filenamex64Test.exe
size30208 (0x7600)
md5fa6c4a2b7eae7ca3b3bee03bd074c509
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
147307293
150204132
1313072920
123507272
1060
1323072912
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x52de0caf
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3a00
SizeOfInitializedData0x3e00
SizeOfUninitializedData0
AddressOfEntryPoint0x11087
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000x39930x3a00R-X CODE
.rdata0x150000x1e190x2000R-- IDATA
.data0x170000x64c0x200RW- IDATA
.idata0x180000x92b0xa00RW- IDATA
.rsrc0x190000x58c0x600R-- IDATA
.reloc0x1a0000x4ed0x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x180000x3c
RESOURCE0x190000x58c
EXCEPTION00
SECURITY00
BASERELOC0x1a0000x35c
DEBUG0x157200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x181b00x174
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#16630
module_namehintordfunction_name
MSVCR90D.dll581_invoke_watson
MSVCR90D.dll1060_unlock
MSVCR90D.dll186__dllonexit
MSVCR90D.dll368_controlfp_s
MSVCR90D.dll856_onexit
MSVCR90D.dll404_decode_pointer
MSVCR90D.dll424_except_handler4_common
MSVCR90D.dll383_crt_debugger_hook
MSVCR90D.dll57public: void __thiscall type_info::_type_info_dtor_internal_method(void)

?_type_info_dtor_internal_method@type_info@@QAEXXZ

MSVCR90D.dll71void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90D.dll576_initterm_e
MSVCR90D.dll575_initterm
MSVCR90D.dll97_CrtDbgReportW
MSVCR90D.dll114_CrtSetCheckCount
MSVCR90D.dll287__winitenv
MSVCR90D.dll1296exit
MSVCR90D.dll347_cexit
MSVCR90D.dll138_XcptFilter
MSVCR90D.dll433_exit
MSVCR90D.dll286__wgetmainargs
MSVCR90D.dll324_amsg_exit
MSVCR90D.dll263__set_app_type
MSVCR90D.dll415_encode_pointer
MSVCR90D.dll246__p__fmode
MSVCR90D.dll239__p__commode
MSVCR90D.dll306_adjust_fdiv
MSVCR90D.dll266__setusermatherr
MSVCR90D.dll365_configthreadlocale
MSVCR90D.dll19void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCR90D.dll92_CRT_RTC_INITW
MSVCR90D.dll176__clean_type_info_names_internal
MSVCR90D.dll47public: char const * __thiscall type_info::_name_internal_method(struct __type_info_node *)const

?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z

MSVCR90D.dll688_lock
MSVCR90D.dll1394printf
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1069TerminateProcess
KERNEL32.dll332FreeLibrary
KERNEL32.dll1116VirtualQuery
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll547GetProcessHeap
KERNEL32.dll669HeapAlloc
KERNEL32.dll673HeapFree
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll753LoadLibraryA
KERNEL32.dll544GetProcAddress
KERNEL32.dll1205lstrlenA
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll180DebugBreak
KERNEL32.dll858RaiseException
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll1057Sleep
KERNEL32.dll701InterlockedExchange
KERNEL32.dll1086UnhandledExceptionFilter
offsetsizetypecomment
030208EXE01/21/2014 05:59:11#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK