iam.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	iam.exe
size	61440 (0xf000)
md5	fc24babef9f727b4d6389bda8c5a6d6a

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
96	3077	2
15	3077	17
93	2179	7
1	0	76
95	3077	79
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x486bc2aa
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0xa000
SizeOfInitializedData	0x6000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4532
BaseOfCode	0x1000
BaseOfData	0xb000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x11000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x9172	0xa000	R-X CODE
.rdata	0xb000	0x153e	0x2000	R-- IDATA
.data	0xd000	0x31b8	0x2000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xbe18	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xbdb0	0x48
Bound_IAT	0	0
IAT	0xb000	0x138
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
VERSION.dll	1	GetFileVersionInfoSizeA
VERSION.dll		GetFileVersionInfoA
VERSION.dll	10	VerQueryValueA
ADVAPI32.dll	281	GetTokenInformation
ADVAPI32.dll	333	LookupPrivilegeValueA
ADVAPI32.dll	28	AdjustTokenPrivileges
ADVAPI32.dll	426	OpenProcessToken
KERNEL32.dll	570	LCMapStringA
KERNEL32.dll	571	LCMapStringW
KERNEL32.dll	681	ReadFile
KERNEL32.dll	46	CloseHandle
KERNEL32.dll	847	TerminateProcess
KERNEL32.dll	619	MultiByteToWideChar
KERNEL32.dll	408	GetProcAddress
KERNEL32.dll	584	LoadLibraryA
KERNEL32.dll	652	Process32Next
KERNEL32.dll	650	Process32First
KERNEL32.dll	108	CreateToolhelp32Snapshot
KERNEL32.dll	314	GetCurrentProcess
KERNEL32.dll	450	GetSystemWindowsDirectoryA
KERNEL32.dll	342	GetFileAttributesA
KERNEL32.dll	887	VirtualFreeEx
KERNEL32.dll	899	WaitForSingleObject
KERNEL32.dll	100	CreateRemoteThread
KERNEL32.dll	925	WriteProcessMemory
KERNEL32.dll	884	VirtualAllocEx
KERNEL32.dll	373	GetModuleFileNameA
KERNEL32.dll	634	OpenProcess
KERNEL32.dll	553	IsBadReadPtr
KERNEL32.dll	524	HeapFree
KERNEL32.dll	518	HeapAlloc
KERNEL32.dll	175	ExitProcess
KERNEL32.dll	375	GetModuleHandleA
KERNEL32.dll	264	GetCommandLineA
KERNEL32.dll	479	GetVersionExA
KERNEL32.dll	522	HeapDestroy
KERNEL32.dll	520	HeapCreate
KERNEL32.dll	886	VirtualFree
KERNEL32.dll	883	VirtualAlloc
KERNEL32.dll	528	HeapReAlloc
KERNEL32.dll	791	SetHandleCount
KERNEL32.dll	433	GetStdHandle
KERNEL32.dll	350	GetFileType
KERNEL32.dll	431	GetStartupInfoA
KERNEL32.dll	903	WideCharToMultiByte
KERNEL32.dll	916	WriteFile
KERNEL32.dll	864	UnhandledExceptionFilter
KERNEL32.dll	237	FreeEnvironmentStringsA
KERNEL32.dll	333	GetEnvironmentStrings
KERNEL32.dll	238	FreeEnvironmentStringsW
KERNEL32.dll	361	GetLastError
KERNEL32.dll	335	GetEnvironmentStringsW
KERNEL32.dll	530	HeapSize
KERNEL32.dll	434	GetStringTypeA
KERNEL32.dll	437	GetStringTypeW
KERNEL32.dll	663	QueryPerformanceCounter
KERNEL32.dll	469	GetTickCount
KERNEL32.dll	318	GetCurrentThreadId
KERNEL32.dll	315	GetCurrentProcessId
KERNEL32.dll	448	GetSystemTimeAsFileTime
KERNEL32.dll	782	SetFilePointer
KERNEL32.dll	889	VirtualProtect
KERNEL32.dll	443	GetSystemInfo
KERNEL32.dll	891	VirtualQuery
KERNEL32.dll	229	FlushFileBuffers
KERNEL32.dll	52	CompareStringA
KERNEL32.dll	252	GetCPInfo
KERNEL32.dll	53	CompareStringW
KERNEL32.dll	245	GetACP
KERNEL32.dll	395	GetOEMCP
KERNEL32.dll	774	SetEnvironmentVariableA
KERNEL32.dll	714	RtlUnwind
KERNEL32.dll	543	InterlockedExchange
KERNEL32.dll	364	GetLocaleInfoA
KERNEL32.dll	810	SetStdHandle

show previews

offset	size	type	comment
0	61440	EXE	07/02/2008 18:02:18	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK