filenameUAC.dll
size18944 (0x4a00)
md50bea21545b130f74ad40160ae8ac05ea
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1235072711
1080
132210222
146210221
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x49ce92e9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3a00
SizeOfInitializedData0xc00
SizeOfUninitializedData0
AddressOfEntryPoint0x3673
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x8000
SizeOfHeaders0x400
CheckSum0x88db
Subsystem2
DllCharacteristics0x400
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x396a0x3a00R-X CODE
.data0x50000x740x200RW- IDATA
.rsrc0x60000x3800x400R-- IDATA
.reloc0x70000x4980x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x48200x14a
IMPORT0x40c00x78
RESOURCE0x60000x380
EXCEPTION00
SECURITY00
BASERELOC0x70000x3bc
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x10000x14c
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#1013861252
MANIFEST#23461252
module_namehintordfunction_name
KERNEL32.dll151CreateProcessW
KERNEL32.dll1206lstrlenW
KERNEL32.dll1203lstrcpynW
KERNEL32.dll1197lstrcmpiW
KERNEL32.dll630GetVersionExW
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll756LoadLibraryW
KERNEL32.dll544GetProcAddress
KERNEL32.dll753LoadLibraryA
KERNEL32.dll486GetLastError
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll212DuplicateHandle
KERNEL32.dll1057Sleep
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll163CreateThread
KERNEL32.dll368GetCommandLineW
KERNEL32.dll332FreeLibrary
KERNEL32.dll819OpenProcess
KERNEL32.dll328FormatMessageW
KERNEL32.dll765LocalFree
KERNEL32.dll67CloseHandle
KERNEL32.dll1004SetLastError
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll535GetPrivateProfileIntW
KERNEL32.dll541GetPrivateProfileStringW
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll652GlobalFree
KERNEL32.dll453GetExitCodeProcess
KERNEL32.dll645GlobalAlloc
USER32.dll166DialogBoxParamW
USER32.dll47CharNextW
USER32.dll729UnhookWindowsHookEx
USER32.dll27CallNextHookEx
USER32.dll267GetClassNameW
USER32.dll688SetWindowsHookExW
USER32.dll610SendMessageTimeoutW
USER32.dll764WaitForInputIdle
USER32.dll150DefWindowProcW
USER32.dll543PostMessageW
USER32.dll312GetLastActivePopup
USER32.dll544PostQuitMessage
USER32.dll634SetForegroundWindow
USER32.dll169DispatchMessageW
USER32.dll334GetMessageW
USER32.dll104CreateWindowExW
USER32.dll566RegisterClassW
USER32.dll735UnregisterClassW
USER32.dll399GetWindowTextW
USER32.dll725TranslateMessage
USER32.dll441IsDialogMessageW
USER32.dll540PeekMessageW
USER32.dll518MsgWaitForMultipleObjects
USER32.dll453IsWindow
USER32.dll400GetWindowThreadProcessId
USER32.dll511MessageBoxW
USER32.dll677SetWindowLongW
USER32.dll473LoadImageW
USER32.dll160DestroyWindow
USER32.dll386GetWindowLongW
USER32.dll209EnableWindow
USER32.dll696ShowWindow
USER32.dll684SetWindowTextW
USER32.dll776wsprintfW
USER32.dll484LoadStringW
USER32.dll287GetDlgItem
USER32.dll611SendMessageW
USER32.dll211EndDialog
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll546QueryServiceStatus
ADVAPI32.dll501OpenServiceW
ADVAPI32.dll83CloseServiceHandle
ADVAPI32.dll499OpenSCManagerW
ADVAPI32.dll497OpenProcessToken
ADVAPI32.dll616RegQueryValueExW
ADVAPI32.dll603RegOpenKeyExW
SHELL32.dll279ShellExecuteExW
ole32.dll61CoInitialize
ole32.dll107CoUninitialize
ordentry_vafunction_name
10x3b85Exec
20x3520ExecCodeSegment
30x3bbeExecWait
40x3c69GetElevationType
50x3e0cGetOuterHwnd
60x3eb3GetShellFolderPath
70x3d74IsAdmin
80x39e8RunElevated
90x3bf7ShellExec
100x3c30ShellExecWait
110x35deStackPush
120x3cf7SupportsUAC
130x404cUnload
module_nameUAC.dll
flags0
timestamp2009-03-28 21:13:13
version0.0
ordinal_base1
nFunctions13
nNames13
Names(13)0x487c
Functions(13)0x4848
NameOrdinals(13)0x48b0
offsetsizetypecomment
018944DLL03/28/2009 21:13:13#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK