filenamesacsvr.dll
size12288 (0x3000)
md5562c66c6cf8f8a36dd2d062742346fb6
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1521791
93217911
1057
9221791
9521909
9421791
9021791

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x3e8122f1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion7.10
SizeOfCode0x2000
SizeOfInitializedData0xc00
SizeOfUninitializedData0
AddressOfEntryPoint0x2639
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x5d100000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion5.2
SubsystemVersion4.0
Reserved10
SizeOfImage0x6000
SizeOfHeaders0x400
CheckSum0x3bf1
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1f830x2000R-X CODE
.data0x30000x680x200RW- IDATA
.rsrc0x40000x4cc0x600R-- IDATA
.reloc0x50000x2c00x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x2f000x83
IMPORT0x29780x78
RESOURCE0x40000x4cc
EXCEPTION00
SECURITY00
BASERELOC0x50000x1f4
DEBUG0x10f00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x17780x40
Bound_IAT0x2780x74
IAT0x10000xf0
Delay_IAT00
CLR_Header00
typenamesizecp
MESSAGETABLE#11401252
VERSION#19281252
module_namehintordfunction_name
KERNEL32.dll132DisableThreadLibraryCalls
KERNEL32.dll408GetProcAddress
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll665QueryPerformanceCounter
KERNEL32.dll469GetTickCount
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll315GetCurrentProcessId
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll778SetErrorMode
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll829SetUnhandledExceptionFilter
KERNEL32.dll378GetModuleHandleW
KERNEL32.dll361GetLastError
KERNEL32.dll46CloseHandle
KERNEL32.dll899WaitForMultipleObjects
KERNEL32.dll338GetExitCodeProcess
KERNEL32.dll245GetACP
KERNEL32.dll374GetModuleFileNameW
KERNEL32.dll99CreateProcessW
KERNEL32.dll442GetSystemDirectoryW
KERNEL32.dll960lstrlenW
KERNEL32.dll131DeviceIoControl
KERNEL32.dll80CreateFileW
KERNEL32.dll779SetEvent
KERNEL32.dll74CreateEventW
KERNEL32.dll849TerminateProcess
msvcrt.dll562_wcsicmp
msvcrt.dll830wcsstr
msvcrt.dll820wcscpy
msvcrt.dll828wcsrchr
msvcrt.dll817wcschr
msvcrt.dll493_snwprintf
msvcrt.dll687free
msvcrt.dll738malloc
msvcrt.dll823wcslen
msvcrt.dll242_except_handler3
ntdll.dll148NtCreateFile
ntdll.dll600RtlFindMessage
ntdll.dll660RtlInitAnsiString
ntdll.dll444RtlAnsiStringToUnicodeString
ntdll.dll514RtlCreateUnicodeString
ntdll.dll667RtlInitUnicodeString
ADVAPI32.dll516RegisterServiceCtrlHandlerW
ADVAPI32.dll457RegCloseKey
ADVAPI32.dll506RegSetValueExW
ADVAPI32.dll483RegOpenKeyExW
ADVAPI32.dll463RegCreateKeyW
ADVAPI32.dll62CloseServiceHandle
ADVAPI32.dll577StartServiceW
ADVAPI32.dll430OpenServiceW
ADVAPI32.dll428OpenSCManagerW
ADVAPI32.dll462RegCreateKeyExW
ADVAPI32.dll493RegQueryValueExW
ADVAPI32.dll569SetServiceStatus
SHLWAPI.dll298wnsprintfW
ordentry_vafunction_name
10x1ffbDllRegisterServer
20x241eDllUnregisterServer
30x248fServiceMain
module_namesacsvr.dll
flags0
timestamp2003-03-25 06:41:04
version0.0
ordinal_base1
nFunctions3
nNames3
Names(3)0x2f34
Functions(3)0x2f28
NameOrdinals(3)0x2f40

StringTable 080404B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft EMS SAC Service
FileVersion5.2.3790.0 (srv03_rtm.030324-2048)
InternalNamesacsvr.dll
LegalCopyright(C) Microsoft Corporation. All rights reserved.
OriginalFilenamesacsvr.dll
ProductNameMicrosoft(R) Windows(R) Operating System
ProductVersion5.2.3790.0

VS_FIXEDFILEINFO

FileVersion5.2.3790.0
ProductVersion5.2.3790.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype8
offsetsizetypecomment
012288DLL03/26/2003 03:48:01#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278