parentCisco.dll
filenameCisco.unpacked.dll
size40960 (0xa000)
md54820c7c6d6851224dcbaf566a1f89219
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xb8

Rich Header

lib idversiontimes used
1381691
481681

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x53a15003
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x7000
SizeOfInitializedData0x3000
SizeOfUninitializedData0
AddressOfEntryPoint0x1180
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x11000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion2.29
SubsystemVersion4.0
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual Basic v6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x69d20x7000R-X CODE
.data0x80000x3580RW- IDATA
.rsrc0x90000x9e80x1000R-- IDATA
.reloc0xa0000x3600x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x79300xa2
IMPORT0x77640x28
RESOURCE0x90000x9e8
EXCEPTION00
SECURITY00
BASERELOC0xa0000x33c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
TYPELIB#116681200
_IID_PRO#1201200
VERSION#15761200
module_namehintordfunction_name
MSVBVM60.DLLEVENT_SINK_GetIDsOfNames
MSVBVM60.DLLMethCallEngine
MSVBVM60.DLLEVENT_SINK_Invoke
MSVBVM60.DLL516
MSVBVM60.DLL558
MSVBVM60.DLLZombie_GetTypeInfo
MSVBVM60.DLLEVENT_SINK2_Release
MSVBVM60.DLL520
MSVBVM60.DLL631
MSVBVM60.DLL632
MSVBVM60.DLLEVENT_SINK_AddRef
MSVBVM60.DLL528
MSVBVM60.DLL561
MSVBVM60.DLLZombie_GetTypeInfoCount
MSVBVM60.DLLEVENT_SINK_Release
MSVBVM60.DLLEVENT_SINK_QueryInterface
MSVBVM60.DLL__vbaExceptHandler
MSVBVM60.DLL712
MSVBVM60.DLL713
MSVBVM60.DLL608
MSVBVM60.DLL716
MSVBVM60.DLL319
MSVBVM60.DLL537
MSVBVM60.DLL573
MSVBVM60.DLLEVENT_SINK2_AddRef
MSVBVM60.DLL685
MSVBVM60.DLL101
MSVBVM60.DLL102
MSVBVM60.DLL103
MSVBVM60.DLL689
MSVBVM60.DLL104
MSVBVM60.DLL105
MSVBVM60.DLL320
MSVBVM60.DLL321
MSVBVM60.DLL617
MSVBVM60.DLL619
MSVBVM60.DLL581
ordentry_vafunction_name
10x3896DllCanUnloadNow
20x386aDllGetClassObject
30x3880DllRegisterServer
40x3854DllUnregisterServer
module_nameCisco.dll
flags0
timestamp2014-06-18 08:38:27
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x7968
Functions(4)0x7958
NameOrdinals(4)0x7978

StringTable 040904B0

CompanyNameMemory Unit
ProductNameAdobe
FileVersion2.29.0740
ProductVersion2.29.0740
InternalNameCisco
OriginalFilenameCisco.dll
OLESelfRegister

VS_FIXEDFILEINFO

FileVersion2.29.0.740
ProductVersion2.29.0.740
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
040960DLL06/18/2014 08:38:27#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK