filenamepyexpat.pyd
size164352 (0x28200)
md519a58b99fadfaa94ca3a1e1e10c59a6c
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
131307299
132307292
147307297
1091
137307294
146307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x5560ae6c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x1c200
SizeOfInitializedData0xbe00
SizeOfUninitializedData0
AddressOfEntryPoint0x1cbd0
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x2c000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x1c0110x1c200R-X CODE
.rdata0x1e0000x7f6a0x8000R-- IDATA
.data0x260000x15800x1400RW- IDATA
.pdata0x280000x21d80x2200R-- IDATA
.reloc0x2b0000x5300x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x25f200x4a
IMPORT0x255500x50
RESOURCE00
EXCEPTION0x280000x21d8
SECURITY00
BASERELOC0x2b0000x3b0
DEBUG0x1e3200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x1e0000x2f0
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
python27.dll154PyErr_Occurred
python27.dll421PyModule_AddIntConstant
python27.dll173PyErr_SetString
python27.dll945_PyObject_GC_New
python27.dll693PyTraceBack_Here
python27.dll516PyObject_GC_Track
python27.dll1032_Py_TrueStruct
python27.dll150PyErr_NewException
python27.dll8PyArg_ParseTupleAndKeywords
python27.dll701PyTuple_Pack
python27.dll711PyType_Type
python27.dll423PyModule_AddStringConstant
python27.dll755PyUnicodeUCS2_Decode
python27.dll533PyObject_IsTrue
python27.dll517PyObject_GC_UnTrack
python27.dll1023_Py_HashSecret
python27.dll357PyList_New
python27.dll236PyExc_RuntimeError
python27.dll148PyErr_Format
python27.dll422PyModule_AddObject
python27.dll245PyExc_TypeError
python27.dll147PyErr_Fetch
python27.dll521PyObject_GetAttrString
python27.dll764PyUnicodeUCS2_DecodeUTF8
python27.dll351PyList_Append
python27.dll253PyExc_ValueError
python27.dll424PyModule_GetDict
python27.dll834Py_FindMethod
python27.dll853Py_InitModule4_64
python27.dll7PyArg_ParseTuple
python27.dll1025_Py_NoneStruct
python27.dll544PyObject_SetAttrString
python27.dll133PyDict_SetItem
python27.dll208PyExc_AttributeError
python27.dll1034_Py_ZeroStruct
python27.dll172PyErr_SetObject
python27.dll64PyCapsule_New
python27.dll500PyObject_CallFunction
python27.dll289PyFrame_New
python27.dll81PyCode_NewEmpty
python27.dll427PyModule_New
python27.dll183PyEval_CallObjectWithKeywords
python27.dll152PyErr_NoMemory
python27.dll515PyObject_GC_Del
python27.dll975_PyThreadState_Current
python27.dll629PyString_AsString
python27.dll331PyInt_AsLong
python27.dll125PyDict_GetItem
python27.dll641PyString_FromStringAndSize
python27.dll820Py_BuildValue
python27.dll337PyInt_FromLong
python27.dll131PyDict_New
python27.dll700PyTuple_New
python27.dll158PyErr_Restore
python27.dll499PyObject_Call
python27.dll656PySys_GetObject
python27.dll193PyEval_GetGlobals
python27.dll144PyErr_Clear
python27.dll640PyString_FromString
MSVCR90.dll1263memcmp
MSVCR90.dll1264memcpy
MSVCR90.dll740_onexit
MSVCR90.dll573_lock
MSVCR90.dll133__dllonexit
MSVCR90.dll932_unlock
MSVCR90.dll123__clean_type_info_names_internal
MSVCR90.dll90__CppXcptFilter
MSVCR90.dll89__C_specific_handler
MSVCR90.dll226_amsg_exit
MSVCR90.dll301_decode_pointer
MSVCR90.dll312_encoded_null
MSVCR90.dll463_initterm_e
MSVCR90.dll462_initterm
MSVCR90.dll590_malloc_crt
MSVCR90.dll311_encode_pointer
MSVCR90.dll904_time64
MSVCR90.dll1286realloc
MSVCR90.dll1305srand
MSVCR90.dll1284rand
MSVCR90.dll1266memmove
MSVCR90.dll1253malloc
MSVCR90.dll1196free
MSVCR90.dll1301sprintf
MSVCR90.dll1268memset
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll226DisableThreadLibraryCalls
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll1216Sleep
KERNEL32.dll666GetTickCount
KERNEL32.dll937QueryPerformanceCounter
ordentry_vafunction_name
10x4970initpyexpat
module_namepyexpat.pyd
flags0
timestamp2015-05-23 16:44:27
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x25f4c
Functions(1)0x25f48
NameOrdinals(1)0x25f50
offsetsizetypecomment
15c115HTM#
15d0158768BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK