filenamecryptlib.dll
size60928 (0xee00)
md51d54c6f173918050d564ddd9a379adb0
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x318f0d9d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion3.0
SizeOfCode0x8800
SizeOfInitializedData0x7400
SizeOfUninitializedData0
AddressOfEntryPoint0x62c0
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x14000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C v2.0

Sections

namevavsizeraw sizeflags
.text0x10000x86180x8800R-X CODE
.rdata0xa0000x25c0x400R-- IDATA
.data0xb0000x5bd80x4a00RW- IDATA
.idata0x110000x5180x600RW- IDATA
.rsrc0x120000x3900x400R-- IDATA
.reloc0x130000x84c0xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xa0b00x1ac
IMPORT0x110000x28
RESOURCE0x120000x390
EXCEPTION00
SECURITY00
BASERELOC0x130000x5ac
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x110ec0xc4
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18140
module_namehintordfunction_name
KERNEL32.dll246GetOEMCP
KERNEL32.dll345HeapFree
KERNEL32.dll226GetLocalTime
KERNEL32.dll159GetCommandLineA
KERNEL32.dll259GetProcAddress
KERNEL32.dll235GetModuleHandleA
KERNEL32.dll311GetVersion
KERNEL32.dll341HeapCreate
KERNEL32.dll343HeapDestroy
KERNEL32.dll98ExitProcess
KERNEL32.dll199GetCurrentThreadId
KERNEL32.dll546TlsSetValue
KERNEL32.dll543TlsAlloc
KERNEL32.dll544TlsFree
KERNEL32.dll509SetLastError
KERNEL32.dll545TlsGetValue
KERNEL32.dll225GetLastError
KERNEL32.dll506SetHandleCount
KERNEL32.dll220GetFileType
KERNEL32.dll278GetStdHandle
KERNEL32.dll276GetStartupInfoA
KERNEL32.dll68DeleteCriticalSection
KERNEL32.dll233GetModuleFileNameA
KERNEL32.dll152GetCPInfo
KERNEL32.dll146GetACP
KERNEL32.dll339HeapAlloc
KERNEL32.dll139FreeEnvironmentStringsA
KERNEL32.dll403MultiByteToWideChar
KERNEL32.dll208GetEnvironmentStrings
KERNEL32.dll140FreeEnvironmentStringsW
KERNEL32.dll210GetEnvironmentStringsW
KERNEL32.dll578WideCharToMultiByte
KERNEL32.dll591WriteFile
KERNEL32.dll356InitializeCriticalSection
KERNEL32.dll79EnterCriticalSection
KERNEL32.dll375LeaveCriticalSection
KERNEL32.dll307GetTimeZoneInformation
KERNEL32.dll376LoadLibraryA
KERNEL32.dll131FlushFileBuffers
KERNEL32.dll518SetStdHandle
KERNEL32.dll504SetFilePointer
KERNEL32.dll279GetStringTypeA
KERNEL32.dll282GetStringTypeW
KERNEL32.dll28CompareStringA
KERNEL32.dll29CompareStringW
KERNEL32.dll496SetEnvironmentVariableA
KERNEL32.dll22CloseHandle
KERNEL32.dll348HeapReAlloc
ordentry_vafunction_name
10x2f90decryptBuffer
20x2be0destroyCryptContext
30x2df0encryptBuffer
40x29f0endLibrary
50x2a40initCryptContext
60x2b00initCryptContextEx
70x2980initLibrary
80x2c30loadCryptContext
90x2cd0loadIV
100x2840queryAlgoAvailability
110x2850queryAlgoModeInformation
120x2950queryContextInformation
130x27a0queryModeAvailability
140x2d80retrieveIV
module_namecryptlib.dll
flags0
timestamp1996-05-07 08:45:17
version0.0
ordinal_base1
nFunctions14
nNames14
Names(14)0xa110
Functions(14)0xa0d8
NameOrdinals(14)0xa148

StringTable 040904E4

CompanyNamePeter Gutmann et al.
FileDescriptionEncryption library.
FileVersion0.95
InternalNameCRYPT.DLL
LegalCopyrightCopyright © Peter Gutmann, Eric Young, Colin Plumb 1994, 1995.
OriginalFilenameCRYPT.DLL
ProductNameEncryption library.
ProductVersion0.95

VS_FIXEDFILEINFO

FileVersion0.0.0.95
ProductVersion0.0.0.95
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40000
FileType2
FileSubtype0
offsetsizetypecomment
060928DLL05/07/1996 08:45:17#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK