Dll Connector.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	Dll Connector.exe
size	877568 (0xd6400)
md5	2c8254c698a21e06ba15178a3d17cbfe

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
205	50929	2
206	50929	19
207	50929	4
203	50929	4
147	30729	13
1	0	131
211	61030	4
201	61030	1
151	0	1
204	61030	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x575993b5
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	11.0
SizeOfCode	0x2e00
SizeOfInitializedData	0x6a800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x12c382
BaseOfCode	0x1000
BaseOfData	0x4000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x1f0000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

PolyEnE 0.01+ by Lennart Hedlund

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2d6b	0	R-X CODE
.rdata	0x4000	0x1790	0	R-- IDATA
.data	0x6000	0x388c	0	RW- IDATA
.slon0	0xa000	0x10ede1	0	RWX CODE IDATA
.slon1	0x119000	0xcae30	0xcb000	RWX CODE IDATA
.reloc	0x1e4000	0x60	0x200	R-- IDATA
.rsrc	0x1e5000	0xacf0	0xae00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x119588	0xdc
RESOURCE	0x1e5000	0xacf0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x1e4000	0x60
DEBUG	0x1e3df0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x1e3d44	0x40
Bound_IAT	0	0
IAT	0x12b000	0x64
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	43378
GROUP_ICON	#102	20
MANIFEST	#1	640

module_name	hint	ord	function_name
KERNEL32.dll			FreeEnvironmentStringsW
USER32.dll			GetMessageA
GDI32.dll			SetTextColor
COMDLG32.dll			GetOpenFileNameA
SHELL32.dll			DragFinish
MSVCP110.dll			char const * __cdecl std::_Winerror_map(int) ?_Winerror_map@std@@YAPBDH@Z
WININET.dll			InternetReadFile
MSVCR110.dll			_onexit
KERNEL32.dll			GetModuleFileNameW
KERNEL32.dll			GetModuleHandleA
KERNEL32.dll			LoadLibraryA
KERNEL32.dll			LocalAlloc
KERNEL32.dll			LocalFree
KERNEL32.dll			GetModuleFileNameA
KERNEL32.dll			ExitProcess

show previews

offset	size	type	comment
0	877568	EXE	06/09/2016 16:05:09	#
15c1	15	HTM		#
cb6e8	43378	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER