filenamepython.exe
size27136 (0x6a00)
md5f730d2853b86116f72130bfe34fed474
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
132210222
147210225
147307292
1030
1312102215
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4c301fa5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x23
Magic0x20b
LinkerVersion9.0
SizeOfCode0x800
SizeOfInitializedData0x5e00
SizeOfUninitializedData0
AddressOfEntryPoint0x1354
BaseOfCode0x1000
ImageBase0x1d000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0xd4b2
Subsystem3
DllCharacteristics0x8000
SizeOfStackReserve0x1e8480
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x7810x800R-X CODE
.rdata0x20000x6080x800R-- IDATA
.data0x30000x800x200RW- IDATA
.pdata0x40000xb40x200R-- IDATA
.rsrc0x50000x51a00x5200R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x22b00x50
RESOURCE0x50000x51a0
EXCEPTION0x40000xb4
SECURITY00
BASERELOC00
DEBUG0x21400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x20000x108
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17441252
ICON#22961252
ICON#322161252
ICON#413841252
ICON#596401252
ICON#642641252
ICON#711281252
GROUP_ICON#11041252
MANIFEST#16001252
module_namehintordfunction_name
python27.dll859Py_Main
MSVCR90.dll1169exit
MSVCR90.dll145__initenv
MSVCR90.dll462_initterm
MSVCR90.dll463_initterm_e
MSVCR90.dll265_configthreadlocale
MSVCR90.dll191__setusermatherr
MSVCR90.dll264_commode
MSVCR90.dll249_cexit
MSVCR90.dll311_encode_pointer
MSVCR90.dll188__set_app_type
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll932_unlock
MSVCR90.dll133__dllonexit
MSVCR90.dll573_lock
MSVCR90.dll740_onexit
MSVCR90.dll301_decode_pointer
MSVCR90.dll326_exit
MSVCR90.dll85_XcptFilter
MSVCR90.dll89__C_specific_handler
MSVCR90.dll144__getmainargs
MSVCR90.dll226_amsg_exit
MSVCR90.dll354_fmode
KERNEL32.dll639GetSystemTimeAsFileTime
KERNEL32.dll457GetCurrentThreadId
KERNEL32.dll665GetTickCount
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll1155SetUnhandledExceptionFilter
KERNEL32.dll1168Sleep
KERNEL32.dll453GetCurrentProcessId
offsetsizetypecomment
15c115HTM#
15d021552BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK