filenamedevlink.dll
size36965 (0x9065)
md551f1b343b0721c538e04a638f631b823
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
1472991
1081684
1043
1980345
617201
1181686
481683

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x48353967
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.0
SizeOfCode0x4000
SizeOfInitializedData0x4000
SizeOfUninitializedData0
AddressOfEntryPoint0x46a9
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x37a50x4000R-X CODE
.rdata0x50000x45b0x1000R-- IDATA
.data0x60000x5bc0x1000RW- IDATA
.rsrc0x70000x3a00x1000R-- IDATA
.reloc0x80000x2240x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x53e00x7b
IMPORT0x51100x50
RESOURCE0x70000x3a0
EXCEPTION00
SECURITY00
BASERELOC0x80000x208
DEBUG0x50c00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x50000xb8
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18280
module_namehintordfunction_name
KERNEL32.dll663SleepEx
KERNEL32.dll662Sleep
KERNEL32.dll126ExitThread
KERNEL32.dll27CloseHandle
KERNEL32.dll74CreateThread
KERNEL32.dll102EnterCriticalSection
KERNEL32.dll449LeaveCriticalSection
KERNEL32.dll426InitializeCriticalSection
KERNEL32.dll501OutputDebugStringA
WS2_32.dll116
WS2_32.dll115
WS2_32.dll20
WS2_32.dll17
WS2_32.dll9
WS2_32.dll3
WS2_32.dll23
WS2_32.dll2
WS2_32.dll10
WS2_32.dll11
WS2_32.dll8
MSVCRT.dll85__dllonexit
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll271_initterm
MSVCRT.dll732vsprintf
MSVCRT.dll599fopen
MSVCRT.dll610fseek
MSVCRT.dll600fprintf
MSVCRT.dll588fclose
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll402_purecall
MSVCRT.dll579clock
MSVCRT.dll690sprintf
MSVCRT.dll704strncmp
MSVCRT.dll712strtol
MSVCRT.dll705strncpy
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll713strtoul
MSVCRT.dll573atoi
MSVCRT.dll711strtok
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll390_onexit
ordentry_vafunction_name
10x1040DLClose
20x1000DLOpen
30x1050DLRegisterType2CallDeltas
module_nameDEVLINK.DLL
flags0
timestamp2008-05-22 09:14:15
version0.0
ordinal_base1
nFunctions3
nNames3
Names(3)0x5414
Functions(3)0x5408
NameOrdinals(3)0x5420

StringTable 080904b0

Comments
CompanyNameAvaya
FileDescriptiondevlink
FileVersion1, 0, 0, 5
InternalNamedevlink
LegalCopyrightCopyright © 2001 Avaya
LegalTrademarks
OriginalFilenamedevlink.dll
PrivateBuild
ProductNameAvaya DevLink DLL
ProductVersion1, 0, 0, 5
SpecialBuild

VS_FIXEDFILEINFO

FileVersion1.0.0.5
ProductVersion1.0.0.5
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
036864DLL05/22/2008 09:14:15#
15c115HTM#
9000101BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK