DLL Injector.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	DLL Injector.exe
size	12800 (0x3200)
md5	0224e728d873223cfdd6f2eb27534dd9

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
147	30729	10
261	28619	19
260	28619	12
259	28619	1
257	28619	4
257	26715	5
1	0	82
265	28806	1
255	28806	1
258	28806	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5f12c933
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.26
SizeOfCode	0x1400
SizeOfInitializedData	0x1c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x18a2
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x137d	0x1400	R-X CODE
.rdata	0x3000	0x11a4	0x1200	R-- IDATA
.data	0x5000	0x398	0x200	RW- IDATA
.rsrc	0x6000	0x1e0	0x200	R-- IDATA
.reloc	0x7000	0x224	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x37d4	0xc8
RESOURCE	0x6000	0x1e0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x7000	0x224
DEBUG	0x3268	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x32d8	0x40
Bound_IAT	0	0
IAT	0x3000	0x138
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	function_name
KERNEL32.dll	1563	WriteProcessMemory
KERNEL32.dll	1283	SetConsoleTitleA
KERNEL32.dll	996	Module32Next
KERNEL32.dll	598	GetFullPathNameA
KERNEL32.dll	1037	OpenProcess
KERNEL32.dll	252	CreateToolhelp32Snapshot
KERNEL32.dll	1405	Sleep
KERNEL32.dll	961	LoadLibraryA
KERNEL32.dll	134	CloseHandle
KERNEL32.dll	964	LoadLibraryW
KERNEL32.dll	686	GetProcAddress
KERNEL32.dll	1479	VirtualAllocEx
KERNEL32.dll	231	CreateRemoteThread
KERNEL32.dll	895	IsDebuggerPresent
KERNEL32.dll	867	InitializeSListHead
KERNEL32.dll	745	GetSystemTimeAsFileTime
KERNEL32.dll	540	GetCurrentThreadId
KERNEL32.dll	536	GetCurrentProcessId
KERNEL32.dll	1101	QueryPerformanceCounter
KERNEL32.dll	902	IsProcessorFeaturePresent
KERNEL32.dll	1420	TerminateProcess
KERNEL32.dll	535	GetCurrentProcess
KERNEL32.dll	1389	SetUnhandledExceptionFilter
KERNEL32.dll	1453	UnhandledExceptionFilter
KERNEL32.dll	632	GetModuleHandleW
USER32.dll	499	GetWindowThreadProcessId
USER32.dll	273	FindWindowA
MSVCP140.dll	872	public: class std::basic_ostream<char, struct std::char_traits<char> > & __thiscall std::basic_ostream<char, struct std::char_traits<char> >::flush(void) ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
MSVCP140.dll	1246	public: int __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
MSVCP140.dll	262	public: class std::basic_ostream<char, struct std::char_traits<char> > & __thiscall std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > &)) ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
MSVCP140.dll	580	public: void __thiscall std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
MSVCP140.dll	1249	public: __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const *, __int64) ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
MSVCP140.dll	1221	public: void __thiscall std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
MSVCP140.dll	692	class std::basic_ostream<char, struct std::char_traits<char> > std::cout ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
MSVCP140.dll	1310	bool __cdecl std::uncaught_exception(void) ?uncaught_exception@std@@YA_NXZ
MSVCP140.dll	1121	public: class std::basic_ostream<char, struct std::char_traits<char> > & __thiscall std::basic_ostream<char, struct std::char_traits<char> >::put(char) ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
MSVCP140.dll	1332	public: char __thiscall std::basic_ios<char, struct std::char_traits<char> >::widen(char)const ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
VCRUNTIME140.dll	28	__current_exception
VCRUNTIME140.dll	29	__current_exception_context
VCRUNTIME140.dll	72	memset
VCRUNTIME140.dll	16	__CxxFrameHandler3
VCRUNTIME140.dll	35	__std_terminate
VCRUNTIME140.dll	53	_except_handler4_common
api-ms-win-crt-runtime-l1-1-0.dll	22	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	23	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	57	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	54	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	6	__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	31	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	29	_controlfp_s
api-ms-win-crt-runtime-l1-1-0.dll	106	terminate
api-ms-win-crt-runtime-l1-1-0.dll	56	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	42	_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	63	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	5	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	62	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	66	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	68	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	88	exit
api-ms-win-crt-runtime-l1-1-0.dll	37	_exit
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	116	fclose
api-ms-win-crt-stdio-l1-1-0.dll	125	fopen
api-ms-win-crt-math-l1-1-0.dll	46	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode

show previews

offset	size	type	comment
0	12800	EXE	07/18/2020 10:04:35	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK