filenametest_Dll1.dll
size7680 (0x1e00)
md5111445b2eda921ae43a9960249f4f654
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
257241233
261241239
259241231
2602412311
1473072912
1020
265242133
256242131
258242131

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x57ea17f1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.0
SizeOfCode0xc00
SizeOfInitializedData0x1000
SizeOfUninitializedData0
AddressOfEntryPoint0x1333
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion0.0
SubsystemVersion6.2
Reserved10
SizeOfImage0x6000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x1140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xa0e0xc00R-X CODE
.rdata0x20000x7ce0x800R-- IDATA
.data0x30000x3900x200RW- IDATA
.gfids0x40000x100x200R-- IDATA
.reloc0x50000xdc0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x24200x54
IMPORT0x24740x8c
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x50000xdc
DEBUG0x20a00x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x21100x5c
Bound_IAT00
IAT0x20000x60
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
VCRUNTIME140_APP.dll53_except_handler4_common
VCRUNTIME140_APP.dll37__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0.dll31_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll36_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll62_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll54_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll53_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll25_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll65_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll57_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll56_initterm
api-ms-win-crt-runtime-l1-1-0.dll23_cexit
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2.dll17GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll47IsProcessorFeaturePresent
api-ms-win-core-processthreads-l1-1-2.dll13GetCurrentProcessId
api-ms-win-core-sysinfo-l1-2-1.dll20GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-2-0.dllInitializeSListHead
ordentry_vafunction_name
10x1010?ml_func@@YAHHH@Z
module_nametest_Dll1.dll
flags0
timestamp2016-09-27 06:55:45
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x244c
Functions(1)0x2448
NameOrdinals(1)0x2450
offsetsizetypecomment
07680DLL09/27/2016 06:55:45#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK