hex relative absolute shared clean self-modifying nameless checksum-valid checksum-invalid address-space-layout-randomization (ASLR) code-integrity data-execution-prevention (DEP) image-isolation structured-exception-handling (SEH) image-bound windows-driver-model (WDM) terminal-server-aware low Non-Portable Executable Certificate exist tls-callbacks Exceptions Handler usage Empty score 32 bit Images 64 bit Images Select a file to open Exe files (*.exe)|*.exe|Dll files (*.dll)|*.dll|Sys files (*.sys)|*.sys|All Files (*.*)|*.*|| failure Images (%i of %i) The image is not Portable Executable highest administrator invoker trust-info-missing virustotal internet connection failed the file has not been found in the repository wait... please enable the virustotal submission positives disabled scan-id resource response-code scan-date permanent-link verbose engines detections sha1 sha256 md5 details result engine virustotal header results signature exports analysis ordinal available gap forwarded entry-point xml-id symbol gaps address hint offline imphash Network: online bl n/a callback 32 64 map severity detection date (dd.mm.yyyy) age (days) not-supported - x directory directories obfuscated level raw-address size (bytes) location (address) invalid empty missing TimeDateStamp libraries library type file-version image-base imports CPU mismatch type cpu all implicit delay-loaded application blacklist description Imported Library bound types created undocumented 16bytes symbol section:offset library whitelist deprecated anti-debug imports registries urls messages Tables control-flow-guard (CFG) delay-loaded strings-tables manifest certificates elevated unsafe top list begin end item score address (begin) address (end) address (unwind) expired file duplicated property value detail status headers image error overview date %.2i/%.2i/%.4i time-stamp %.2i:%.2i:%.2i import network error strings string footprints overlay ascii unicode file-header-offset file-version groups not found processor-32bit relocation-stripped large-address-aware uniprocessor system-image dynamic-link-library executable debug-stripped media-run-from-swap network-run-from-swap properties gp group location exceptions start end data-begin data-end callback standard exception %s not found run-from-swap color-text md5 certificate resources type instance size offset code-page language manifest assemblies assembly name non-standard version token total count raw_data version file-type file-subtype file-os index first-bytes-hex first-bytes-text suspicious score-file score-file-details r g b settings dump into file... md5-without-overlay sha1-without-overlay sha256-without-overlay 32-bit 64-bit size-without-overlay location (section) trustInfo execution file-offset file-offset-from file-offset-to true false level uiAccess code-less language rich-header-checksum character-set items item name value rich-header signature-offset dos-stub PE00 autoElevate virtualized file-size unreachable mitre-tactic mitre-technique dos-header mitre file-signature pe-offset build-id product-id IDE version rich-hash checksum checksum-computed certificate-stamp version-stamp exports-stamp resources-stamp stamp debugger-stamp e_lfanew checksum-builtin relocations file-header machine sections compiler-stamp pointer-symbol-table number-of-symbols size-of-optional-header characteristics e_magic file files debug relocations optional-header magic linker-version control-flow-guard size-of-code size-of-initialized-data size-of-uninitialized-data base-of-code base-of-data image-base section-alignment file-alignment os-version enable image-version subsystem-version windows-driver-model Win32VersionValue size-of-image size-of-headers file-checksum subsystem DllCharacteristics address-space-layout-randomization data-execution-prevention structured-exception-handling real-checksum threshold size-of-stack-reserve size-of-stack-commit size-of-heap-reserve size-of-heap-commit LoaderFlags directories-number pdb message warning Signer Counter-signer Email Street Postal code valid-from valid-to organization serial-number CRL-Distribution-Point Signing Time Dump PKCS7 FileMajorVersion FileMinorVersion FileVersionBuildNumber FileVersionRevisionNumber VarFileInfo LanguageId CodePage export file-ratio export-file-name executables debugs debug guid %.4X-%2.X-%2.X-%1X%1X-%1X%1X%1X%1X%1X%1X age RSDS Nb09 Nb10 Nb11 format path managed BoundImports BoundImport BoundImportDate type size linker version none entropy sections name virtual-size virtual-address raw-size raw-address file-cave contains characteristics blacklisted obfuscated readable writable executable shareable unreadable md5 section PointerToRelocations PointerToLinenumbers NumberOfRelocations NumberOfLinenumbers characteristics sections ExecutableCode initialized-data uninitialized-data discardable shareable executable readable writable discardable cachable indicators indicator pageable initialized-data uninitialized-data The quota has been reached. unknown MS-DOS Windows NT Windows 16-bit Windows 32-bit OS/2 16-bit OS/2 32-bit PM-16-bit PM-32-bit Unknown executable dynamic-link library device-driver font static-link library virtual-device unknown Communication-driver Display-driver Installable-driver Keyboard-driver Language-driver Mouse driver Network-driver Printer-driver Sound-driver System-driver Printer-driver Unknown-Driver dos-header dos-stub file-header rich-header library import export export-file-name resource manifest pdb version certificate overlay unknown absolute high low high-low high-adjust mips-jump-addr ia64 dir64 unknown registry execution network cryptography memory file synchronization remote-desktop services obfuscation resource windowing compression hooking data-exchange diagnostic administration exception-handling system-information console dynamic-library keyboard-and-mouse storage desktop shell setup power email directory security time export-table import-name resource exception security relocation debug architecture global-pointer thread-storage load-configuration bound-import import-address delay-loaded com-runtime reserved manifest cursor bitmap icon menu dialog string-table message-table font-directory font accelerator rcdata cursor-group icon-group version dlgInclude Plug-and-play Vxd Animated-cursor Animated-icon HTML MUI icons custom executable Compiled-HTML Riff GIF PNG BMP typelib registry Driver-Installation-File PDF CAB PKZIP PKlite PKSfx JAR Delphi 7zSFX Stylesheet-XML MOF XML-Event-Log RTF Nullsoft AutoIt Nb10 Spoon RAR Smart-installer InnoSetup Flash Flash Debugger FPO-debug Text JPEG Registry-file aPLib-compressed Python Python-script SFX XML MS-Office unknown any Native GUI console Windows-boot-application Windows-CE os2 posix win9x-driver EFI-application EFI-driver-boot-service EFI-driver-run-time-service EFI-ROM Xbox Intel MipsR3000 MipsR6000 MipsR10000 Mipsv2 Alpha SH3 SH3DSP SH3E SH4 SH5 ARM ARMv7 ARM-Thumb ARM-Thumb-2-little-Indian AM33 PowerPc PowerPcfp IA64 Mips16 Alpha64 MipsFpu MipsFpu16 Axp64 TriCore CEF EBC Amd64 M32R CEE unknown asInvoker highest administrator unknown COFF Nb09 Nb10 Nb11 RSDS FPO MISC exception fixu omapToSrc omapFromSrc Borland reserved10 clsid PGO vcFeature iltcg mpx unknown 7-bit ASCII Japan (Shift – JIS X-0208) Korea (Shift – KSC 5601) Taiwan (Big5) Unicode Latin-2 (Eastern European) Cyrillic Multilingual Greek Turkish Hebrew Arabic High Medium Low Information implicit delay-loaded forwarded Administrator Highest Invoker guid privilege registry OID security-descriptor-language user-agent rtti pipe pdb dos-message wmi Windows-dll utility mutex query security-identificator file regex url-pattern keyboard security size office base64 password unknown AegisLab Agnitum V3 Antiy-AVL Avast! Antivirus AVG AntiVir AVware Baidu-International BitDefender Bkav ByteHero Quick Heal CMC Antivirus Command Antivirus ClamAV Comodo DrWeb ALYac Emsisoft ESET NOD32 Fortinet F-Prot F-Secure GData The Hacker ViRobot Ikarus nProtect Jiangmin K7AntiVirus - K7GW Kaspersky Kingsoft Malwarebytes Anti-malware VirusScan Malware Protection eScan Nano Antivirus Norman Antivirus Panda Platinum PCTools Qihoo 360 Rising SAV SUPERAntiSpyware VIPRE Antivirus TotalDefense TrendMicro, TrendMicro-HouseCall VBA32 Zillya