wasaxp.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	wasaxp.exe
size	310635 (0x4bd6b)
md5	f057a2c38ab8890c943553c3a1263402

type	PE32 executable (console) Alpha, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x80
blocks_in_file	1
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x88

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 69 73 20 61 20  57 69 6e 64 6f 77 73 20  |is is a Windows |
00000020: 4e 54 28 41 58 50 29 20  63 68 61 72 61 63 74 65  |NT(AXP) characte|
00000030: 72 2d 6d 6f 64 65 20 65  78 65 63 75 74 61 62 6c  |r-mode executabl|
00000040: 65 0d 0a 24 00 00 00 00                           |e..$....        |

PE Header

Signature	PE
Machine	0x184
NumberOfSections	4
TimeDateStamp	0x4f416cb2
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x182
Magic	0x10b
LinkerVersion	2.18
SizeOfCode	0x3c200
SizeOfInitializedData	0xae00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x384d0
BaseOfCode	0x10000
BaseOfData	0x50000
ImageBase	0x400000
SectionAlignment	0x10000
FileAlignment	0x200
OperatingSystemVersion	1.11
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x90000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x1000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x2000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
AUTO	0x10000	0x3c0d8	0x3c200	R-X CODE
.idata	0x50000	0x51a	0x600	RW- IDATA
DGROUP	0x60000	0x12764	0xa800	RW- IDATA
.reloc	0x80000	0	0x3800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x50000	0x51a
RESOURCE	0	0
EXCEPTION	0x664c0	0x4150
SECURITY	0	0
BASERELOC	0x80000	0x3658
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
USER32.DLL	1	CharUpperA
KERNEL32.dll	1	CloseHandle
KERNEL32.dll	2	CreateEventA
KERNEL32.dll	3	CreateFileA
KERNEL32.dll	4	DeleteFileA
KERNEL32.dll	5	ExitProcess
KERNEL32.dll	6	FindClose
KERNEL32.dll	7	FindFirstFileA
KERNEL32.dll	8	FlushFileBuffers
KERNEL32.dll	9	FreeEnvironmentStringsA
KERNEL32.dll	10	GetACP
KERNEL32.dll	11	GetCPInfo
KERNEL32.dll	12	GetCommandLineA
KERNEL32.dll	13	GetCommandLineW
KERNEL32.dll	14	GetCurrentThreadId
KERNEL32.dll	15	GetEnvironmentStringsA
KERNEL32.dll	16	GetFileAttributesA
KERNEL32.dll	17	GetFileType
KERNEL32.dll	18	GetLastError
KERNEL32.dll	19	GetLocalTime
KERNEL32.dll	20	GetModuleFileNameA
KERNEL32.dll	21	GetModuleFileNameW
KERNEL32.dll	22	GetModuleHandleA
KERNEL32.dll	23	GetOEMCP
KERNEL32.dll	24	GetProcAddress
KERNEL32.dll	25	GetStdHandle
KERNEL32.dll	26	GetTimeZoneInformation
KERNEL32.dll	27	GetVersion
KERNEL32.dll	28	LoadLibraryA
KERNEL32.dll	29	MultiByteToWideChar
KERNEL32.dll	30	ReadFile
KERNEL32.dll	31	RtlLookupFunctionEntry
KERNEL32.dll	32	RtlUnwindRfp
KERNEL32.dll	33	RtlUnwind
KERNEL32.dll	34	SetConsoleCtrlHandler
KERNEL32.dll	35	SetEnvironmentVariableA
KERNEL32.dll	36	SetEnvironmentVariableW
KERNEL32.dll	37	SetFilePointer
KERNEL32.dll	38	SetStdHandle
KERNEL32.dll	39	SetUnhandledExceptionFilter
KERNEL32.dll	40	UnhandledExceptionFilter
KERNEL32.dll	41	VirtualAlloc
KERNEL32.dll	42	VirtualFree
KERNEL32.dll	43	VirtualQuery
KERNEL32.dll	44	WideCharToMultiByte
KERNEL32.dll	45	WriteFile

show previews

offset	size	type	comment
0	306176	EXE	02/19/2012 21:42:10	#
15c1	15	HTM		#
4ac00	4459	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 310635 bytes (304 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK