllame_set_out_samplerate
libmp3lame-0.dlllame_set_quality
msvcrt.dll__getmainargs
msvcrt.dll__lc_codepage
msvcrt.dll__mb_cur_max
msvcrt.dll__p__environ
msvcrt.dll__p__fmode
msvcrt.dll__set_app_type
msvcrt.dll_assert
msvcrt.dll_atoi64
msvcrt.dll_cexit
msvcrt.dll_errno
msvcrt.dll_filbuf
msvcrt.dll_iob
msvcrt.dll_lseeki64
msvcrt.dll_onexit
msvcrt.dll_setmode
msvcrt.dll_stricmp
msvcrt.dllabort
msvcrt.dllacos
msvcrt.dllasin
msvcrt.dllatan
msvcrt.dllatexit
msvcrt.dllatof
msvcrt.dllatoi
msvcrt.dllceil
msvcrt.dllcos
msvcrt.dllcosh
msvcrt.dllexit
msvcrt.dllexp
msvcrt.dllfclose
msvcrt.dllfflush
msvcrt.dllfloor
msvcrt.dllfopen
msvcrt.dllfprintf
msvcrt.dllfputc
msvcrt.dllfread
msvcrt.dllfree
msvcrt.dllfrexp
msvcrt.dllfscanf
msvcrt.dllfseek
msvcrt.dllftell
msvcrt.dllfwrite
msvcrt.dllgetenv
msvcrt.dllgmtime
msvcrt.dllisalpha
msvcrt.dllisprint
msvcrt.dllisspace
msvcrt.dllldexp
msvcrt.dlllocaleconv
msvcrt.dlllocaltime
msvcrt.dlllog
msvcrt.dlllog10
msvcrt.dllmalloc
msvcrt.dllmemchr
msvcrt.dllmemcpy
msvcrt.dllmemmove
msvcrt.dllmemset
msvcrt.dllmktime
msvcrt.dllperror
msvcrt.dllpow
msvcrt.dllqsort
msvcrt.dllrealloc
msvcrt.dllrename
msvcrt.dllsignal
msvcrt.dllsin
msvcrt.dllsinh
msvcrt.dllsprintf
msvcrt.dllsqrt
msvcrt.dllsscanf
msvcrt.dllstrchr
msvcrt.dllstrcmp
msvcrt.dllstrcpy
msvcrt.dllstrcspn
msvcrt.dllstrerror
msvcrt.dllstrlen
msvcrt.dllstrncmp
msvcrt.dllstrncpy
msvcrt.dllstrpbrk
msvcrt.dllstrrchr
msvcrt.dllstrspn
msvcrt.dllstrstr
msvcrt.dllstrtod
msvcrt.dllstrtok
msvcrt.dllstrtol
msvcrt.dlltan
msvcrt.dlltanh
msvcrt.dlltime
msvcrt.dlltolower
msvcrt.dlltoupper
msvcrt.dllvfprintf
msvcrt.dllwcslen
msvcrt.dll_close
msvcrt.dll_getch
msvcrt.dll_isatty
msvcrt.dll_kbhit
msvcrt.dll_open
msvcrt.dll_read
msvcrt.dll_setmode
msvcrt.dll_strdup
msvcrt.dll_tempnam
msvcrt.dll_unlink
msvcrt.dll_write
USER32.dllDestroyWindow
USER32.dllGetWindowLongA
USER32.dllSendMessageA
USER32.dllSetWindowLongA
WS2_32.DLLWSACleanup
WS2_32.DLLWSAGetLastError
WS2_32.DLLWSAStartup
WS2_32.DLL__WSAFDIsSet
WS2_32.DLLbind
WS2_32.DLLclosesocket
WS2_32.DLLconnect
WS2_32.DLLgethostbyname
WS2_32.DLLgethostname
WS2_32.DLLgetsockname
WS2_32.DLLgetsockopt
WS2_32.DLLhtonl
WS2_32.DLLhtons
WS2_32.DLLinet_ntoa
WS2_32.DLLioctlsocket
WS2_32.DLLntohl
WS2_32.DLLntohs
WS2_32.DLLrecv
WS2_32.DLLrecvfrom
WS2_32.DLLselect
WS2_32.DLLsend
WS2_32.DLLsendto
WS2_32.DLLsetsockopt
WS2_32.DLLsocket
offsetsizetypecomment
15c115HTM#
57447610106GIF(18759 x 14406)#
576bf0967696BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK