filenamehexutils.dll
size8704 (0x2200)
md51388b1d0358120b2ebc4cd3fd84d1e46
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
147307293
149307291
1313072913
123507272
1031
132307295
146307291
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5342b471
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xe00
SizeOfInitializedData0x1000
SizeOfUninitializedData0
AddressOfEntryPoint0x17bd
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x6000
SizeOfHeaders0x400
CheckSum0xf57b
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x989680
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xcb60xe00R-X CODE
.rdata0x20000x50e0x600R-- IDATA
.data0x30000x35c0x200RW- IDATA
.rsrc0x40000x4a80x600R-- IDATA
.reloc0x50000x17e0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x24900x7e
IMPORT0x216c0x3c
RESOURCE0x40000x4a8
EXCEPTION00
SECURITY00
BASERELOC0x50000x144
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x20a80x40
Bound_IAT00
IAT0x20000x84
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#14301252
MANIFEST#25981252
module_namehintordfunction_name
MSVCR90.dll150__dllonexit
MSVCR90.dll630_lock
MSVCR90.dll998_unlock
MSVCR90.dll371_except_handler4_common
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll140__clean_type_info_names_internal
MSVCR90.dll106__CppXcptFilter
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll277_amsg_exit
MSVCR90.dll517_initterm_e
MSVCR90.dll516_initterm
MSVCR90.dll352_decode_pointer
MSVCR90.dll363_encoded_null
MSVCR90.dll1252free
MSVCR90.dll647_malloc_crt
MSVCR90.dll362_encode_pointer
MSVCR90.dll796_onexit
MSVCR90.dll1322memset
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1069TerminateProcess
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll1057Sleep
KERNEL32.dll701InterlockedExchange
KERNEL32.dll721IsDebuggerPresent
ordentry_vafunction_name
10x1010?HexUtils_ConvertHexToBin@@YA?AW4EReadHexStatus@@PAEI0AAII_N@Z
module_namehexutils.dll
flags0
timestamp2014-04-07 14:21:37
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x24bc
Functions(1)0x24b8
NameOrdinals(1)0x24c0

StringTable 040904e4

CompanyNameSECU-3.ORG
LegalCopyright(c) Alexey A. Shabelnikov, SECU-3.ORG. All rights reserved.
ProductNameSECU-3 Manager

VS_FIXEDFILEINFO

FileVersion3.9.0.0
ProductVersion3.9.0.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0
FileType0
FileSubtype0
offsetsizetypecomment
08704DLL04/07/2014 14:21:37#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] invalid VS_VERSIONINFO child type "bly xm"