filenamemapistubdll
size1103872 (0x10d800)
md5563c3f45c1aea3e20259ff2181c8c431
typePE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xb
TimeDateStamp0x5fff2d9b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x222e
Magic0x20b
LinkerVersion2.31
SizeOfCode0x9f600
SizeOfInitializedData0x10d400
SizeOfUninitializedData0x1600
AddressOfEntryPoint0x1330
BaseOfCode0x1000
ImageBase0x63280000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x117000
SizeOfHeaders0x400
CheckSum0x11746b
Subsystem3
DllCharacteristics0x160
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x9f5280x9f600R-X CODE IDATA
.data0xa10000x42d600x42e00RW- IDATA
.rdata0xe40000xf1400xf200R-- IDATA
.pdata0xf40000xa98c0xaa00R-- IDATA
.xdata0xff0000xe5180xe600R-- IDATA
.bss0x10e0000x14200RW- UDATA
.edata0x1100000x740x200R-- IDATA
.idata0x1110000x10ac0x1200RW- IDATA
.CRT0x1130000x580x200RW- IDATA
.tls0x1140000x100x200RW- IDATA
.reloc0x1150000x15f40x1600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1100000x74
IMPORT0x1110000x10ac
RESOURCE00
EXCEPTION0xf40000xa98c
SECURITY00
BASERELOC0x1150000x15f4
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xe7b000x28
LOAD_CONFIG00
Bound_IAT00
IAT0x11140c0x3d0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x633940000x633940080x6338e5cc0x6339303000
module_namehintordfunction_name
KERNEL32.dll131CloseHandle
KERNEL32.dll222CreateProcessA
KERNEL32.dll232CreateSemaphoreW
KERNEL32.dll247CreateToolhelp32Snapshot
KERNEL32.dll269DeleteCriticalSection
KERNEL32.dll305EnterCriticalSection
KERNEL32.dll351ExitProcess
KERNEL32.dll536GetCurrentProcess
KERNEL32.dll537GetCurrentProcessId
KERNEL32.dll541GetCurrentThreadId
KERNEL32.dll610GetLastError
KERNEL32.dll695GetProcessHeap
KERNEL32.dll747GetSystemTimeAsFileTime
KERNEL32.dll775GetTickCount
KERNEL32.dll836HeapAlloc
KERNEL32.dll864InitializeCriticalSection
KERNEL32.dll868InitializeProcThreadAttributeList
KERNEL32.dll890IsDBCSLeadByteEx
KERNEL32.dll952LeaveCriticalSection
KERNEL32.dll1000MultiByteToWideChar
KERNEL32.dll1033OpenProcess
KERNEL32.dll1061Process32First
KERNEL32.dll1063Process32Next
KERNEL32.dll1094QueryPerformanceCounter
KERNEL32.dll1103QueueUserAPC
KERNEL32.dll1113RaiseException
KERNEL32.dll1155ReleaseSemaphore
KERNEL32.dll1179ResumeThread
KERNEL32.dll1180RtlAddFunctionTable
KERNEL32.dll1181RtlCaptureContext
KERNEL32.dll1188RtlLookupFunctionEntry
KERNEL32.dll1194RtlUnwindEx
KERNEL32.dll1195RtlVirtualUnwind
KERNEL32.dll1291SetLastError
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll1361Sleep
KERNEL32.dll1376TerminateProcess
KERNEL32.dll1394TlsAlloc
KERNEL32.dll1395TlsFree
KERNEL32.dll1396TlsGetValue
KERNEL32.dll1397TlsSetValue
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1423UpdateProcThreadAttribute
KERNEL32.dll1437VirtualAlloc
KERNEL32.dll1438VirtualAllocEx
KERNEL32.dll1443VirtualProtect
KERNEL32.dll1444VirtualProtectEx
KERNEL32.dll1445VirtualQuery
KERNEL32.dll1453WaitForSingleObject
KERNEL32.dll1490WideCharToMultiByte
KERNEL32.dll1519WriteProcessMemory
KERNEL32.dll1545lstrcmpiA
msvcrt.dll64___lc_codepage_func
msvcrt.dll67___mb_cur_max_func
msvcrt.dll80__doserrno
msvcrt.dll84__iob_func
msvcrt.dll94__pioinfo
msvcrt.dll121_amsg_exit
msvcrt.dll189_errno
msvcrt.dll209_filelengthi64
msvcrt.dll210_fileno
msvcrt.dll234_fstat64
msvcrt.dll284_initterm
msvcrt.dll386_lock
msvcrt.dll395_lseeki64
msvcrt.dll656_strnicmp
msvcrt.dll712_unlock
msvcrt.dll827_wfopen
msvcrt.dll858_write
msvcrt.dll900abort
msvcrt.dll917calloc
msvcrt.dll934fclose
msvcrt.dll937fflush
msvcrt.dll939fgetpos
msvcrt.dll947fopen
msvcrt.dll951fputc
msvcrt.dll952fputs
msvcrt.dll955fread
msvcrt.dll956free
msvcrt.dll963fsetpos
msvcrt.dll968fwrite
msvcrt.dll971getc
msvcrt.dll976getwc
msvcrt.dll989isspace
msvcrt.dll995iswctype
msvcrt.dll1008localeconv
msvcrt.dll1014malloc
msvcrt.dll1020memchr
msvcrt.dll1021memcmp
msvcrt.dll1022memcpy
msvcrt.dll1023memmove
msvcrt.dll1024memset
msvcrt.dll1033putc
msvcrt.dll1036putwc
msvcrt.dll1042realloc
msvcrt.dll1050setlocale
msvcrt.dll1051setvbuf
msvcrt.dll1052signal
msvcrt.dll1057sprintf
msvcrt.dll1066strcmp
msvcrt.dll1067strcoll
msvcrt.dll1071strerror
msvcrt.dll1072strftime
msvcrt.dll1073strlen
msvcrt.dll1076strncmp
msvcrt.dll1087strtoul
msvcrt.dll1088strxfrm
msvcrt.dll1103towlower
msvcrt.dll1104towupper
msvcrt.dll1105ungetc
msvcrt.dll1106ungetwc
msvcrt.dll1107vfprintf
msvcrt.dll1121wcscoll
msvcrt.dll1125wcsftime
msvcrt.dll1126wcslen
msvcrt.dll1145wcsxfrm
msvcrt.dll1191_write
msvcrt.dll1233_read
msvcrt.dll1260_fileno
msvcrt.dll1264_fdopen
ordentry_vafunction_name
10x17a3FixMAPI
module_namedllexport_hook_queueuserapc_x64_shellcode_inject_base.dll
flags0
timestamp2021-01-13 17:27:55
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x11002c
Functions(1)0x110028
NameOrdinals(1)0x110030
offsetsizetypecomment
15c115HTM#
15d01098288BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x10e5cc