filenametestdll.dll
size180224 (0x2c000)
md5290f59c7f62b9913af74ee24849bf3d5
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
2232080626
2252080666
22420806190
2036550115
10168
229210057
220210051
219210051
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x54454d11
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x1ea00
SizeOfInitializedData0x11600
SizeOfUninitializedData0
AddressOfEntryPoint0xa039
BaseOfCode0x1000
BaseOfData0x20000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x33000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1e9c80x1ea00R-X CODE
.rdata0x200000x920a0x9400R-- IDATA
.data0x2a0000x5f8c0x1c00RW- IDATA
.rsrc0x300000x1e00x200R-- IDATA
.reloc0x310000x1ee00x2000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x284000x60
IMPORT0x284600xa0
RESOURCE0x300000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x310000x1ee0
DEBUG0x203200x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x26b100x40
Bound_IAT00
IAT0x200000x294
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
USER32.dll262FindWindowA
USER32.dll582MessageBoxA
WS2_32.dll57
WS2_32.dll4
WS2_32.dll12
WS2_32.dll115
WS2_32.dll8
WS2_32.dll9
WS2_32.dll21
WS2_32.dll116
WS2_32.dll16
WS2_32.dll10
WS2_32.dll23
WS2_32.dll3
WS2_32.dll51
WS2_32.dll52
WS2_32.dll19
WS2_32.dll7
WS2_32.dll13
WS2_32.dll1
WS2_32.dll11
WS2_32.dll2
IPHLPAPI.DLL62GetAdaptersInfo
KERNEL32.dll646GetOEMCP
KERNEL32.dll882IsValidCodePage
KERNEL32.dll194CreateFileW
KERNEL32.dll1101ReadConsoleW
KERNEL32.dll1502WriteConsoleW
KERNEL32.dll1312SetStdHandle
KERNEL32.dll1018OutputDebugStringW
KERNEL32.dll212CreatePipe
KERNEL32.dll289EncodePointer
KERNEL32.dll254DecodePointer
KERNEL32.dll293EnterCriticalSection
KERNEL32.dll930LeaveCriticalSection
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll1483WideCharToMultiByte
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll709GetStringTypeW
KERNEL32.dll337ExitProcess
KERNEL32.dll740GetThreadContext
KERNEL32.dll822HeapReAlloc
KERNEL32.dll186CreateFileA
KERNEL32.dll1178RemoveVectoredExceptionHandler
KERNEL32.dll108CancelSynchronousIo
KERNEL32.dll1322SetThreadContext
KERNEL32.dll960MapViewOfFile
KERNEL32.dll1411UnmapViewOfFile
KERNEL32.dll414FreeLibrary
KERNEL32.dll815HeapAlloc
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll819HeapFree
KERNEL32.dll1036Process32First
KERNEL32.dll1287SetHandleInformation
KERNEL32.dll1449WaitForSingleObject
KERNEL32.dll148ConnectNamedPipe
KERNEL32.dll754GetTickCount
KERNEL32.dll525GetCurrentThread
KERNEL32.dll674GetProcessHeap
KERNEL32.dll783GetWindowsDirectoryA
KERNEL32.dll1442VirtualQueryEx
KERNEL32.dll1503WriteFile
KERNEL32.dll1006OpenProcess
KERNEL32.dll1391Thread32First
KERNEL32.dll1437VirtualFreeEx
KERNEL32.dll1376TerminateThread
KERNEL32.dll596GetLocaleInfoW
KERNEL32.dll1360Sleep
KERNEL32.dll1106ReadProcessMemory
KERNEL32.dll818HeapDestroy
KERNEL32.dll817HeapCreate
KERNEL32.dll556GetExitCodeProcess
KERNEL32.dll221CreateRemoteThreadEx
KERNEL32.dll215CreateProcessA
KERNEL32.dll1375TerminateProcess
KERNEL32.dll1392Thread32Next
KERNEL32.dll1103ReadFile
KERNEL32.dll716GetSystemDirectoryA
KERNEL32.dll552GetEnvironmentVariableA
KERNEL32.dll278DisconnectNamedPipe
KERNEL32.dll964Module32First
KERNEL32.dll592GetLastError
KERNEL32.dll1290SetLastError
KERNEL32.dll669GetProcAddress
KERNEL32.dll210CreateNamedPipeA
KERNEL32.dll1440VirtualProtectEx
KERNEL32.dll1434VirtualAllocEx
KERNEL32.dll1013OpenThread
KERNEL32.dll1038Process32Next
KERNEL32.dll187CreateFileMappingA
KERNEL32.dll19AddVectoredExceptionHandler
KERNEL32.dll557GetExitCodeThread
KERNEL32.dll720GetSystemInfo
KERNEL32.dll1276SetFilePointerEx
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll934LoadLibraryExA
KERNEL32.dll206CreateMutexA
KERNEL32.dll514GetCurrentDirectoryA
KERNEL32.dll241CreateToolhelp32Snapshot
KERNEL32.dll1017OutputDebugStringA
KERNEL32.dll966Module32Next
KERNEL32.dll127CloseHandle
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll738GetTempPathA
KERNEL32.dll997OpenFileMappingA
KERNEL32.dll121CheckRemoteDebuggerPresent
KERNEL32.dll1512WriteProcessMemory
KERNEL32.dll1191ResumeThread
KERNEL32.dll263DeleteFileA
KERNEL32.dll232CreateThread
KERNEL32.dll755GetTickCount64
KERNEL32.dll456GetCommandLineA
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll1087RaiseException
KERNEL32.dll1196RtlUnwind
KERNEL32.dll435GetCPInfo
KERNEL32.dll1408UnhandledExceptionFilter
KERNEL32.dll1345SetUnhandledExceptionFilter
KERNEL32.dll840InitializeCriticalSectionAndSpinCount
KERNEL32.dll1393TlsAlloc
KERNEL32.dll1395TlsGetValue
KERNEL32.dll1396TlsSetValue
KERNEL32.dll1394TlsFree
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll918LCMapStringW
KERNEL32.dll884IsValidLocale
KERNEL32.dll764GetUserDefaultLCID
KERNEL32.dll327EnumSystemLocalesW
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll824HeapSize
KERNEL32.dll704GetStdHandle
KERNEL32.dll574GetFileType
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll551GetEnvironmentStringsW
KERNEL32.dll413FreeEnvironmentStringsW
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll420GetACP
KERNEL32.dll402FlushFileBuffers
KERNEL32.dll476GetConsoleCP
KERNEL32.dll494GetConsoleMode
KERNEL32.dll935LoadLibraryExW
ADVAPI32.dll428LookupPrivilegeValueA
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll673RegSetValueExA
ADVAPI32.dll657RegQueryValueExA
ADVAPI32.dll619RegDeleteValueA
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll631RegFlushKey
ADVAPI32.dll377GetUserNameA
ADVAPI32.dll604RegCreateKeyExA
SHELL32.dll307ShellExecuteA
WININET.dll31DeleteUrlCacheEntryA
ordentry_vafunction_name
10x14e0?EntryPoint@@YGKPAUEntryParam@@@Z
module_nametestdll.dll
flags0
timestamp2014-10-20 17:57:36
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x2842c
Functions(1)0x28428
NameOrdinals(1)0x28430
offsetsizetypecomment
0180224DLL10/20/2014 17:57:37#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK