filenameGolem.exe
size1473536 (0x167c00)
md5f60bf6f7a7e2978cb77c6c74e0d17ef3
typePE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xb
TimeDateStamp0x5f29311e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22f
Magic0x20b
LinkerVersion2.35
SizeOfCode0x109200
SizeOfInitializedData0x167800
SizeOfUninitializedData0x1a00
AddressOfEntryPoint0x14f0
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x170000
SizeOfHeaders0x400
CheckSum0x17638d
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1090f00x109200R-X CODE IDATA
.data0x10b0000x3d700x3e00RW- IDATA
.rdata0x10f0000x194a00x19600R-- IDATA
.eh_fram0x12900040x200RW- IDATA
.pdata0x12a0000xe6d00xe800R-- IDATA
.xdata0x1390000x16f900x17000R-- IDATA
.bss0x1500000x18e00RW- UDATA
.idata0x1520000x25f80x2600RW- IDATA
.CRT0x1550000x700x200RW- IDATA
.tls0x1560000x100x200RW- IDATA
.rsrc0x1570000x18de00x18e00RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1520000x25f8
RESOURCE0x1570000x18de0
EXCEPTION0x12a0000xe6d0
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x1182e00x28
LOAD_CONFIG00
Bound_IAT00
IAT0x1529240x870
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x5560000x5560080x55099c0x55504000
typenamesizecp
ICON#111280
ICON#242640
ICON#396400
ICON#4169360
ICON#5676240
GROUP_ICON#100760
MANIFEST#117540
module_namehintordfunction_name
ADVAPI32.dll1238DeregisterEventSource
ADVAPI32.dll1687RegisterEventSourceW
ADVAPI32.dll1705ReportEventW
GDI32.dll1094CreateRectRgnIndirect
GDI32.dll1099CreateSolidBrush
GDI32.dll1376FillRgn
GDI32.dll1582GetStockObject
GDI32.dll1738SelectObject
GDI32.dll1745SetBkColor
GDI32.dll1803TextOutA
KERNEL32.dll20AddVectoredExceptionHandler
KERNEL32.dll141CloseHandle
KERNEL32.dll190CreateDirectoryA
KERNEL32.dll197CreateEventA
KERNEL32.dll200CreateEventW
KERNEL32.dll217CreateIoCompletionPort
KERNEL32.dll243CreateSemaphoreA
KERNEL32.dll283DeleteCriticalSection
KERNEL32.dll285DeleteFileA
KERNEL32.dll313DuplicateHandle
KERNEL32.dll319EnterCriticalSection
KERNEL32.dll366ExitProcess
KERNEL32.dll378FileTimeToSystemTime
KERNEL32.dll438FormatMessageA
KERNEL32.dll439FormatMessageW
KERNEL32.dll443FreeLibrary
KERNEL32.dll545GetCurrentDirectoryA
KERNEL32.dll552GetCurrentProcess
KERNEL32.dll553GetCurrentProcessId
KERNEL32.dll556GetCurrentThread
KERNEL32.dll557GetCurrentThreadId
KERNEL32.dll589GetEnvironmentVariableW
KERNEL32.dll612GetFileType
KERNEL32.dll627GetHandleInformation
KERNEL32.dll630GetLastError
KERNEL32.dll649GetModuleFileNameA
KERNEL32.dll651GetModuleHandleA
KERNEL32.dll654GetModuleHandleW
KERNEL32.dll710GetProcAddress
KERNEL32.dll711GetProcessAffinityMask
KERNEL32.dll726GetProcessTimes
KERNEL32.dll738GetQueuedCompletionStatus
KERNEL32.dll744GetStartupInfoW
KERNEL32.dll746GetStdHandle
KERNEL32.dll768GetSystemTimeAdjustment
KERNEL32.dll769GetSystemTimeAsFileTime
KERNEL32.dll783GetThreadContext
KERNEL32.dll793GetThreadPriority
KERNEL32.dll797GetThreadTimes
KERNEL32.dll799GetTickCount
KERNEL32.dll819GetVersion
KERNEL32.dll892InitializeCriticalSection
KERNEL32.dll893InitializeCriticalSectionAndSpinCount
KERNEL32.dll919IsDBCSLeadByteEx
KERNEL32.dll920IsDebuggerPresent
KERNEL32.dll984LeaveCriticalSection
KERNEL32.dll988LoadLibraryA
KERNEL32.dll991LoadLibraryW
KERNEL32.dll1002LocalFree
KERNEL32.dll1028MoveFileExA
KERNEL32.dll1036MultiByteToWideChar
KERNEL32.dll1069OpenProcess
KERNEL32.dll1078OutputDebugStringA
KERNEL32.dll1089PostQueuedCompletionStatus
KERNEL32.dll1131QueryPerformanceCounter
KERNEL32.dll1132QueryPerformanceFrequency
KERNEL32.dll1141QueueUserAPC
KERNEL32.dll1153RaiseException
KERNEL32.dll1196ReleaseSemaphore
KERNEL32.dll1207RemoveVectoredExceptionHandler
KERNEL32.dll1214ResetEvent
KERNEL32.dll1221ResumeThread
KERNEL32.dll1222RtlAddFunctionTable
KERNEL32.dll1223RtlCaptureContext
KERNEL32.dll1230RtlLookupFunctionEntry
KERNEL32.dll1236RtlUnwindEx
KERNEL32.dll1237RtlVirtualUnwind
KERNEL32.dll1292SetCurrentDirectoryA
KERNEL32.dll1306SetEvent
KERNEL32.dll1334SetLastError
KERNEL32.dll1345SetProcessAffinityMask
KERNEL32.dll1362SetSystemTime
KERNEL32.dll1368SetThreadContext
KERNEL32.dll1378SetThreadPriority
KERNEL32.dll1394SetUnhandledExceptionFilter
KERNEL32.dll1403SetWaitableTimer
KERNEL32.dll1410Sleep
KERNEL32.dll1413SleepEx
KERNEL32.dll1418SuspendThread
KERNEL32.dll1425TerminateProcess
KERNEL32.dll1426TerminateThread
KERNEL32.dll1443TlsAlloc
KERNEL32.dll1444TlsFree
KERNEL32.dll1445TlsGetValue
KERNEL32.dll1446TlsSetValue
KERNEL32.dll1452TryEnterCriticalSection
KERNEL32.dll1459UnhandledExceptionFilter
KERNEL32.dll1481VerSetConditionMask
KERNEL32.dll1485VerifyVersionInfoW
KERNEL32.dll1492VirtualProtect
KERNEL32.dll1494VirtualQuery
KERNEL32.dll1501WaitForMultipleObjects
KERNEL32.dll1503WaitForSingleObject
KERNEL32.dll1550WideCharToMultiByte
KERNEL32.dll1570WriteFile
msvcrt.dll56__C_specific_handler
msvcrt.dll64___lc_codepage_func
msvcrt.dll67___mb_cur_max_func
msvcrt.dll80__doserrno
msvcrt.dll84__iob_func
msvcrt.dll91__lconv_init
msvcrt.dll97__set_app_type
msvcrt.dll99__setusermatherr
msvcrt.dll110__wgetmainargs
msvcrt.dll111__winitenv
msvcrt.dll121_amsg_exit
msvcrt.dll135_beginthreadex
msvcrt.dll139_cexit
msvcrt.dll187_endthreadex
msvcrt.dll190_errno
msvcrt.dll199_exit
msvcrt.dll210_filelengthi64
msvcrt.dll211_fileno
msvcrt.dll221_fmode
msvcrt.dll235_fstat64
msvcrt.dll286_initterm
msvcrt.dll388_lock
msvcrt.dll397_lseeki64
msvcrt.dll554_onexit
msvcrt.dll599_setjmp
msvcrt.dll659_strnicmp
msvcrt.dll706_ultoa
msvcrt.dll715_unlock
msvcrt.dll745_vsnprintf
msvcrt.dll751_vsnwprintf
msvcrt.dll774_wcmdln
msvcrt.dll831_wfopen
msvcrt.dll902abort
msvcrt.dll914atof
msvcrt.dll919calloc
msvcrt.dll932exit
msvcrt.dll936fclose
msvcrt.dll939fflush
msvcrt.dll941fgetpos
msvcrt.dll949fopen
msvcrt.dll951fprintf
msvcrt.dll953fputc
msvcrt.dll954fputs
msvcrt.dll957fread
msvcrt.dll958free
msvcrt.dll965fsetpos
msvcrt.dll970fwrite
msvcrt.dll973getc
msvcrt.dll975getenv
msvcrt.dll978getwc
msvcrt.dll991isspace
msvcrt.dll997iswctype
msvcrt.dll1010localeconv
msvcrt.dll1016malloc
msvcrt.dll1022memchr
msvcrt.dll1023memcmp
msvcrt.dll1024memcpy
msvcrt.dll1025memmove
msvcrt.dll1026memset
msvcrt.dll1033printf
msvcrt.dll1035putc
msvcrt.dll1038putwc
msvcrt.dll1042raise
msvcrt.dll1043rand
msvcrt.dll1044realloc
msvcrt.dll1052setlocale
msvcrt.dll1053setvbuf
msvcrt.dll1054signal
msvcrt.dll1059sprintf
msvcrt.dll1067strchr
msvcrt.dll1068strcmp
msvcrt.dll1069strcoll
msvcrt.dll1070strcpy
msvcrt.dll1073strerror
msvcrt.dll1074strftime
msvcrt.dll1075strlen
msvcrt.dll1078strncmp
msvcrt.dll1079strncpy
msvcrt.dll1084strstr
msvcrt.dll1090strxfrm
msvcrt.dll1103tolower
msvcrt.dll1104toupper
msvcrt.dll1105towlower
msvcrt.dll1106towupper
msvcrt.dll1107ungetc
msvcrt.dll1108ungetwc
msvcrt.dll1109vfprintf
msvcrt.dll1123wcscoll
msvcrt.dll1127wcsftime
msvcrt.dll1128wcslen
msvcrt.dll1139wcsstr
msvcrt.dll1147wcsxfrm
msvcrt.dll1185longjmp
msvcrt.dll1197_write
msvcrt.dll1224_strdup
msvcrt.dll1239_read
msvcrt.dll1266_fileno
msvcrt.dll1270_fdopen
msvcrt.dll1286_close
SHELL32.dll338ShellExecuteExA
SHELL32.dll350Shell_NotifyIconA
USER32.dll17BeginPaint
USER32.dll115CreateWindowExA
USER32.dll165DefWindowProcW
USER32.dll177DestroyWindow
USER32.dll186DispatchMessageW
USER32.dll241EndPaint
USER32.dll304GetClientRect
USER32.dll318GetCursorPos
USER32.dll384GetMessageW
USER32.dll386GetMonitorInfoW
USER32.dll417GetProcessWindowStation
USER32.dll456GetUserObjectInformationW
USER32.dll471GetWindowLongPtrW
USER32.dll522InvalidateRect
USER32.dll558IsWindow
USER32.dll568KillTimer
USER32.dll576LoadCursorW
USER32.dll578LoadIconW
USER32.dll613MessageBoxA
USER32.dll620MessageBoxW
USER32.dll623MonitorFromPoint
USER32.dll651PeekMessageW
USER32.dll658PostThreadMessageW
USER32.dll696RegisterClassA
USER32.dll754SendMessageW
USER32.dll816SetRect
USER32.dll832SetTimer
USER32.dll845SetWindowLongPtrW
USER32.dll865ShowWindow
USER32.dll881SystemParametersInfoW
USER32.dll897TranslateMessage
USER32.dll934ValidateRect
WS2_32.dll73WSARecv
WS2_32.dll78WSASend
WS2_32.dll88WSASocketW
WS2_32.dll90WSAStringToAddressA
WS2_32.dll166freeaddrinfo
WS2_32.dll167getaddrinfo
WSOCK32.dll1AcceptEx
WSOCK32.dll4GetAcceptExSockaddrs
WSOCK32.dll28WSACleanup
WSOCK32.dll29WSAGetLastError
WSOCK32.dll33WSASetLastError
WSOCK32.dll34WSAStartup
WSOCK32.dll39bind
WSOCK32.dll40closesocket
WSOCK32.dll41connect
WSOCK32.dll53getsockopt
WSOCK32.dll54htonl
WSOCK32.dll55htons
WSOCK32.dll59ioctlsocket
WSOCK32.dll60listen
WSOCK32.dll61ntohl
WSOCK32.dll69select
WSOCK32.dll73setsockopt
WSOCK32.dll74shutdown
offsetsizetypecomment
15c115HTM#
15d01467952BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x15099c