30841DFD9B3AE6580974CFA6B26C6FAF20EBF10AF56F47ED13F55C6017F10F9C.bin - lsass.exe

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	30841DFD9B3AE6580974CFA6B26C6FAF20EBF10AF56F47ED13F55C6017F10F9C.bin
size	22528 (0x5800)
md5	3abdb971e97a59e6749b160e17335d7a

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
132	30729	1
149	30729	1
1	0	95
147	30729	33
131	30729	28
146	30729	1
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4dce0b9a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x122
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x4200
SizeOfInitializedData	0x1000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2f35
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x9000
SizeOfHeaders	0x600
CheckSum	0x102b8
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x6000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x40d6	0x4200	R-X CODE
.data	0x6000	0x3cc	0x400	RW- IDATA
.rsrc	0x7000	0x708	0x800	R-- IDATA
.reloc	0x8000	0x368	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x2004	0x6b
IMPORT	0x4470	0x154
RESOURCE	0x7000	0x708
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x8000	0x368
DEBUG	0x5078	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x3f88	0x40
Bound_IAT	0x280	0x294
IAT	0x1000	0x1ac
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	936	0
MANIFEST	#1	702	0

module_name	hint	function_name
msvcrt.dll	185	__p__commode
msvcrt.dll	190	__p__fmode
msvcrt.dll	212	__setusermatherr
msvcrt.dll	210	__set_app_type
msvcrt.dll	55	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	345	_except_handler4_common
msvcrt.dll	295	_controlfp
msvcrt.dll	257	_amsg_exit
msvcrt.dll	469	_initterm
msvcrt.dll	1167	exit
msvcrt.dll	106	_XcptFilter
msvcrt.dll	354	_exit
msvcrt.dll	276	_cexit
msvcrt.dll	145	__getmainargs
msvcrt.dll	1258	memcpy
msvcrt.dll	1262	memset
msvcrt.dll	1303	strcpy_s
msvcrt.dll	972	_vsnprintf_s
ntdll.dll	239	NtCreatePort
ntdll.dll	221	NtConnectPort
ntdll.dll	318	NtListenPort
ntdll.dll	162	NtAcceptConnectPort
ntdll.dll	219	NtCompleteConnectPort
ntdll.dll	459	NtReplyWaitReceivePort
ntdll.dll	1005	RtlLengthRequiredSid
ntdll.dll	944	RtlInitializeSid
ntdll.dll	1190	RtlSubAuthoritySid
ntdll.dll	511	NtSetSecurityObject
ntdll.dll	341	NtOpenEvent
ntdll.dll	840	RtlFreeHeap
ntdll.dll	611	RtlAllocateHeap
ntdll.dll	1044	RtlNtStatusToDosError
ntdll.dll	1162	RtlSetProcessIsCritical
ntdll.dll	497	NtSetInformationProcess
ntdll.dll	924	RtlInitUnicodeString
ntdll.dll	343	NtOpenFile
ntdll.dll	270	NtDeviceIoControlFile
ntdll.dll	493	NtSetInformationFile
ntdll.dll	699	RtlCreateSecurityDescriptor
ntdll.dll	1007	RtlLengthSid
ntdll.dll	1160	RtlSetOwnerSecurityDescriptor
ntdll.dll	682	RtlCreateAcl
ntdll.dll	585	RtlAddAccessAllowedAce
ntdll.dll	1147	RtlSetDaclSecurityDescriptor
ntdll.dll	609	RtlAllocateAndInitializeSid
ntdll.dll	600	RtlAddMandatoryAce
ntdll.dll	1164	RtlSetSaclSecurityDescriptor
ntdll.dll	1027	RtlMakeSelfRelativeSD
ntdll.dll	1215	RtlUnhandledExceptionFilter
ntdll.dll	33	DbgPrintEx
ntdll.dll	463	NtRequestWaitReplyPort
RPCRT4.dll	62	I_RpcMapWin32Status
RPCRT4.dll	446	RpcServerRegisterIf2
RPCRT4.dll	442	RpcServerListen
RPCRT4.dll	461	RpcServerUseProtseqEpW
RPCRT4.dll	283	NdrServerCall2
SspiSrv.dll	1	SspiSrvInitialize
SspiSrv.dll		SspiSrvClientCallback
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	5	SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	3	SetErrorMode
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	4	SetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	6	UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	1	GetLastError
API-MS-Win-Core-Handle-L1-1-0.dll		CloseHandle
API-MS-Win-Core-Interlocked-L1-1-0.dll	1	InterlockedCompareExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll	4	InterlockedExchange
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	13	GetProcAddress
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	15	LoadLibraryExW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	9	GetModuleHandleA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	30	RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	25	RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll		RegCloseKey
API-MS-Win-Core-Misc-L1-1-0.dll	10	LocalAlloc
API-MS-Win-Core-Misc-L1-1-0.dll	11	LocalFree
API-MS-Win-Core-Misc-L1-1-0.dll	19	Sleep
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll	12	GetEnvironmentVariableW
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll	19	SetEnvironmentVariableW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	26	OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10	GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	8	ExitThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	5	CreateThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13	GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11	GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42	TerminateProcess
API-MS-Win-Core-Profile-L1-1-0.dll		QueryPerformanceCounter
API-MS-Win-Core-Synch-L1-1-0.dll	32	SetEvent
API-MS-Win-Core-Synch-L1-1-0.dll	21	OpenEventW
API-MS-Win-Core-Synch-L1-1-0.dll	6	CreateEventW
API-MS-Win-Core-SysInfo-L1-1-0.dll	11	GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll	14	GetTickCount
API-MS-Win-Security-Base-L1-1-0.dll	58	GetTokenInformation

ord	entry_va	function_name
1	0x2eee	LsaGetInterface
2	0x23c1	LsaRegisterExtension

module_name	lsass.exe
flags	0
timestamp	2011-05-14 04:56:58
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x2034
Functions(2)	0x202c
NameOrdinals(2)	0x203c

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Local Security Authority Process
FileVersion	6.1.7601.21728 (win7sp1_ldr.110513-1659)
InternalName	lsass.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	lsass.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.21728

VS_FIXEDFILEINFO

FileVersion	6.1.7601.21728
ProductVersion	6.1.7601.21728
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	22528	EXE	05/14/2011 04:56:58	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x280

30841DFD9B3AE6580974CFA6B26C6FAF20EBF10AF56F47ED13F55C6017F10F9C.bin-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

30841DFD9B3AE6580974CFA6B26C6FAF20EBF10AF56F47ED13F55C6017F10F9C.bin
-