filenamehelloworld.exe
size4831766 (0x49ba16)
md5f078c6e7974bac8c41b253b213e72e62
typePE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0
PointerToSymbolTable0x22000
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x32f
Magic0x10b
LinkerVersion2.29
SizeOfCode0xa800
SizeOfInitializedData0x22000
SizeOfUninitializedData0x9800
AddressOfEntryPoint0x1510
BaseOfCode0x1000
BaseOfData0xc000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x31000
SizeOfHeaders0x400
CheckSum0x27ed2
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xa7c40xa800R-X CODE IDATA
.data0xc0000x380x200RW- IDATA
.rdata0xd0000x4c5c0x4e00R-- IDATA
/40x120000x25b80x2600R-- IDATA
.bss0x150000x96200RW- UDATA
.idata0x1f0000xc940xe00RW- IDATA
.CRT0x200000x340x200RW- IDATA
.tls0x210000x200x200RW- IDATA
.rsrc0x220000xef700xf000RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1f0000xc94
RESOURCE0x220000xef70
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x210040x18
LOAD_CONFIG00
Bound_IAT00
IAT0x1f23c0x1d8
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4210000x42101c0x41e5b00x42002000
typenamesizecp
ICON#137521252
ICON#222161252
ICON#313841252
ICON#4370191252
ICON#596401252
ICON#642641252
ICON#711281252
GROUP_ICON#1011041252
MANIFEST#112681252
module_namehintordfunction_name
ADVAPI32.dll1114ConvertStringSecurityDescriptorToSecurityDescriptorW
KERNEL32.dll132CreateDirectoryW
KERNEL32.dll172CreateProcessW
KERNEL32.dll213DeleteCriticalSection
KERNEL32.dll241EnterCriticalSection
KERNEL32.dll288ExpandEnvironmentStringsW
KERNEL32.dll354FormatMessageW
KERNEL32.dll358FreeLibrary
KERNEL32.dll397GetCommandLineW
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll482GetEnvironmentVariableW
KERNEL32.dll484GetExitCodeProcess
KERNEL32.dll517GetLastError
KERNEL32.dll534GetModuleFileNameW
KERNEL32.dll535GetModuleHandleA
KERNEL32.dll583GetProcAddress
KERNEL32.dll615GetStartupInfoW
KERNEL32.dll637GetSystemTimeAsFileTime
KERNEL32.dll650GetTempPathW
KERNEL32.dll665GetTickCount
KERNEL32.dll749InitializeCriticalSection
KERNEL32.dll808LeaveCriticalSection
KERNEL32.dll811LoadLibraryA
KERNEL32.dll813LoadLibraryExW
KERNEL32.dll855MultiByteToWideChar
KERNEL32.dll920QueryPerformanceCounter
KERNEL32.dll1051SetDllDirectoryW
KERNEL32.dll1057SetEnvironmentVariableW
KERNEL32.dll1133SetUnhandledExceptionFilter
KERNEL32.dll1146Sleep
KERNEL32.dll1160TerminateProcess
KERNEL32.dll1167TlsGetValue
KERNEL32.dll1180UnhandledExceptionFilter
KERNEL32.dll1212VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1224WaitForSingleObject
KERNEL32.dll1248WideCharToMultiByte
msvcrt.dll46__argc
msvcrt.dll56__dllonexit
msvcrt.dll69__lconv_init
msvcrt.dll105__set_app_type
msvcrt.dll108__setusermatherr
msvcrt.dll117__wargv
msvcrt.dll119__wgetmainargs
msvcrt.dll120__winitenv
msvcrt.dll145_amsg_exit
msvcrt.dll162_cexit
msvcrt.dll260_findclose
msvcrt.dll258_fileno
msvcrt.dll276_fmode
msvcrt.dll300_fullpath
msvcrt.dll313_get_osfhandle
msvcrt.dll330_getpid
msvcrt.dll352_initterm
msvcrt.dll356_iob
msvcrt.dll462_lock
msvcrt.dll628_onexit
msvcrt.dll695_setmode
msvcrt.dll745_stat
msvcrt.dll762_strdup
msvcrt.dll843_unlock
msvcrt.dll873_vsnprintf
msvcrt.dll880_vsnwprintf
msvcrt.dll902_wcmdln
msvcrt.dll967_wfindfirst
msvcrt.dll974_wfindnext
msvcrt.dll976_wfopen
msvcrt.dll1006_wputenv_s
msvcrt.dll1007_wremove
msvcrt.dll1010_wrmdir
msvcrt.dll1030_wstat
msvcrt.dll1036_wtempnam
msvcrt.dll1052abort
msvcrt.dll1069calloc
msvcrt.dll1071clearerr
msvcrt.dll1080exit
msvcrt.dll1083fclose
msvcrt.dll1084feof
msvcrt.dll1085ferror
msvcrt.dll1086fflush
msvcrt.dll1096fprintf
msvcrt.dll1099fputs
msvcrt.dll1102fread
msvcrt.dll1103free
msvcrt.dll1109fseek
msvcrt.dll1111ftell
msvcrt.dll1115fwrite
msvcrt.dll1162malloc
msvcrt.dll1165mbstowcs
msvcrt.dll1172memcpy
msvcrt.dll1176perror
msvcrt.dll1189realloc
msvcrt.dll1195setbuf
msvcrt.dll1196setlocale
msvcrt.dll1198signal
msvcrt.dll1201sprintf
msvcrt.dll1206strcat
msvcrt.dll1208strchr
msvcrt.dll1209strcmp
msvcrt.dll1211strcpy
msvcrt.dll1216strlen
msvcrt.dll1217strncat
msvcrt.dll1219strncmp
msvcrt.dll1220strncpy
msvcrt.dll1227strtok
msvcrt.dll1252vfprintf
msvcrt.dll1265wcscat
msvcrt.dll1268wcscmp
msvcrt.dll1270wcscpy
msvcrt.dll1274wcslen
msvcrt.dll1290wcstombs
WS2_32.dll158ntohl
offsetsizetypecomment
0140288EXE01/01/1970 00:00:00#
15c115HTM#
152c037019PNG(256 x 256)#
224004691478BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 4831766 bytes (4719 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x1e5b0