filenameDLL-Injector(GameHack) RandoInjector.exe
size309248 (0x4b800)
md5078c86fb1c72a74c0d43778b5c081b1c
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
2592741211
26127412140
2602741218
2612892037
2602892017
2592892017
257274123
1089
261291111
255291111
258291111

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5f422824
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.27
SizeOfCode0x3f200
SizeOfInitializedData0xd600
SizeOfUninitializedData0
AddressOfEntryPoint0x15c4
BaseOfCode0x1000
BaseOfData0x41000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x51000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x3f0090x3f200R-X CODE
.rdata0x410000x920c0x9400R-- IDATA
.data0x4b0000x1c6c0xa00RW- IDATA
.rsrc0x4d0000x1e00x200R-- IDATA
.reloc0x4e0000x21680x2200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x499e40x28
RESOURCE0x4d0000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x4e0000x2168
DEBUG0x48afc0x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x48b180x40
Bound_IAT00
IAT0x410000x168
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll600GetFullPathNameA
KERNEL32.dll136CloseHandle
KERNEL32.dll233CreateRemoteThread
KERNEL32.dll1038OpenProcess
KERNEL32.dll1481VirtualAllocEx
KERNEL32.dll1565WriteProcessMemory
KERNEL32.dll688GetProcAddress
KERNEL32.dll964LoadLibraryA
KERNEL32.dll967LoadLibraryW
KERNEL32.dll254CreateToolhelp32Snapshot
KERNEL32.dll1070Process32Next
KERNEL32.dll1555WriteConsoleW
KERNEL32.dll1455UnhandledExceptionFilter
KERNEL32.dll1391SetUnhandledExceptionFilter
KERNEL32.dll537GetCurrentProcess
KERNEL32.dll1422TerminateProcess
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll1102QueryPerformanceCounter
KERNEL32.dll538GetCurrentProcessId
KERNEL32.dll542GetCurrentThreadId
KERNEL32.dll747GetSystemTimeAsFileTime
KERNEL32.dll869InitializeSListHead
KERNEL32.dll897IsDebuggerPresent
KERNEL32.dll722GetStartupInfoW
KERNEL32.dll634GetModuleHandleW
KERNEL32.dll881InterlockedPushEntrySList
KERNEL32.dll878InterlockedFlushSList
KERNEL32.dll1236RtlUnwind
KERNEL32.dll611GetLastError
KERNEL32.dll1331SetLastError
KERNEL32.dll307EnterCriticalSection
KERNEL32.dll960LeaveCriticalSection
KERNEL32.dll274DeleteCriticalSection
KERNEL32.dll865InitializeCriticalSectionAndSpinCount
KERNEL32.dll1440TlsAlloc
KERNEL32.dll1442TlsGetValue
KERNEL32.dll1443TlsSetValue
KERNEL32.dll1441TlsFree
KERNEL32.dll429FreeLibrary
KERNEL32.dll966LoadLibraryExW
KERNEL32.dll303EncodePointer
KERNEL32.dll1123RaiseException
KERNEL32.dll724GetStdHandle
KERNEL32.dll1556WriteFile
KERNEL32.dll630GetModuleFileNameW
KERNEL32.dll352ExitProcess
KERNEL32.dll633GetModuleHandleExW
KERNEL32.dll472GetCommandLineA
KERNEL32.dll473GetCommandLineW
KERNEL32.dll541GetCurrentThread
KERNEL32.dll1050OutputDebugStringW
KERNEL32.dll839HeapAlloc
KERNEL32.dll843HeapFree
KERNEL32.dll375FindClose
KERNEL32.dll381FindFirstFileExW
KERNEL32.dll398FindNextFileW
KERNEL32.dll910IsValidCodePage
KERNEL32.dll436GetACP
KERNEL32.dll665GetOEMCP
KERNEL32.dll451GetCPInfo
KERNEL32.dll1010MultiByteToWideChar
KERNEL32.dll1536WideCharToMultiByte
KERNEL32.dll569GetEnvironmentStringsW
KERNEL32.dll428FreeEnvironmentStringsW
KERNEL32.dll1301SetEnvironmentVariableW
KERNEL32.dll1356SetStdHandle
KERNEL32.dll592GetFileType
KERNEL32.dll729GetStringTypeW
KERNEL32.dll615GetLocaleInfoW
KERNEL32.dll912IsValidLocale
KERNEL32.dll788GetUserDefaultLCID
KERNEL32.dll342EnumSystemLocalesW
KERNEL32.dll547GetDateFormatW
KERNEL32.dll782GetTimeFormatW
KERNEL32.dll157CompareStringW
KERNEL32.dll948LCMapStringW
KERNEL32.dll694GetProcessHeap
KERNEL32.dll1258SetConsoleCtrlHandler
KERNEL32.dll848HeapSize
KERNEL32.dll846HeapReAlloc
KERNEL32.dll417FlushFileBuffers
KERNEL32.dll514GetConsoleOutputCP
KERNEL32.dll510GetConsoleMode
KERNEL32.dll590GetFileSizeEx
KERNEL32.dll1316SetFilePointerEx
KERNEL32.dll1140ReadFile
KERNEL32.dll1137ReadConsoleW
KERNEL32.dll205CreateFileW
KERNEL32.dll267DecodePointer
offsetsizetypecomment
0309248EXE08/23/2020 08:26:12#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK