filenamedm.unpacked.dll 930472 114688.dll
size114688 (0x1c000)
md50dea32625c218321c3febfe0686f34a0
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1472993
1080474
480472
9640352
1272911
1180473
1980347
10143
11978217
484471

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5024a38f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x15000
SizeOfInitializedData0xc000
SizeOfUninitializedData0
AddressOfEntryPoint0x15a5f
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x22000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x14e5e0x15000R-X CODE
.rdata0x160000x28490x3000R-- IDATA
.data0x190000x6d000x1000RW- IDATA
.reloc0x200000x196a0x2000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x187d00x79
IMPORT0x17c280x64
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x200000x1580
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x160000x238
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll470MapViewOfFile
KERNEL32.dll489OpenFileMappingA
KERNEL32.dll540ReadProcessMemory
KERNEL32.dll495OpenProcess
KERNEL32.dll711VirtualQueryEx
KERNEL32.dll716WaitForMultipleObjects
KERNEL32.dll347GetSystemInfo
KERNEL32.dll180FreeLibrary
KERNEL32.dll450LoadLibraryA
KERNEL32.dll249GetCurrentThread
KERNEL32.dll171FlushInstructionCache
KERNEL32.dll662Sleep
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll373GetVersionExA
KERNEL32.dll92DeviceIoControl
KERNEL32.dll126ExitThread
KERNEL32.dll484MultiByteToWideChar
KERNEL32.dll688UnmapViewOfFile
KERNEL32.dll250GetCurrentThreadId
KERNEL32.dll430InterlockedExchange
KERNEL32.dll613SetEvent
KERNEL32.dll365GetTickCount
KERNEL32.dll486OpenEventA
KERNEL32.dll282GetLastError
KERNEL32.dll625SetLastError
KERNEL32.dll286GetLogicalDriveStringsA
KERNEL32.dll643SetThreadContext
KERNEL32.dll359GetThreadContext
KERNEL32.dll556ResumeThread
KERNEL32.dll428InterlockedCompareExchange
KERNEL32.dll52CreateFileA
KERNEL32.dll735WriteFile
KERNEL32.dll699VirtualAlloc
KERNEL32.dll703VirtualFree
KERNEL32.dll345GetSystemDirectoryA
KERNEL32.dll710VirtualQuery
KERNEL32.dll53CreateFileMappingA
KERNEL32.dll319GetProcessAffinityMask
KERNEL32.dll632SetProcessAffinityMask
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll318GetProcAddress
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll248GetCurrentProcessId
KERNEL32.dll76CreateToolhelp32Snapshot
KERNEL32.dll473Module32First
KERNEL32.dll475Module32Next
KERNEL32.dll27CloseHandle
KERNEL32.dll664SuspendThread
USER32.dll642TranslateMessage
USER32.dll535SendMessageTimeoutA
USER32.dll437MapVirtualKeyA
USER32.dll401IsWindowUnicode
USER32.dll478PostMessageA
USER32.dll514ReleaseCapture
USER32.dll227GetAsyncKeyState
USER32.dll58ClientToScreen
USER32.dll132DefWindowProcA
USER32.dll600SetWindowLongA
USER32.dll601SetWindowLongW
USER32.dll235GetClassLongA
USER32.dll639TranslateAcceleratorA
USER32.dll264GetForegroundWindow
USER32.dll338GetWindow
USER32.dll299GetMessageExtraInfo
USER32.dll66CopyIcon
USER32.dll275GetKeyboardLayout
USER32.dll438MapVirtualKeyExA
USER32.dll240GetClientRect
USER32.dll350GetWindowTextA
USER32.dll208EnumWindows
USER32.dll236GetClassLongW
USER32.dll396IsIconic
USER32.dll347GetWindowPlacement
USER32.dll274GetKeyState
USER32.dll625SystemParametersInfoA
USER32.dll348GetWindowRect
USER32.dll221GetActiveWindow
USER32.dll552SetCursorPos
USER32.dll252GetCursorPos
USER32.dll22CallWindowProcA
USER32.dll139DestroyCursor
USER32.dll267GetIconInfo
USER32.dll342GetWindowLongA
USER32.dll343GetWindowLongW
USER32.dll532SendMessageA
USER32.dll354GetWindowThreadProcessId
USER32.dll169DrawIcon
USER32.dll253GetDC
USER32.dll515ReleaseDC
USER32.dll309GetParent
USER32.dll399IsWindow
USER32.dll522ScreenToClient
GDI32.dll292GetDIBits
GDI32.dll80DeleteDC
GDI32.dll158ExtTextOutA
GDI32.dll461SetBkColor
GDI32.dll455SelectObject
GDI32.dll41CreateCompatibleBitmap
GDI32.dll42CreateCompatibleDC
GDI32.dll83DeleteObject
GDI32.dll335GetObjectA
MSVCRT.dll690sprintf
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll157_adjust_fdiv
MSVCRT.dll271_initterm
MSVCRT.dll390_onexit
MSVCRT.dll85__dllonexit
MSVCRT.dll599fopen
MSVCRT.dll610fseek
MSVCRT.dll612ftell
MSVCRT.dll605fread
MSVCRT.dll588fclose
MSVCRT.dll202_except_handler3
MSVCRT.dll490_wcsicmp
MSVCRT.dll7public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

MSVCRT.dll13public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

MSVCRT.dll65_CxxThrowException
MSVCRT.dll702strlen
MSVCRT.dll8public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

MSVCRT.dll739wcscpy
MSVCRT.dll747wcsrchr
MSVCRT.dll695strchr
MSVCRT.dll633isspace
MSVCRT.dll451_strlwr
MSVCRT.dll707strrchr
MSVCRT.dll166_beginthreadex
MSVCRT.dll679realloc
MSVCRT.dll742wcslen
MSVCRT.dll657malloc
MSVCRT.dll606free
MSVCRT.dll573atoi
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll661memchr
MSVCRT.dll664memmove
MSVCRT.dll705strncpy
MSVCRT.dll709strstr
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll693sscanf
ordentry_vafunction_name
10x9df0User32SetWindowLongA
20x9fe0User32SetWindowLongW
module_nameUser32Kernel32.dll
flags0
timestamp2012-08-10 06:00:47
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x18800
Functions(2)0x187f8
NameOrdinals(2)0x18808
offsetsizetypecomment
0114688DLL08/10/2012 06:00:47#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK