filenameMyDll.dll
size652288 (0x9f400)
md506e543ebf1d9b71ae7afc29904ff9940
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
259307955
26130795135
2603079510
2613253337
2603253315
259325339
257307955
1092
261328252
255328251
258328251

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xb
TimeDateStamp0x654779e5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion14.37
SizeOfCode0x7dc00
SizeOfInitializedData0x23400
SizeOfUninitializedData0
AddressOfEntryPoint0x3b0fa
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xe3000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x390440RWX CODE UDATA
.text0x3b0000x7dac40x7dc00R-X CODE
.rdata0xb90000x163a60x16400R-- IDATA
.data0xd00000x32000x1200RW- IDATA
.pdata0xd40000x6a680x6c00R-- IDATA
.idata0xdb0000x10e80x1200R-- IDATA
.msvcjmc0xdd0000x17b0x200RW- IDATA
.00cfg0xde0000x1750x200R-- IDATA
_RDATA0xdf0000x29f0x400R-- IDATA
.rsrc0xe00000x3260x400R-- IDATA
.reloc0xe10000x12af0x1400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xdb4200x3c
RESOURCE0xe00000x326
EXCEPTION0xd40000x5fac
SECURITY00
BASERELOC0xe10000x834
DEBUG0xc6a300x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xc68b00x140
Bound_IAT00
IAT0xdb0000x420
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#21450
module_namehintordfunction_name
KERNEL32.dll259CreateThread
KERNEL32.dll1610WriteConsoleW
KERNEL32.dll148CloseHandle
KERNEL32.dll218CreateFileW
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll1136QueryPerformanceCounter
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll906InitializeSListHead
KERNEL32.dll1269RtlCaptureContext
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll753GetStartupInfoW
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll1159RaiseException
KERNEL32.dll1042MultiByteToWideChar
KERNEL32.dll1591WideCharToMultiByte
KERNEL32.dll637GetLastError
KERNEL32.dll876HeapAlloc
KERNEL32.dll880HeapFree
KERNEL32.dll724GetProcessHeap
KERNEL32.dll1543VirtualQuery
KERNEL32.dll453FreeLibrary
KERNEL32.dll717GetProcAddress
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll1476TerminateProcess
KERNEL32.dll1283RtlUnwindEx
KERNEL32.dll912InterlockedPushEntrySList
KERNEL32.dll910InterlockedFlushSList
KERNEL32.dll657GetModuleFileNameW
KERNEL32.dll998LoadLibraryExW
KERNEL32.dll1380SetLastError
KERNEL32.dll329EnterCriticalSection
KERNEL32.dll992LeaveCriticalSection
KERNEL32.dll291DeleteCriticalSection
KERNEL32.dll902InitializeCriticalSectionAndSpinCount
KERNEL32.dll1494TlsAlloc
KERNEL32.dll1496TlsGetValue
KERNEL32.dll1497TlsSetValue
KERNEL32.dll1495TlsFree
KERNEL32.dll325EncodePointer
KERNEL32.dll1279RtlPcToFileHeader
KERNEL32.dll376ExitProcess
KERNEL32.dll660GetModuleHandleExW
KERNEL32.dll566GetCurrentThread
KERNEL32.dll399FindClose
KERNEL32.dll405FindFirstFileExW
KERNEL32.dll422FindNextFileW
KERNEL32.dll942IsValidCodePage
KERNEL32.dll460GetACP
KERNEL32.dll694GetOEMCP
KERNEL32.dll475GetCPInfo
KERNEL32.dll496GetCommandLineA
KERNEL32.dll497GetCommandLineW
KERNEL32.dll595GetEnvironmentStringsW
KERNEL32.dll452FreeEnvironmentStringsW
KERNEL32.dll1350SetEnvironmentVariableW
KERNEL32.dll793GetTempPathW
KERNEL32.dll436FlsAlloc
KERNEL32.dll438FlsGetValue
KERNEL32.dll439FlsSetValue
KERNEL32.dll437FlsFree
KERNEL32.dll573GetDateFormatW
KERNEL32.dll817GetTimeFormatW
KERNEL32.dll170CompareStringW
KERNEL32.dll980LCMapStringW
KERNEL32.dll641GetLocaleInfoW
KERNEL32.dll944IsValidLocale
KERNEL32.dll825GetUserDefaultLCID
KERNEL32.dll365EnumSystemLocalesW
KERNEL32.dll755GetStdHandle
KERNEL32.dll618GetFileType
KERNEL32.dll1307SetConsoleCtrlHandler
KERNEL32.dll760GetStringTypeW
KERNEL32.dll885HeapSize
KERNEL32.dll883HeapReAlloc
KERNEL32.dll1407SetStdHandle
KERNEL32.dll441FlushFileBuffers
KERNEL32.dll1611WriteFile
KERNEL32.dll538GetConsoleOutputCP
KERNEL32.dll534GetConsoleMode
KERNEL32.dll616GetFileSizeEx
KERNEL32.dll1365SetFilePointerEx
KERNEL32.dll1176ReadFile
KERNEL32.dll1173ReadConsoleW
KERNEL32.dll1082OutputDebugStringW
KERNEL32.dll1282RtlUnwind
USER32.dll651MessageBoxW
offsetsizetypecomment
15c115HTM#
15d0646704BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK