filenameUAD2Dll.dll
size28672 (0x7000)
md52311b697e99d6be902c6059bcb7ba1e5
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
147210223
149210221
1312102211
123507272
1045
132210229
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x4f5c0183
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3400
SizeOfInitializedData0x3c00
SizeOfUninitializedData0
AddressOfEntryPoint0x110c8
BaseOfCode0x1000
BaseOfData0x1000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000x329f0x3400R-X CODE
.rdata0x150000x18ca0x1a00R-- IDATA
.data0x170000x56c0x200RW- IDATA
.idata0x180000x73b0x800RW- IDATA
.rsrc0x190000xc090xe00R-- IDATA
.reloc0x1a0000x4210x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x180000x3c
RESOURCE0x190000xc09
EXCEPTION00
SECURITY00
BASERELOC0x1a0000x2a4
DEBUG0x155200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x181680x12c
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#26630
module_namehintordfunction_name
MSVCR90D.dll383_crt_debugger_hook
MSVCR90D.dll424_except_handler4_common
MSVCR90D.dll856_onexit
MSVCR90D.dll688_lock
MSVCR90D.dll186__dllonexit
MSVCR90D.dll1060_unlock
MSVCR90D.dll176__clean_type_info_names_internal
MSVCR90D.dll142__CppXcptFilter
MSVCR90D.dll306_adjust_fdiv
MSVCR90D.dll324_amsg_exit
MSVCR90D.dll576_initterm_e
MSVCR90D.dll575_initterm
MSVCR90D.dll114_CrtSetCheckCount
MSVCR90D.dll404_decode_pointer
MSVCR90D.dll416_encoded_null
MSVCR90D.dll475_free_dbg
MSVCR90D.dll706_malloc_dbg
MSVCR90D.dll415_encode_pointer
MSVCR90D.dll92_CRT_RTC_INITW
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll1069TerminateProcess
KERNEL32.dll332FreeLibrary
KERNEL32.dll1116VirtualQuery
KERNEL32.dll501GetModuleFileNameW
KERNEL32.dll547GetProcessHeap
KERNEL32.dll669HeapAlloc
KERNEL32.dll673HeapFree
KERNEL32.dll753LoadLibraryA
KERNEL32.dll544GetProcAddress
KERNEL32.dll1205lstrlenA
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll180DebugBreak
KERNEL32.dll858RaiseException
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll701InterlockedExchange
KERNEL32.dll1057Sleep
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll614GetTickCount
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll426GetCurrentProcessId
offsetsizetypecomment
028672DLL03/11/2012 01:36:03#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK