filenameantivshlp32.dll
size40960 (0xa000)
md51243c517da1b212db8525eea31d80a03
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
1272912
1472991
1180471
1080474
480472
007
10110
1980347
1197821
617351
484471

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4f962440
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x3000
SizeOfInitializedData0x6000
SizeOfUninitializedData0
AddressOfEntryPoint0x38ff
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x71000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xa000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x29ca0x3000R-X CODE
.rdata0x40000xbf50x1000R-- IDATA
.data0x50000x12480x2000RW- IDATA
.rsrc0x70000x18d00x2000R-- IDATA
.reloc0x90000x5120x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x4b400xb5
IMPORT0x43100x78
RESOURCE0x70000x18d0
EXCEPTION00
SECURITY00
BASERELOC0x90000x360
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x190
Delay_IAT00
CLR_Header00
typenamesizecp
HTTPEXE#222262360
module_namehintordfunction_name
KERNEL32.dll27CloseHandle
KERNEL32.dll510Process32Next
KERNEL32.dll508Process32First
KERNEL32.dll76CreateToolhelp32Snapshot
KERNEL32.dll478MoveFileExA
KERNEL32.dll495OpenProcess
KERNEL32.dll182FreeResource
KERNEL32.dll735WriteFile
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll269GetFileAttributesA
KERNEL32.dll87DeleteFileA
KERNEL32.dll283GetLocalTime
KERNEL32.dll381GetWindowsDirectoryA
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll338GetStdHandle
KERNEL32.dll357GetTempPathA
KERNEL32.dll365GetTickCount
KERNEL32.dll163FindResourceA
KERNEL32.dll501OutputDebugStringA
KERNEL32.dll455LoadResource
KERNEL32.dll52CreateFileA
KERNEL32.dll177FreeConsole
KERNEL32.dll625SetLastError
KERNEL32.dll699VirtualAlloc
KERNEL32.dll700VirtualAllocEx
KERNEL32.dll708VirtualProtectEx
KERNEL32.dll318GetProcAddress
KERNEL32.dll745WriteProcessMemory
KERNEL32.dll643SetThreadContext
KERNEL32.dll556ResumeThread
KERNEL32.dll670TerminateProcess
KERNEL32.dll359GetThreadContext
KERNEL32.dll540ReadProcessMemory
KERNEL32.dll711VirtualQueryEx
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll662Sleep
KERNEL32.dll776lstrlenA
KERNEL32.dll68CreateProcessA
KERNEL32.dll282GetLastError
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll761lstrcatA
KERNEL32.dll661SizeofResource
USER32.dll684wsprintfA
ADVAPI32.dll325OpenSCManagerA
ADVAPI32.dll76CreateServiceA
ADVAPI32.dll43ChangeServiceConfig2A
ADVAPI32.dll52CloseServiceHandle
ADVAPI32.dll350RegCreateKeyA
ADVAPI32.dll322OpenProcessToken
ADVAPI32.dll245LookupPrivilegeValueA
ADVAPI32.dll23AdjustTokenPrivileges
ADVAPI32.dll430SetServiceStatus
ADVAPI32.dll398RegisterServiceCtrlHandlerA
ADVAPI32.dll351RegCreateKeyExA
ADVAPI32.dll390RegSetValueExA
ADVAPI32.dll354RegDeleteKeyA
ADVAPI32.dll356RegDeleteValueA
ADVAPI32.dll379RegQueryValueExA
ADVAPI32.dll370RegOpenKeyExA
ADVAPI32.dll347RegCloseKey
ADVAPI32.dll327OpenServiceA
ADVAPI32.dll120DeleteService
SHLWAPI.dll108SHDeleteKeyA
MSVCRT.dll430_snprintf
MSVCRT.dll202_except_handler3
MSVCRT.dll703strncat
MSVCRT.dll695strchr
MSVCRT.dll707strrchr
MSVCRT.dll690sprintf
MSVCRT.dll670printf
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll605fread
MSVCRT.dll612ftell
MSVCRT.dll610fseek
MSVCRT.dll588fclose
MSVCRT.dll599fopen
MSVCRT.dll606free
MSVCRT.dll614fwrite
MSVCRT.dll579clock
MSVCRT.dll657malloc
MSVCRT.dll449_stricmp
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll65_CxxThrowException
MSVCRT.dll753wcstombs
MSVCRT.dll705strncpy
MSVCRT.dll573atoi
MSVCRT.dll275_iob
MSVCRT.dll600fprintf
MSVCRT.dll446_strdate
MSVCRT.dll458_strtime
MSVCRT.dll481_vsnprintf
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll271_initterm
MSVCRT.dll157_adjust_fdiv
ordentry_vafunction_name
10x2d10InstallService
20x3120RundllInstallA
30x3280RundllUninstallA
40x2570ServiceMain
50x3130UninstallService
module_nameSvcHostDLL.dll
flags0
timestamp2012-04-24 03:55:44
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0x4b7c
Functions(5)0x4b68
NameOrdinals(5)0x4b90
offsetsizetypecomment
040960DLL04/24/2012 03:55:44#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK