filenamesbdrop.dll
size77824 (0x13000)
md515acf266c579fe03c80a5871eead703f
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
189307161
187307161
1883071613
10179
1853071631
184307161
193307168
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4fb70405
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion10.10
SizeOfCode0x3800
SizeOfInitializedData0xf800
SizeOfUninitializedData0
AddressOfEntryPoint0x3f77
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion6.2
Reserved10
SizeOfImage0x16000
SizeOfHeaders0x400
CheckSum0x21222
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x37050x3800R-X CODE
.data0x50000x9240x600RW- IDATA
.idata0x60000x9f40xa00R-- IDATA
.rsrc0x70000xd8c80xda00R-- IDATA
.reloc0x150000x81e0xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x46500xb5
IMPORT0x60000xf0
RESOURCE0x70000xd8c8
EXCEPTION00
SECURITY00
BASERELOC0x150000x468
DEBUG0x10200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x21700x40
Bound_IAT0x2b80x120
IAT0x62700x180
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12240
REGISTRY#50011980
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#7271190
ICON#896400
ICON#942640
ICON#1011280
GROUP_ICON#11460
VERSION#18880
module_namehintordfunction_name
msvcrt.dll346_except_handler4_common
msvcrt.dll1250malloc
msvcrt.dll1194free
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll257_amsg_exit
msvcrt.dll106_XcptFilter
msvcrt.dll767_purecall
msvcrt.dll977_vsnwprintf
msvcrt.dll472_initterm
msvcrt.dll1266memset
ATL.DLL21
ATL.DLL22
ATL.DLL18
ATL.DLL15
ATL.DLL23
ATL.DLL32
ATL.DLL16
ntdll.dll1505WinSqmIsOptedIn
ntdll.dll1504WinSqmIncrementDWORD
api-ms-win-core-path-l1-1-0.dll795PathCchCombine
KERNEL32.dll184CopyFileW
KERNEL32.dll878InterlockedIncrement
KERNEL32.dll836GlobalUnlock
KERNEL32.dll634GetModuleFileNameW
KERNEL32.dll238CreateProcessW
KERNEL32.dll201CreateEventW
KERNEL32.dll141CloseHandle
KERNEL32.dll301DisableThreadLibraryCalls
KERNEL32.dll866InitializeCriticalSection
KERNEL32.dll1370Sleep
KERNEL32.dll875InterlockedExchange
KERNEL32.dll872InterlockedCompareExchange
KERNEL32.dll1417UnhandledExceptionFilter
KERNEL32.dll1355SetUnhandledExceptionFilter
KERNEL32.dll546GetCurrentProcess
KERNEL32.dll1385TerminateProcess
KERNEL32.dll1081QueryPerformanceCounter
KERNEL32.dll547GetCurrentProcessId
KERNEL32.dll551GetCurrentThreadId
KERNEL32.dll753GetSystemTimeAsFileTime
KERNEL32.dll781GetTickCount
KERNEL32.dll482GetCommandLineW
KERNEL32.dll1554lstrlenW
KERNEL32.dll615GetLastError
KERNEL32.dll829GlobalLock
KERNEL32.dll842HeapAlloc
KERNEL32.dll846HeapFree
KERNEL32.dll695GetProcessHeap
KERNEL32.dll766GetTempPathW
KERNEL32.dll820GlobalDeleteAtom
KERNEL32.dll285DeleteCriticalSection
KERNEL32.dll817GlobalAddAtomW
KERNEL32.dll874InterlockedDecrement
USER32.dll694SendMessageTimeoutW
USER32.dll266FindWindowW
USER32.dll692SendMessageCallbackW
USER32.dll419GetSubMenu
USER32.dll63CheckMenuItem
USER32.dll619PostMessageW
USER32.dll6AllowSetForegroundWindow
USER32.dll464GetWindowThreadProcessId
USER32.dll182DispatchMessageW
USER32.dll824TranslateMessage
USER32.dll616PeekMessageW
USER32.dll592MsgWaitForMultipleObjects
USER32.dll488InsertMenuW
USER32.dll557LoadStringW
SHLWAPI.dll86PathGetArgsW
SHLWAPI.dll74PathFileExistsW
SHLWAPI.dll144PathRemoveFileSpecW
SHLWAPI.dll78PathFindFileNameW
ole32.dll395ReleaseStgMedium
ole32.dll25CoCreateInstance
OLEAUT32.dll6
OLEAUT32.dll8
OLEAUT32.dll4
SHELL32.dll32DragQueryFileW
SHELL32.dll21
ADVAPI32.dll600RegCloseKey
ADVAPI32.dll662RegQueryValueExW
ADVAPI32.dll649RegOpenKeyExW
ADVAPI32.dll367GetTokenInformation
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll609RegCreateKeyExW
ADVAPI32.dll678RegSetValueExW
ordentry_vafunction_name
10x2cb0DllCanUnloadNow
20x2cc1DllGetClassObject
30x2c46DllMain
40x2ce3DllRegisterServer
50x2cf8DllUnregisterServer
module_namesbdrop.dll
flags0
timestamp2012-05-18 23:52:15
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0x468c
Functions(5)0x4678
NameOrdinals(5)0x46a0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSidebar droptarget
FileVersion6.2.8400.0 (winmain_win8rc.120518-1423)
InternalNamesbdrop
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamesbdrop
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.2.8400.0

VS_FIXEDFILEINFO

FileVersion6.2.8400.0
ProductVersion6.2.8400.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
077824DLL05/19/2012 02:23:01#
15c115HTM#
7ea827119PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x2b8