filenamesysdllR.dll
size5817856 (0x58c600)
md53343b05a8756e936936243c286cd7bbb
typePE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
147210222
225208064
221210053
199411181
2232100511
2242100512
225210057
22531101145
203655012
10118
22431101256
220311011
219210051
222311011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5786616f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion12.0
SizeOfCode0xca000
SizeOfInitializedData0x66c600
SizeOfUninitializedData0
AddressOfEntryPoint0xcae46
BaseOfCode0x1000
BaseOfData0xcb000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x73a000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000xc9e4c0xca000R-X CODE
.rdata0xcb0000x4a38fa0x4a3a00R-- IDATA
.data0x56f0000x1be2100x14000RW- IDATA
.rsrc0x72e0000x1e00x200R-- IDATA
.reloc0x72f0000xa4440xa600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x56dff00x54
IMPORT0x56e0440x50
RESOURCE0x72e0000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x72f0000xa444
DEBUG0xcb2400x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x564b600x40
Bound_IAT00
IAT0xcb0000x1e4
Delay_IAT00
CLR_Header0x4e2b340x48
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
MSVCR120D.dll740_free_dbg
MSVCR120D.dll366_CrtSetCheckCount
MSVCR120D.dll837_initterm
MSVCR120D.dll838_initterm_e
MSVCR120D.dll642_crt_debugger_hook
MSVCR120D.dll462__crtUnhandledException
MSVCR120D.dll461__crtTerminateProcess
MSVCR120D.dll1384_vsnprintf_s
MSVCR120D.dll971_lock
MSVCR120D.dll1343_unlock
MSVCR120D.dll349_CrtDbgReportW
MSVCR120D.dll603_calloc_dbg
MSVCR120D.dll464__dllonexit
MSVCR120D.dll1139_onexit
MSVCR120D.dll430__clean_type_info_names_internal
MSVCR120D.dll685_except_handler4_common
MSVCR120D.dll1990wcscpy_s
MSVCR120D.dll989_malloc_dbg
MSVCR120D.dll1535_wsplitpath_s
MSVCR120D.dll1820malloc
MSVCR120D.dll580_amsg_exit
MSVCR120D.dll401__CppXcptFilter
MSVCR120D.dll343_CRT_RTC_INITW
MSVCR120D.dll1347_vacopy
MSVCR120D.dll1898sqrt
MSVCR120D.dll1833memmove
MSVCR120D.dll1905strcmp
MSVCR120D.dll1932strtoul
MSVCR120D.dll1949tolower
MSVCR120D.dll1765isgraph
MSVCR120D.dll1771isupper
MSVCR120D.dll1917strncpy
MSVCR120D.dll1916strncmp
MSVCR120D.dll1902strcat
MSVCR120D.dll1831memcpy
MSVCR120D.dll1907strcpy
MSVCR120D.dll1830memcmp
MSVCR120D.dll1722fopen
MSVCR120D.dll1679exit
MSVCR120D.dll1835memset
MSVCR120D.dll1732free
MSVCR120D.dll1923strstr
MSVCR120D.dll1921strrchr
MSVCR120D.dll1913strlen
MSVCR120D.dll1903strcat_s
MSVCR120D.dll1908strcpy_s
MSVCR120D.dll1874rename
MSVCR120D.dll1813longjmp
MSVCR120D.dll1204_setjmp3
MSVCR120D.dll1864rand
MSVCR120D.dll1899srand
MSVCR120D.dll1687fabs
MSVCR120D.dll1646cos
MSVCR120D.dll1803log10
MSVCR120D.dll1853pow
MSVCR120D.dll1894sin
MSVCR120D.dll1940tan
MSVCR120D.dll1566abs
MSVCR120D.dll1896sprintf
MSVCR120D.dll1733freopen
MSVCR120D.dll748_fseeki64
MSVCR120D.dll756_ftelli64
MSVCR120D.dll682_except1
MSVCR120D.dll1870remove
MSVCR120D.dll1743fwrite
MSVCR120D.dll1740ftell
MSVCR120D.dll1738fseek
MSVCR120D.dll1730fread
MSVCR120D.dll1723fopen_s
MSVCR120D.dll1706fgetc
MSVCR120D.dll1705fflush
MSVCR120D.dll1699ferror
MSVCR120D.dll1697feof
MSVCR120D.dll1688fclose
MSVCR120D.dll1501_wmakepath_s
MSVCR120D.dll112void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCR120D.dll604_cexit
MSVCR120D.dll412__FrameUnwindFilter
KERNEL32.dll173CreateDirectoryA
KERNEL32.dll1447WaitCommEvent
KERNEL32.dll1211SetCommTimeouts
KERNEL32.dll1210SetCommState
KERNEL32.dll1209SetCommMask
KERNEL32.dll1358SetupComm
KERNEL32.dll127CloseHandle
KERNEL32.dll1505WriteFile
KERNEL32.dll1104ReadFile
KERNEL32.dll186CreateFileA
KERNEL32.dll754GetTickCount
KERNEL32.dll1362Sleep
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll414FreeLibrary
KERNEL32.dll1443VirtualQuery
KERNEL32.dll674GetProcessHeap
KERNEL32.dll819HeapFree
KERNEL32.dll815HeapAlloc
KERNEL32.dll275DisableThreadLibraryCalls
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll669GetProcAddress
KERNEL32.dll1088RaiseException
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll254DecodePointer
KERNEL32.dll289EncodePointer
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll592GetLastError
KERNEL32.dll381FindNextFileA
KERNEL32.dll364FindFirstFileA
KERNEL32.dll360FindClose
KERNEL32.dll97BuildCommDCBA
mscoree.dll118_CorDllMain
ordentry_vafunction_name
10x1140setexternalentrypoint
module_namesysdllR.dll
flags0
timestamp2016-07-13 15:42:39
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x56e01c
Functions(1)0x56e018
NameOrdinals(1)0x56e020
offsetsizetypecomment
15c115HTM#
55bc8027235ZIP#
5626e3171805BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK