filenamecsscan.exe
size371200 (0x5aa00)
md5ef68c11146b39be46e6ccae3e66fbd85
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
110507272
125507271
1095072714
109403102
125403104
123403102
1235072719
10194
0048
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4e7dfa1a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x23
Magic0x20b
LinkerVersion8.0
SizeOfCode0x37800
SizeOfInitializedData0x22e00
SizeOfUninitializedData0
AddressOfEntryPoint0x29ba0
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x66000
SizeOfHeaders0x400
CheckSum0x5d6f6
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x3774e0x37800R-X CODE
.rdata0x390000x1d8a20x1da00R-- IDATA
.data0x570000x95d00x2c00RW- IDATA
.pdata0x610000x12300x1400R-- IDATA
.trace0x630000x11300x1200R-- IDATA
.rsrc0x650000x1b00x200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x556940xdc
RESOURCE0x650000x1b0
EXCEPTION0x610000x1230
SECURITY00
BASERELOC00
DEBUG0x396a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x390000x658
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13421252
module_namehintordfunction_name
oracommon11.dll709slsprom
oracommon11.dll743vsnupr
orageneric11.dll282OCIStringPtr
orageneric11.dll211OCIObjectGetAttr
orageneric11.dll212OCIObjectGetInd
orageneric11.dll136OCICollSize
orageneric11.dll132OCICollGetElem
orageneric11.dll284OCIStringSize
orageneric11.dll2524kgrdr2ec
orageneric11.dll2521kgrdec2r
orageneric11.dll230OCIObjectPin
orageneric11.dll299OCITypeByName
orageneric11.dll173OCINumberFromInt
orageneric11.dll199OCINumberToInt
orageneric11.dll300OCITypeByRef
oraclient11.dll73OCIBindByPos
oraclient11.dll364OCIParamGet
oraclient11.dll110OCIDescribeAny
oraclient11.dll71OCIBindArrayOfStruct
oraclient11.dll65OCIAttrGet
oraclient11.dll106OCIDefineArrayOfStruct
oraclient11.dll112OCIDescriptorFree
oraclient11.dll245OCILobGetLength
oraclient11.dll111OCIDescriptorAlloc
oraclient11.dll495OCITransCommit
oraclient11.dll107OCIDefineByPos
oraclient11.dll72OCIBindByName
oraclient11.dll128OCIErrorGet
oraclient11.dll174OCIHandleAlloc
oraclient11.dll125OCIEnvCreate
oraclient11.dll447OCISessionBegin
oraclient11.dll66OCIAttrSet
oraclient11.dll443OCIServerAttach
oraclient11.dll175OCIHandleFree
oraclient11.dll444OCIServerDetach
oraclient11.dll448OCISessionEnd
oraclient11.dll446OCIServerVersion
oraclient11.dll1146upicpr
oraclient11.dll455OCIStmtFetch
oraclient11.dll462OCIStmtSetPieceInfo
oraclient11.dll458OCIStmtGetPieceInfo
oraclient11.dll258OCILobRead2
oraclient11.dll257OCILobRead
oraclient11.dll454OCIStmtExecute
oraclient11.dll459OCIStmtPrepare
oraclient11.dll109OCIDefineObject
orancrypt11.dll92ztcegml
oranls11.dll348lxsTrnStr
oranls11.dll329lxsCmpStr
oranls11.dll248lxmfwdx
oranls11.dll287lxoSchPat
oranls11.dll280lxoCnvNumStrToInt
oranls11.dll243lxmcpen
oranls11.dll231lxlterm
oranls11.dll26lmsatrm
oranls11.dll107lxdsupid
oranls11.dll160lxhclrsave
oranls11.dll361lxsulen
oranls11.dll143lxgratio
oranls11.dll341lxsCpStr
oranls11.dll5lmsacbn
oranls11.dll7lmsacin
oranls11.dll150lxgu2t
oranls11.dll133lxgcnv
oranls11.dll148lxgt2u
oranls11.dll288lxoSkip
oranls11.dll187lxhnamemap
oranls11.dll186lxhname2id
oranls11.dll424slxcfrt
oranls11.dll303lxpendian
oranls11.dll217lxlfopn
oranls11.dll419slxcfct
oranls11.dll333lxsCntExc
oranls11.dll176lxhid2name
oranls11.dll159lxhci2h
oranls11.dll256lxmopen
oranls11.dll281lxoCpChar
oranls11.dll285lxoCvChar
oranls11.dll154lxhLaToId
oranls11.dll177lxhidtolang
oranls11.dll155lxhLangEnv
oranls11.dll203lxinitc
oranls11.dll229lxlinit
oranls11.dll404lxzinit
oranls11.dll331lxsCntChar
oranls11.dll262lxmspax
oranls11.dll158lxhchtoid
oranls11.dll162lxhcsn
oranls11.dll157lxhasc
oranls11.dll354lxscat
oranls11.dll9lmsagbf
oranls11.dll10lmsaicmt
oranls11.dll259lxmr2w
oranls11.dll273lxoCmpNStr
oracore11.dll2943sltsini
oracore11.dll2305lpminit
oracore11.dll2163lmmtophp
oracore11.dll2132lmmhpinit
oracore11.dll2395lrmini
oracore11.dll2398lrmpaa
oracore11.dll2386lrmgbv
oracore11.dll2391lrmgsp
oracore11.dll3022sltspin
oracore11.dll1615lcv42b
oracore11.dll2443lrmtrm
oracore11.dll2131lmmhpfree
oracore11.dll2331lpmterm
oracore11.dll3041sltster
oracore11.dll2388lrmgiv
oracore11.dll2118lmmfree
oracore11.dll2142lmmrealloc
oracore11.dll2134lmmmalloc
oracore11.dll2059lfiwr
oracore11.dll2020lfiflu
oracore11.dll2007lficls
oracore11.dll2040lfimknam
oracore11.dll2031lfilini
oracore11.dll2044lfiopn
oracore11.dll2048lfird
oracore11.dll3027sltspsinit
oracore11.dll3053sltstspawn
oracore11.dll3026sltspsdestroy
oracore11.dll3029sltspswait
oracore11.dll3028sltspspost
oracore11.dll3054sltsttr
oracore11.dll3011sltsmnr
oracore11.dll3047sltstiddestroy
oracore11.dll3010sltsmna
oracore11.dll3044sltstgi
oracore11.dll3048sltstidinit
oracore11.dll2488lstclo
oracore11.dll3063slzsetevar
orauts.dll65Sleep
orauts.dll38LoadLibraryA
orauts.dll25GetCurrentThreadId
MSVCR80.dll1347strtoul
MSVCR80.dll1192fgets
MSVCR80.dll1335strncmp
MSVCR80.dll1305setbuf
MSVCR80.dll146__iob_func
MSVCR80.dll1166atoi
MSVCR80.dll1314sprintf
MSVCR80.dll1373vsprintf
MSVCR80.dll1333strncat
MSVCR80.dll1336strncpy
MSVCR80.dll1281memset
MSVCR80.dll1277memcpy
MSVCR80.dll1287printf
MSVCR80.dll1343strtod
MSVCR80.dll1324strcmp
MSVCR80.dll231_amsg_exit
MSVCR80.dll144__getmainargs
MSVCR80.dll89__C_specific_handler
MSVCR80.dll85_XcptFilter
MSVCR80.dll331_exit
MSVCR80.dll254_cexit
MSVCR80.dll145__initenv
MSVCR80.dll471_initterm
MSVCR80.dll472_initterm_e
MSVCR80.dll270_configthreadlocale
MSVCR80.dll196__setusermatherr
MSVCR80.dll269_commode
MSVCR80.dll359_fmode
MSVCR80.dll316_encode_pointer
MSVCR80.dll193__set_app_type
MSVCR80.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR80.dll1339strpbrk
MSVCR80.dll942_unlock
MSVCR80.dll133__dllonexit
MSVCR80.dll1204fputs
MSVCR80.dll476_iob
MSVCR80.dll819_snprintf
MSVCR80.dll1323strchr
MSVCR80.dll1182exit
MSVCR80.dll322_errno
MSVCR80.dll306_decode_pointer
MSVCR80.dll749_onexit
MSVCR80.dll582_lock
orasnls11.dll25lxkSubstr
orasnls11.dll28lxkTrim
KERNEL32.dll246FormatMessageA
KERNEL32.dll671QueryPerformanceCounter
KERNEL32.dll481GetTickCount
KERNEL32.dll326GetCurrentProcessId
KERNEL32.dll460GetSystemTimeAsFileTime
KERNEL32.dll868TerminateProcess
KERNEL32.dll476GetThreadLocale
KERNEL32.dll325GetCurrentProcess
KERNEL32.dll884UnhandledExceptionFilter
KERNEL32.dll848SetUnhandledExceptionFilter
KERNEL32.dll720RtlCaptureContext
KERNEL32.dll727RtlLookupFunctionEntry
KERNEL32.dll734RtlVirtualUnwind
offsetsizetypecomment
15c115HTM#
15d0365616BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK