hk.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	hk.dll
size	4096 (0x1000)
md5	090f3e37b3732104c4b7651c7ee3fad5

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
93	2067	2
93	2179	2
1	0	27
93	3077	3
96	3077	3
92	3077	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x517b62cd
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0
SizeOfInitializedData	0xc00
SizeOfUninitializedData	0xa00
AddressOfEntryPoint	0x23b2
BaseOfCode	0x1000
BaseOfData	0x1000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x5000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x400
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.bss	0x1000	0x820	0	RW- UDATA
.data	0x2000	0x761	0x800	RWX IDATA
.s	0x3000	4	0x200	RW- IDATA SHARED
.reloc	0x4000	0xda	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x2710	0x51
IMPORT	0x2450	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x4000	0x94
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2000	0x78
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
MSVCR71.dll	771	sscanf
MSVCR71.dll	780	strlen
MSVCR71.dll	743	memset
KERNEL32.dll	950	lstrcpyA
KERNEL32.dll	315	GetCurrentProcessId
KERNEL32.dll	77	CreateFileA
KERNEL32.dll	916	WriteFile
KERNEL32.dll	318	GetCurrentThreadId
KERNEL32.dll	956	lstrlenA
KERNEL32.dll	941	lstrcatA
KERNEL32.dll	264	GetCommandLineA
KERNEL32.dll	46	CloseHandle
USER32.dll	69	CloseWindowStation
USER32.dll	67	CloseDesktop
USER32.dll	633	SetThreadDesktop
USER32.dll	502	OpenDesktopA
USER32.dll	616	SetProcessWindowStation
USER32.dll	506	OpenWindowStationA
USER32.dll	353	GetThreadDesktop
USER32.dll	328	GetProcessWindowStation
USER32.dll	726	wsprintfA
USER32.dll	375	GetWindowTextA
USER32.dll	279	GetForegroundWindow
USER32.dll	671	ToAscii
USER32.dll	294	GetKeyboardState
USER32.dll	469	MapVirtualKeyA
USER32.dll	26	CallNextHookEx

ord	entry_va	function_name
1	0x23ed	KeyProc
2	0x3000	xHook

module_name	hk.dll
flags	0
timestamp	2013-04-27 05:31:57
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x2740
Functions(2)	0x2738
NameOrdinals(2)	0x2748

show previews

offset	size	type	comment
0	4096	DLL	04/27/2013 05:31:57	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK