filename0x00416800.exe
size28672 (0x7000)
md529dcaee8e3c51d4225cbdabfc6978760
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
125412041
1062
123412049
1094120410
122412041
110412041
120412041

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x4329e38a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x3000
SizeOfInitializedData0x2000
SizeOfUninitializedData0
AddressOfEntryPoint0x375a
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion4.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x6000
SizeOfHeaders0x1000
CheckSum0x9a45
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x2e260x3000R-X CODE
.data0x40000x3480x1000RW- IDATA
.reloc0x50000x1fe0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x3da00x86
IMPORT0x39240x64
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x50000x18c
DEBUG0x11200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x14d80x40
Bound_IAT00
IAT0x10000x100
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
msvcrt.dll359_except_handler3
msvcrt.dll259_adjust_fdiv
msvcrt.dll271_amsg_exit
msvcrt.dll493_initterm
msvcrt.dll1193free
msvcrt.dll1249malloc
msvcrt.dll115_XcptFilter
msvcrt.dll1296strchr
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll970_vsnprintf
KERNEL32.dll171DisableThreadLibraryCalls
KERNEL32.dll981SetUnhandledExceptionFilter
KERNEL32.dll1023UnhandledExceptionFilter
KERNEL32.dll388GetCurrentProcess
KERNEL32.dll1006TerminateProcess
KERNEL32.dll389GetCurrentProcessId
KERNEL32.dll392GetCurrentThreadId
KERNEL32.dll622HeapAlloc
KERNEL32.dll500GetProcessHeap
KERNEL32.dll626HeapFree
KERNEL32.dll582GetVersionExA
KERNEL32.dll442GetLastError
KERNEL32.dll98CreateDirectoryA
KERNEL32.dll729MoveFileExA
KERNEL32.dll728MoveFileA
KERNEL32.dll593GetWindowsDirectoryA
KERNEL32.dll649InterlockedIncrement
KERNEL32.dll163DeleteFileA
KERNEL32.dll918SetFileAttributesA
KERNEL32.dll829RemoveDirectoryA
KERNEL32.dll419GetFileAttributesA
KERNEL32.dll1121lstrcmpiA
KERNEL32.dll786QueryPerformanceCounter
KERNEL32.dll568GetTickCount
KERNEL32.dll544GetSystemTimeAsFileTime
ADVAPI32.dll561RegEnumValueA
ADVAPI32.dll551RegDeleteValueA
ADVAPI32.dll588RegQueryValueExA
ADVAPI32.dll576RegOpenKeyExA
ADVAPI32.dll532RegCloseKey
msi.dll79
msi.dll249
msi.dll245
msi.dll73
msi.dll160
msi.dll159
msi.dll31
msi.dll115
msi.dll166
msi.dll163
msi.dll49
msi.dll50
msi.dll117
msi.dll8
msi.dll17
msi.dll103
msi.dll121
msi.dll124
msi.dll48
ordentry_vafunction_name
10x32f1CustomAction_SxsMsmCleanup
20x3328CustomAction_SxsMsmInstall
module_namemsmcustomaction.dll
flags0
timestamp2005-09-15 21:11:38
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x3dd0
Functions(2)0x3dc8
NameOrdinals(2)0x3dd8
offsetsizetypecomment
024576DLL09/15/2005 21:11:38#
15c115HTM#
60004096BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 28672 bytes (28 KiB)


--
Type = Cab
ERRORS:
Unexpected end of archive
Offset = 26112
Physical Size = 5715
Method = MSZip
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 0

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2009-07-12 00:05:18 ....A         7522               catalog.30729.4148.policy_9_0_Microsoft_VC90_CRT_x86.QFE.EB5BA578_FF7F_3863_8E53_7A003222B7FC
2009-07-12 00:05:18 ....A         7522               ul_catalog.30729.4148.policy_9_0_Microsoft_VC90_CRT_x86.QFE.EB5BA578_FF7F_3863_8E53_7A003222B7FC
2009-07-11 19:38:08 ....A          764               policy.30729.4148.policy_9_0_Microsoft_VC90_CRT_x86.QFE.EB5BA578_FF7F_3863_8E53_7A003222B7FC
2009-07-11 19:38:08 ....A          764               ul_policy.30729.4148.policy_9_0_Microsoft_VC90_CRT_x86.QFE.EB5BA578_FF7F_3863_8E53_7A003222B7FC
------------------- ----- ------------ ------------  ------------------------
2009-07-12 00:05:18              16572        28672  4 files

Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK